Back to the studio

KVKK Information Notice

Last updated: 31 October 2026

This notice is issued by U2 AI Studio Teknoloji Anonim Şirketi as data controller under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It explains which personal data we process through this website and the contact channels published on it, on which legal basis, how long we keep it, and how you can exercise your rights. It applies together with our Privacy Policy and Cookie Policy.

1. Data Controller

Under Law No. 6698, your personal data is processed by U2 AI Studio Teknoloji Anonim Şirketi ("U2 AI Studio") acting as data controller. Our identification and contact details are set out below.

This notice covers u2aistudio.com and the contact channels published on it. Where you use one of our products or platforms through its own website or application, the notice published there applies to that use.

2. Personal Data We Process

Depending on the channel you use, we may process the following categories of personal data:

• Identity: name, surname, title.
• Contact: e-mail address, telephone number, address, company and role.
• Request and complaint records: the subject and content of the message you send through the contact form or by e-mail, and the correspondence that follows.
• Professional experience: the CV file and its attachments that you send through the career application channel, including education, work history, references and any other content you choose to include.
• Training and certificate details: the name, dates, duration and grade of the programme and training you took part in, the instructor's name and the certificate number; only a masked form and a one-way digest of your Turkish identity number (the full number is not stored).
• Customer, business partner and transaction records: demo and proposal records, contract, order and invoice details.
• Visit measurement (cookieless): pages visited, where you came from, contact link clicks, browser and device type, language and the country derived from the IP address; the IP address is not stored.
• Transaction security: IP address, time of request, browser and device information, and the server and security logs created while the site is delivered.

Special categories of personal data. Please do not include special categories of personal data (such as health, biometric or genetic data, criminal conviction records, religious, philosophical or political opinion, or trade-union membership) in your messages, in your CV or in its attachments. We do not request such data and do not use it in evaluating an application; if it nevertheless reaches us inside a document, it is not processed for any purpose and is removed at the first opportunity.

3. How We Collect Your Data

We collect personal data by wholly or partly automated means, through the following channels:

• The contact form on the website, or the e-mail and KEP addresses published on it.
• The application channel on the careers page (the career form or e-mail), including the CV file and attachments you send.
• Telephone calls and written correspondence.
• The documents and details you share while a business relationship is being established or performed.
• The details our authorised staff enter in the certificate panel to issue a certificate, while you take part in our training and internship programmes.
• Server and security records generated automatically while the site is served.
• The cookieless visit measurement script running on our own server.

This website sets no cookies for visitors; only the certificate panel, used by our authorised staff, uses a strictly necessary session cookie. Details are in our Cookie Policy, and the wider picture is in our Privacy Policy.

4. Purposes of Processing

Your personal data is processed for the following purposes:

• Receiving and answering your requests, questions and complaints.
• Running demo, proposal and other pre-contractual processes.
• Establishing and performing contracts and managing the related invoicing and records.
• Evaluating job applications and running the recruitment process.
• Issuing and sending certificates to people who complete our training and internship programmes, and allowing third parties to verify them.
• Keeping requests, applications and correspondence on record as evidence in the event of a dispute.
• Meeting our obligations under tax, commercial and personal data protection legislation.
• Securing the website and the infrastructure that serves it, including spam and bot protection.
• If you allow it, measuring in aggregate how the site is used and how our advertising campaigns perform.

We do not use your data for personalised advertising or remarketing, or for any purpose beyond those listed above; we do no profiling that takes automated decisions about you, and we do not sell or rent your data.

5. Legal Basis

Your personal data is processed on the conditions listed in Article 5/2 of the KVKK, for which explicit consent is not required. The basis of each processing activity is set out separately below.

No processing relies on explicit consent. Visit measurement is cookieless and relies on our legitimate interest. A confirmation box on our forms, where present, is an acknowledgement that you have read this notice; it is not a consent.

This website operates no newsletter or other commercial electronic message channel. If one is added, consent will be collected separately under Article 6 of Law No. 6563 on the Regulation of Electronic Commerce and Article 5/1 of the KVKK, and this notice will be updated.

6. Transfers and Cross-Border Transfers

Your data is shared only to the extent necessary for the purposes above, with:

• Our infrastructure provider Amazon Web Services EMEA SARL, which hosts this website and sends certificate e-mails (servers in Frankfurt, Germany), and our domain name provider Cloudflare.
• Our e-mail, file storage and office software provider, Microsoft 365 (data in Microsoft's data centres in Europe).
• Our professional advisors (independent accountant and legal counsel), who are bound by a duty of confidentiality.
• Authorised public authorities and courts, where there is a statutory request or obligation.
• Business partners, only where necessary to carry out the work you have asked for.

Some of these providers are established outside Türkiye. A cross-border transfer is made under Article 9 of the KVKK: on the basis of an adequacy decision of the Personal Data Protection Board where one exists; in the absence of such a decision, on one of the appropriate safeguards listed in Article 9/3, most commonly the standard contract published by the Board, which must be notified to the Authority within five business days of signature; and where neither is available, only in the incidental cases listed in Article 9/6.

7. U2 Account (id.u2aistudio.com) and Subscriptions

All U2 AI Studio products are reached with one U2 account (id.u2aistudio.com); access to a product opens, is restricted or closes according to its payment status. For this we process:

• Account: e-mail address, first and last name, language. Your password is kept only as an irreversible hash; if you use two-step verification, its key is kept with your account.
• Sign-in records: sign-ins, failed sign-ins, password and verification changes; IP address, time and browser.
• Organisation and subscription: company name, country, tax number, billing e-mail, product, plan, number of seats, period and payment status; for bank transfers the amount and the bank transaction number. Card details never reach us.

Purposes and legal bases: opening the account and authentication, managing access to the products, subscription and invoicing (KVKK Art. 5/2-c, formation and performance of a contract); invoicing and accounting records (Art. 5/2-ç, legal obligation); account security and prevention of unauthorised access (Art. 5/2-f, legitimate interest).

Who sees it and where it is kept: the product you subscribe to receives only what it needs to manage your access (organisation id and name, billing e-mail, plan, seats, access status and period); products do not see each other's data. Account and subscription data are kept on Amazon Web Services in the Istanbul local zone; account e-mails (verification, password reset, subscription notices) are sent with Amazon SES from Frankfurt. For card payments Polar Software, Inc. (USA) acts as the seller; the payment infrastructure is Stripe. Cross-border transfers follow section 6.

Retention: when you delete your account, the account data are deleted. If a subscription closes for non-payment, your product data are kept for 90 days from the closure and you are told by e-mail before they are deleted; records that the law requires us to keep are kept for the period the law sets. Sign-in records are kept for 1 year, invoices and payment records for the period in the Retention Periods section.

8. Retention Periods

We keep your data only for as long as the purpose of processing requires, and never for less than the minimum periods set by law.

At the end of the period the data is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data; under Article 11 of that Regulation, a periodic destruction interval may not exceed six months; ours runs once a day and every run is written to a destruction log.

9. Security and Automated Decisions

We apply technical and organisational measures under Article 12 of the KVKK: encryption in transit (TLS), access control on a least-privilege basis, separation of duties, and logging of access to records. No measure makes a system entirely free of risk, and we make no certification or accreditation claim for this website.

No decision producing a legal effect on you, or a comparably significant effect, is taken about you solely by automated means through this website. Job applications are reviewed by people within our human resources processes; no application is concluded by an automated system alone.

10. Your Rights Under Article 11

As a data subject, under Article 11 of the KVKK you have the right to:

1. learn whether your personal data is processed (Art. 11/1-a);
2. request information about it if it has been processed (b);
3. learn the purpose of processing and whether the data is used in accordance with that purpose (c);
4. know the third parties in Türkiye or abroad to whom the data is transferred (ç);
5. request correction of the data where it is incomplete or inaccurate (d);
6. request deletion or destruction of the data where the conditions in Article 7 are met (e);
7. request that a correction, deletion or destruction carried out under (d) and (e) be notified to the third parties to whom the data has been transferred (f);
8. object to a result to your detriment arising from analysis of the data exclusively by automated systems (g);
9. claim compensation for loss suffered as a result of unlawful processing (ğ).

11. How to Apply

You may submit a request under Article 11 through the channels set out in Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller:

• In writing: Ahi Evran OSB Mah. Erkunt Cad. No: 3 Inner Door No: 41, Sincan / Ankara, Türkiye (delivered in person with identification, or through a notary).
• Registered e-mail (KEP): u2aistudio@hs01.kep.tr
• Secure electronic signature or mobile signature: to info@u2aistudio.com
• From an e-mail address you have previously notified to us and that is registered in our system: to info@u2aistudio.com

Under Article 5/2 of the Communiqué your application must state your name and surname, and your signature where the application is in writing; your Turkish identity number, or for foreign nationals your nationality, passport number or identity number if any; your address of residence or business for notification; your e-mail address, telephone and fax number if any; and the subject of your request.

Your application is concluded free of charge as soon as possible and within thirty days at the latest; where the process requires an additional cost, the fee in the tariff set by the Board may be charged (Article 13 of the KVKK). If your application is rejected, you find the response insufficient, or no response is given within the period, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of the date of the application (Article 14 of the KVKK).

For questions about this notice: info@u2aistudio.com