KVKK Information Notice

Last updated: 18 October 2026

This notice is issued by U2 AI Studio Teknoloji Anonim Şirketi as data controller under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It explains which personal data we process through this website and the contact channels published on it, on which legal basis, how long we keep it, and how you can exercise your rights. It applies together with our Privacy Policy and Cookie Policy.

1. Data Controller

Under Law No. 6698, your personal data is processed by U2 AI Studio Teknoloji Anonim Şirketi ("U2 AI Studio") acting as data controller. Our identification and contact details are set out below.

Legal name	U2 AI Studio Teknoloji Anonim Şirketi (joint-stock company)
MERSIS no	0883124471000001
Trade registry	Ankara Trade Registry, no. 434199
Tax office / no	Sincan, 8831244710
Registered office	Ahi Evran OSB Mah. Erkunt Cad. No: 3 Inner Door No: 41, Sincan / Ankara, Türkiye
Phone	+90 850 346 82 82 · +1 415 712 78 82
E-mail	info@u2aistudio.com
Registered e-mail (KEP)	u2aistudio@hs01.kep.tr

This notice covers u2aistudio.com and the contact channels published on it. Where you use one of our products or platforms through its own website or application, the notice published there applies to that use.

2. Personal Data We Process

Depending on the channel you use, we may process the following categories of personal data:

Identity: name, surname, title.
Contact: e-mail address, telephone number, address, company and role.
Request and complaint records: the subject and content of the message you send through the contact form or by e-mail, and the correspondence that follows.
Professional experience: the CV file and its attachments that you send through the career application channel, including education, work history, references and any other content you choose to include.
Training and certificate details: the name, dates, duration and grade of the programme and training you took part in, the instructor's name and the certificate number; only a masked form and a one-way digest of your Turkish identity number (the full number is not stored).
Customer, business partner and transaction records: demo and proposal records, contract, order and invoice details.
Marketing (visit and advertising measurement), only if you allow it: the Google Analytics cookie identifier, pages visited, where you came from, interactions on the site, device and browser type, language and an approximate location derived from the IP address.
Transaction security: IP address, time of request, browser and device information, and the server and security logs created while the site is delivered.

Special categories of personal data. Please do not include special categories of personal data (such as health, biometric or genetic data, criminal conviction records, religious, philosophical or political opinion, or trade-union membership) in your messages, in your CV or in its attachments. We do not request such data and do not use it in evaluating an application; if it nevertheless reaches us inside a document, it is not processed for any purpose and is removed at the first opportunity.

3. How We Collect Your Data

We collect personal data by wholly or partly automated means, through the following channels:

The contact form on the website, or the e-mail and KEP addresses published on it.
The application channel on the careers page (the career form or e-mail), including the CV file and attachments you send.
Telephone calls and written correspondence.
The documents and details you share while a business relationship is being established or performed.
The details our authorised staff enter in the certificate panel to issue a certificate, while you take part in our training and internship programmes.
Server and security records generated automatically while the site is served.
Google Analytics cookies and the measurement script, only if you allow them.

Apart from strictly necessary cookies, this website sets only the Google Analytics cookies you allow; the strictly necessary session cookie of the certificate panel, used only by our authorised staff, is never set for visitors. Details are in our Cookie Policy, and the wider picture is in our Privacy Policy.

4. Purposes of Processing

Your personal data is processed for the following purposes:

Receiving and answering your requests, questions and complaints.
Running demo, proposal and other pre-contractual processes.
Establishing and performing contracts and managing the related invoicing and records.
Evaluating job applications and running the recruitment process.
Issuing and sending certificates to people who complete our training and internship programmes, and allowing third parties to verify them.
Keeping requests, applications and correspondence on record as evidence in the event of a dispute.
Meeting our obligations under tax, commercial and personal data protection legislation.
Securing the website and the infrastructure that serves it, including spam and bot protection.
If you allow it, measuring in aggregate how the site is used and how our advertising campaigns perform.

We do not use your data for personalised advertising or remarketing, or for any purpose beyond those listed above; we do no profiling that takes automated decisions about you, and we do not sell or rent your data.

5. Legal Basis

Except for visit measurement in the last row of the table, your personal data is processed on the conditions listed in Article 5/2 of the KVKK, for which explicit consent is not required. The basis of each processing activity is set out separately below.

Processing activity	Data	Legal basis (KVKK Art. 5/2; last row Art. 5/1)
Answering a message sent through the contact form or by e-mail and running the pre-contractual process	Identity, contact, request records	(c) direct connection with the establishment or performance of a contract; (f) legitimate interest
Establishing and performing a contract, managing demo, proposal and delivery processes	Identity, contact, customer and transaction records	(c) establishment or performance of a contract
Evaluating a job application and keeping the CV during the process	Identity, contact, professional experience (CV)	(c) direct connection with the establishment of an employment contract; (f) legitimate interest
Issuing a training or internship certificate, sending it to the participant and showing it on the verification page	Identity, contact, training and certificate details	(c) direct connection with the performance of the training or internship relationship; (f) legitimate interest in the authenticity of the certificate being verifiable
Keeping requests, applications and correspondence on record for possible disputes	All categories above	(e) processing necessary for the establishment, exercise or protection of a right
Bookkeeping, invoicing, tax obligations and responding to KVKK applications	Identity, contact, transaction records	(ç) compliance with a legal obligation of the data controller
Security of the site and infrastructure, spam and bot protection, log keeping	Transaction security data	(f) legitimate interest, provided your fundamental rights are not harmed
Visit and advertising measurement with Google Analytics, if you allow it	Marketing (visit and advertising measurement) data	Art. 5/1 explicit consent

We rely on explicit consent for visit measurement only. Explicit consent is governed by Article 5/1 of the KVKK and is separate from the legal bases in Article 5/2. Of the processing described in this notice, only visit and advertising measurement with Google Analytics depends on your consent; that consent is asked for separately in the bar at the foot of the page and can be withdrawn at any time through the Cookie settings link at the foot of every page. Withdrawing consent does not affect the lawfulness of processing carried out before. A confirmation box on our forms, where present, is an acknowledgement that you have read this notice. It is not a consent, and not ticking it or withdrawing it does not change the basis on which your request is handled. Article 4 of the KVKK, which sets out the general principles (lawfulness and fairness, accuracy, purpose limitation, data minimisation and storage limitation), governs all of the processing above but is not itself a legal basis.

This website operates no newsletter or other commercial electronic message channel. If one is added, consent will be collected separately under Article 6 of Law No. 6563 on the Regulation of Electronic Commerce and Article 5/1 of the KVKK, and this notice will be updated.

6. Transfers and Cross-Border Transfers

Your data is shared only to the extent necessary for the purposes above, with:

Our infrastructure provider Amazon Web Services EMEA SARL, which hosts this website and sends certificate e-mails (servers in Frankfurt, Germany), and our domain name provider Cloudflare.
Google LLC (United States), which provides Google Analytics and Google Ads, only if you allow it.
Our e-mail, file storage and office software providers.
Our professional advisors (independent accountant and legal counsel), who are bound by a duty of confidentiality.
Authorised public authorities and courts, where there is a statutory request or obligation.
Business partners, only where necessary to carry out the work you have asked for.

Some of these providers are established outside Türkiye. A cross-border transfer is made under Article 9 of the KVKK: on the basis of an adequacy decision of the Personal Data Protection Board where one exists; in the absence of such a decision, on one of the appropriate safeguards listed in Article 9/3, most commonly the standard contract published by the Board, which must be notified to the Authority within five business days of signature; and where neither is available, only in the incidental cases listed in Article 9/6.

The fonts on this site are served from Google Fonts. When a font is requested, your IP address and browser information may be processed by Google, which can involve a transfer to the United States; see our Cookie Policy.

Google Analytics. If you allow it, visit and advertising measurement data is transferred to Google LLC (United States). There is no adequacy decision of the Board for the United States; this transfer relies on the explicit consent you give after being informed of the possible risks (KVKK Art. 9/6-a). The risks: personal data may not be protected in the United States to the level it is in Türkiye, it may be subject to access by US public authorities, and exercising your rights there may be harder. If you do not consent, or withdraw consent, this transfer does not take place.

7. Retention Periods

We keep your data only for as long as the purpose of processing requires, and never for less than the minimum periods set by law.

Record	Retention period	Reason
Contact form or e-mail enquiry and the related correspondence	2 years from the last correspondence	Our practice; kept as evidence of the request (Art. 5/2-e and 5/2-f)
Job application, CV file and its attachments	1 year from the conclusion of the application process, then deleted	Our practice; deleted earlier if you ask
Contract, invoice and accounting records	10 years from the end of the calendar year in which the record was made	Article 82 of the Turkish Commercial Code No. 6102; books and documents kept for at least 5 years under Article 253 of the Tax Procedure Law No. 213
Certificate records, PDF files, e-mail sending and delivery records and the related activity log	10 years from the date of issue	Keeping certificates verifiable by third parties (Art. 5/2-c and 5/2-f); the period is consistent with Article 82 of the Turkish Commercial Code No. 6102. Revoked certificates are kept for the same period with their revocation record
Certificate panel sign-in codes and sessions	Codes are valid for 10 minutes and sessions for 12 hours; expired ones are deleted within a day	Panel security (Art. 5/2-f)
Server and security logs (IP address, time of request, browser information)	Up to 12 months	Security of the site and the infrastructure (Art. 5/2-f); held by our infrastructure provider on our behalf
Google Analytics cookies and measurement data (only if you allow it)	Cookies up to 2 years (advertising measurement cookies 90 days); detailed data in Google Analytics 14 months	Explicit consent (Art. 5/1); withdrawing consent deletes the cookies from your device and stops new data being collected
KVKK applications and the responses we give	2 years from the date of the response	Our practice; kept to show that the response was given within the legal period

At the end of the period the data is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data; under Article 11 of that Regulation, a periodic destruction interval may not exceed six months; ours runs once a day and every run is written to a destruction log.

8. Security and Automated Decisions

We apply technical and organisational measures under Article 12 of the KVKK: encryption in transit (TLS), access control on a least-privilege basis, separation of duties, and logging of access to records. No measure makes a system entirely free of risk, and we make no certification or accreditation claim for this website.

No decision producing a legal effect on you, or a comparably significant effect, is taken about you solely by automated means through this website. Job applications are reviewed by people within our human resources processes; no application is concluded by an automated system alone.

9. Your Rights Under Article 11

As a data subject, under Article 11 of the KVKK you have the right to:

learn whether your personal data is processed (Art. 11/1-a);
request information about it if it has been processed (b);
learn the purpose of processing and whether the data is used in accordance with that purpose (c);
know the third parties in Türkiye or abroad to whom the data is transferred (ç);
request correction of the data where it is incomplete or inaccurate (d);
request deletion or destruction of the data where the conditions in Article 7 are met (e);
request that a correction, deletion or destruction carried out under (d) and (e) be notified to the third parties to whom the data has been transferred (f);
object to a result to your detriment arising from analysis of the data exclusively by automated systems (g);
claim compensation for loss suffered as a result of unlawful processing (ğ).

10. How to Apply

You may submit a request under Article 11 through the channels set out in Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller:

In writing: Ahi Evran OSB Mah. Erkunt Cad. No: 3 Inner Door No: 41, Sincan / Ankara, Türkiye (delivered in person with identification, or through a notary).
Registered e-mail (KEP): u2aistudio@hs01.kep.tr
Secure electronic signature or mobile signature: to info@u2aistudio.com
From an e-mail address you have previously notified to us and that is registered in our system: to info@u2aistudio.com

Under Article 5/2 of the Communiqué your application must state your name and surname, and your signature where the application is in writing; your Turkish identity number, or for foreign nationals your nationality, passport number or identity number if any; your address of residence or business for notification; your e-mail address, telephone and fax number if any; and the subject of your request.

Your application is concluded free of charge as soon as possible and within thirty days at the latest; where the process requires an additional cost, the fee in the tariff set by the Board may be charged (Article 13 of the KVKK). If your application is rejected, you find the response insufficient, or no response is given within the period, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of the date of the application (Article 14 of the KVKK).

For questions about this notice: info@u2aistudio.com