Privacy Policy

Last updated: 18 October 2026

This page explains what personal data u2aistudio.com collects, why, on what legal basis, where it is kept and for how long. The site has two forms, a contact form and a career application form. In addition, visits are measured with Google Analytics only if you allow it. There is no account, no sign-in, no payment and no advertising shown on the site.

1. Scope and data controller

This notice covers u2aistudio.com and its subdomains, together with the two forms published on the site and the certificate verification service (/certification). It is written to meet the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies, the GDPR. The data controller is:

Trade name: U2 AI Studio Teknoloji Anonim Şirketi
Registered office: Ahi Evran OSB Mah. Erkunt Cad. No: 3 Door No: 41, Sincan / Ankara, Türkiye
MERSİS: 0883124471000001 · Ankara Trade Registry: 434199 · Tax office / number: Sincan / 8831244710
E-mail: info@u2aistudio.com · Registered e-mail (KEP): u2aistudio@hs01.kep.tr
Telephone: +90 850 346 82 82 · +1 415 712 78 82

Two companion texts sit next to this one and say the same things in more detail for their own subject: the KVKK disclosure text and the Cookie Policy.

2. What we collect, why, and for how long

We collect what a form field asks for, the small amount of technical data needed to deliver and protect the site, and, if you allow it, visit measurement data. The table below is the whole picture; there is nothing collected outside it.

Data	Purpose	Legal basis	Retention
Contact form: name, e-mail, company, subject, message	Answering your message and conducting the correspondence it starts	KVKK Art. 5/2-c and 5/2-f; GDPR Art. 6(1)(b) and 6(1)(f)	24 months after the last message exchanged about your request
Career application form: name, e-mail, telephone, area of interest, message, CV as a PDF file of at most 5 MB	Evaluating your application for an open or upcoming role	KVKK Art. 5/2-c and 5/2-f; GDPR Art. 6(1)(b) and 6(1)(f)	12 months from the application; longer only if you ask us in writing. If you join us, the file moves into your employee record and follows employment-law retention
Technical and anti-spam data: the page a form was sent from, the moment the form was opened, and the connection data (including IP address) processed by our infrastructure provider while serving the site	Blocking automated submissions, site security, fault diagnosis	KVKK Art. 5/2-f; GDPR Art. 6(1)(f)	12 months at most
Certificate record: name, e-mail, a masked form and a one-way digest of the Turkish identity number (the full number is not stored), programme and training name, dates, duration, grade, instructor name and signature, certificate number and PDF file; the e-mail sending and delivery record (time sent, recipient address, whether it was delivered or bounced)	Issuing certificates to people who complete our programmes and sending them by e-mail; allowing third parties to verify a certificate by its number or QR code. The verification page shows the name, the training and the certificate details; it never shows the e-mail address or the full identity number	KVKK Art. 5/2-c and 5/2-f; GDPR Art. 6(1)(b) and 6(1)(f)	10 years from the date of issue
Certificate panel sign-in: the authorised staff member's e-mail address, digests of the one-time sign-in code and of the session token, an activity log	Keeping the panel to authorised staff and recording who carried out each certificate action	KVKK Art. 5/2-f; GDPR Art. 6(1)(f)	Sign-in codes are valid for 10 minutes and sessions for 12 hours, and expired ones are deleted within a day; the activity log is kept with the certificate it concerns for 10 years
Visit measurement (only if you allow it): the Google Analytics cookie identifier, pages visited, where you came from, interactions (scrolling, outbound and contact link clicks, the fact that a form was sent; not its content), device and browser type, language, approximate location derived from the IP address	Measuring, in aggregate, how the site is used and how our advertising campaigns on YouTube and Google perform	KVKK Art. 5/1 explicit consent; GDPR Art. 6(1)(a)	Cookies for up to 2 years (advertising measurement cookies 90 days); detailed data in Google Analytics is deleted automatically after 14 months. Withdrawing consent deletes the cookies from your device

At the end of the retention period the record is deleted from the database and the related notification e-mail is deleted with it. No decision about you is taken by automated means, and we do not build profiles or scores from form data.

Please do not put special categories of personal data (health, religious or philosophical belief, biometric or genetic data, criminal records, trade union membership) into your message or your CV. If such data reaches us anyway, we delete it instead of processing it further.

3. We do not ask for consent for the forms, and what the checkbox means

Answering a message you sent us, and evaluating an application you submitted, are processing activities that KVKK Art. 5/2 permits without consent: they are directly related to the establishment or performance of a relationship you initiated (Art. 5/2-c) and to our legitimate interest in responding to it (Art. 5/2-f). Asking for consent where another legal basis already exists would misstate the basis, so we do not ask for it.

The checkbox on the forms is therefore a confirmation that you have read this notice before sending, not a consent declaration. You do not need to withdraw anything to stop the processing; you can simply ask us to delete the record (see section 8).

Sending a form does not add you to any mailing list, and we do not send commercial electronic messages to the addresses collected through these forms. If we ever offer a newsletter, it will be a separate opt-in with prior consent under Art. 6 of Law No. 6563.

We rely on consent in one place only: visit and advertising measurement with Google Analytics and the related transfer abroad (sections 5 and 6). That consent is asked for separately in the bar at the foot of the page, is independent of the forms, and declining it does not affect your use of them.

4. Where the data is kept and who sees it

When you submit a form, or when a certificate is issued to you, the record is written to the database on the server that runs the site (Amazon Web Services, Frankfurt); for form submissions, a notification e-mail is sent to info@u2aistudio.com. Contact requests are read by the business unit that can answer them; applications are read by the people running the hiring process. Access is limited by role, and no one outside that need sees the record.

The parties involved are:

Amazon Web Services EMEA SARL: the server that runs the site and the database that holds form records, CV files and certificate records (Frankfurt, Germany); sending certificate and panel sign-in e-mails (Amazon SES).
Cloudflare: domain name (DNS) service.
Google Fonts (fonts.googleapis.com, fonts.gstatic.com): serving font files. No cookie is set for this site, but your IP address and browser information are processed by Google when the font is requested, and that request may be served from the United States.
Google LLC (Google Analytics and Google Ads, United States): visit and advertising measurement, only if you allow it. Google Analytics does not store your IP address; ad personalisation is switched off.
Our corporate e-mail provider: delivering the notification message.
Our legal and financial advisers, and authorised public authorities where the law requires disclosure.

We do not sell, rent or trade personal data, and we do not share it for anyone else's marketing.

5. Transfers abroad

The infrastructure that serves this site is global, so form records and technical data may be stored or processed outside Türkiye. Such transfers are made within the framework permitted by KVKK Art. 9 and in line with the decisions of the Personal Data Protection Board; where the GDPR applies, they rely on the transfer mechanisms of its Chapter V. The site, its records and the sending of certificate e-mails are in the Frankfurt (Germany) region of Amazon Web Services.

If you allow it, Google Analytics and Google Ads measurement data are transferred to Google LLC (United States). As there is no adequacy decision of the Board for the United States, this transfer relies on the explicit consent you give after being informed of the possible risks (KVKK Art. 9/6-a). The risks: personal data may not be protected in the United States to the level it is in Türkiye, it may be subject to access by US public authorities, and exercising your rights there may be harder. For the purposes of the GDPR, Google LLC is certified under the EU-US Data Privacy Framework.

Two transfers are under your own control: if you do not allow Google Analytics, that transfer never happens; and if you would rather your browser did not contact Google Fonts, blocking that domain leaves the site fully readable and only changes the typeface.

6. Cookies and local storage

Your language is taken from the address you are on (/ and /tr/), not from a cookie, and because visitors have no account or sign-in, no session cookie is created. Signing in to the certificate panel, used only by authorised U2 AI Studio staff, sets a strictly necessary session cookie (u2s_oturum, 12 hours).

Google Analytics cookies (_ga and _ga_6DG64V0GV1, 2 years) and Google Ads measurement cookies (_gcl_au and _gcl_aw, 90 days) are set only if you choose "Accept" in the bar at the foot of the page. While you have not chosen, or if you choose "Decline", Google Analytics is not loaded. Ad personalisation is switched off; there is no ad network, no social tracking pixel, no heat map and no embedded video on the site.

Your choice is written to your browser's local storage under the key u2-cookie-consent. It stays on your device, it is not a cookie and it is never sent to us. You can withdraw consent at any time through the Cookie settings link at the foot of every page; the Google cookies are then deleted from your device.

Cloudflare, as the infrastructure provider, may set technical cookies for security and bot protection. These are strictly necessary for delivering the service and are not used for advertising or profiling. Details are in the Cookie Policy.

7. Security

The site is served over HTTPS/TLS, so form contents travel encrypted. Records are kept in our infrastructure provider's managed database; access follows least privilege and is limited to named staff. Attachments are accepted only as PDF and only up to 5 MB, and the forms carry a timing check that filters automated submissions.

No system can be made completely secure, and we do not claim any certification or accreditation that we do not hold. If a breach occurs that is likely to create a risk for you, we notify the Personal Data Protection Board and the affected individuals in accordance with KVKK Art. 12/5, and Arts. 33-34 of the GDPR where it applies.

8. Your rights and how to use them

Under KVKK Art. 11 you may:

learn whether your personal data is being processed;
request information about it if it has been processed;
learn the purpose of the processing and whether the data is used in line with that purpose;
know the third parties in Türkiye or abroad to whom it has been transferred;
ask for it to be corrected if it is incomplete or inaccurate;
ask for it to be erased or destroyed once the conditions are met;
ask that correction, erasure or destruction be notified to the third parties the data was transferred to;
object to a result produced solely by automated analysis (we produce none on this site);
claim compensation for damage suffered because of unlawful processing.

Where the GDPR applies you also have the rights of access, rectification, erasure, restriction of processing, objection and data portability, and the right to lodge a complaint with your supervisory authority.

For visit measurement, which relies on consent, you can withdraw your consent at any time and without giving reasons through the Cookie settings link at the foot of every page.

Under Art. 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your request in writing, to our registered e-mail (KEP) address, with a secure electronic signature or mobile signature, or from an e-mail address you have previously given us and that is registered in our systems. We conclude the request as soon as possible and within thirty days at the latest, free of charge; if the operation entails a cost, the fee in the Board's tariff may be charged (KVKK Art. 13). If your request is refused, the answer is insufficient, or no answer arrives in time, you may complain to the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of the application (KVKK Art. 14).

9. Children

This site, its forms and our services are not directed at people under 18, and we do not knowingly collect their personal data. If you believe a person under 18 has sent us data through a form, write to info@u2aistudio.com and we will delete the record.

10. Changes to this notice

We update this page when the site changes, for example when a form, a field or a service provider changes. Updates take effect prospectively from the date they are published here; they do not retroactively alter the basis on which data already collected has been processed. Material changes are also announced on the homepage. If a change ever required your consent, we would ask for it separately rather than infer it from your continued use of the site.

11. Contact

For privacy questions and for requests under KVKK Art. 11: info@u2aistudio.com · KEP u2aistudio@hs01.kep.tr · +90 850 346 82 82 · +1 415 712 78 82 · Ahi Evran OSB Mah. Erkunt Cad. No: 3 Door No: 41, Sincan / Ankara, Türkiye.