GDPR Privacy Notice
Information under Articles 13 and 14 of the EU General Data Protection Regulation for people in the European Economic Area whose personal data ENA Innovation processes.
Effective date: · Last updated:
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This notice is for people in the European Economic Area (EEA) whose personal data is processed by ENA Innovation, for example when they visit www.enafeedback.com, contact us, or work for a customer organization. It supplements our Privacy Policy, which describes all processing in detail, and is given under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"). For processing under Turkish law, see the KVKK Privacy Notice.
1. Controller
ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş., Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye. Contact for personal data: support@enainnovation.com.
- EU representative (Art. 27 GDPR): [to be appointed and confirmed].
- Data protection officer: we have not appointed a data protection officer, because the conditions of Article 37 GDPR do not apply to our processing. Write to the address above for any data protection question.
2. When we are controller and when we are processor
We are the controller for the website, contact, demo and trial requests, customer contracts, billing, support and commercial messages you opted in to.
We are a processor for data processed in an EnaFeedback Customer Environment, such as visitor feedback, hygiene ratings, survey answers and staff records. The organization that uses EnaFeedback (for example a hospital, hotel or university) is the controller for that data and must give you its own privacy notice. We process such data only on the customer's documented instructions, under a Data Processing Agreement that contains the terms required by Article 28 GDPR. Please send requests about that data to the organization; requests that reach us are forwarded to it.
3. Data, purposes and legal bases
| Purpose | Data | Legal basis (Art. 6(1) GDPR) |
|---|---|---|
| Running and securing the website | IP address, browser and device data, access logs | Legitimate interests (f): a secure, working website |
| Aggregate visit and performance statistics (no cookies) | Aggregate, non-identifying usage data | Legitimate interests (f): improving the website |
| Answering demo, trial, quote and contact requests | Name, work contact details, organization, role, message | Steps prior to a contract (b); legitimate interests (f) |
| Customer contracts, billing and support | Contact persons' details, contract and invoice data, support correspondence | Contract (b); legal obligation (c) |
| Commercial e-mails | Name, e-mail, consent records | Consent (a), which you can withdraw at any time |
| Establishing or defending legal claims | Relevant records | Legitimate interests (f) |
Where we rely on legitimate interests, we have weighed them against your interests and rights; you can ask us for details. We do not process special categories of data as controller. When we receive your data from someone else (for example from your employer, a customer organization), it is limited to your name, work contact details and role.
4. Recipients
We share data only with service providers acting as our processors (hosting, content delivery, e-mail and SMS delivery, identity, error monitoring and AI services; see Sub-processors), with professional advisers under confidentiality, and with public authorities where the law requires it. We do not sell personal data.
5. Transfers outside the EEA
ENA Innovation is established in Türkiye, so data you send to us is transferred to Türkiye, which has no adequacy decision of the European Commission. Some of our providers process data in other countries, including the USA (for example Vercel, Resend and Cloudflare).
For these transfers we rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) or, for providers certified under it, the EU-U.S. Data Privacy Framework (Art. 45 GDPR), together with supplementary measures such as encryption in transit. [The safeguard used for each provider is to be confirmed.] You can ask for a copy of the relevant safeguards at the address above.
6. Retention
We keep data only as long as needed for the purpose and as required by law. The periods are listed in section 9 of the Privacy Policy; for example, contact requests that do not lead to a contract are deleted [2 years] after the last contact.
7. Your rights
You have the right to:
- access your data (Art. 15) and receive a copy;
- have inaccurate data corrected (Art. 16);
- have data erased (Art. 17);
- restrict processing (Art. 18);
- data portability for data you gave us on the basis of consent or contract (Art. 20);
- object at any time to processing based on legitimate interests, and to direct marketing (Art. 21);
- withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).
Use the Data Subject Request page or write to support@enainnovation.com. We answer within one month; this can be extended by two months for complex requests, in which case we tell you why.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EEA country where you live, work or where the alleged infringement took place.
8. Is providing data required?
Website use requires no personal data beyond technical logs. Information marked as required in our forms is needed to answer your request; without it we cannot respond. Contract data is needed to conclude and perform the contract.
9. Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22). Optional AI features in the EnaFeedback service (sentiment analysis, transcription, translation) support the customer's staff and do not take such decisions.
10. Changes
We may update this notice. The current version is published on this page with its effective and update dates.