KVKK Privacy Notice
Information notice under Article 10 of Turkish Law No. 6698 for website visitors, form submitters and contact persons of customer organizations.
Effective date: · Last updated:
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This information notice has been prepared by ENA Innovation, as data controller, under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
1. Data controller
| Item | Value |
|---|---|
| Legal name | ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation") |
| Address | Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye |
| Personal data contact | support@enainnovation.com |
| Phone | 0850 308 45 91 |
2. Who does this notice cover?
- Website visitors: people who visit www.enafeedback.com.
- Form submitters and people who contact us: people who fill in the contact, demo, free trial or quote form, or reach us by email, phone or WhatsApp.
- Authorized persons and contacts of customer organizations: authorized persons, employees and contacts of organizations that use or are considering EnaFeedback (contract, billing, setup and support processes).
Out of scope: for data of visitors who leave feedback in an organization's EnaFeedback environment (for example, by scanning a QR code in a hospital), and of that organization's staff and users, the organization concerned is the data controller; ENA Innovation processes this data as data processor. The organization concerned provides the privacy notice for this data.
3. Personal data processed
| Data subject group | Data category | Examples |
|---|---|---|
| Website visitor | Transaction security | IP address, browser and device information, page accessed, time |
| Website visitor (organization login page) | Transaction security | Organization code entered, IP address, browser information, country |
| Form submitter / person contacting us | Identity | Full name |
| Contact | Work email, phone | |
| Professional experience | Organization, role, sector | |
| Request / complaint management | Request type, approximate number of locations, message and correspondence | |
| Marketing | Commercial electronic message approval and preferences (only if given) | |
| Customer authorized person / contact | Identity, contact, professional experience | Full name, title, work email and phone |
| Customer transaction | Quotes, orders, contracts, support requests | |
| Finance | Invoice details | |
| Legal transaction | Contract and correspondence records |
ENA Innovation does not ask for special categories of personal data in the processes covered by this notice. Please do not include such data in your message.
4. Purposes and legal grounds
| Purpose | Legal ground |
|---|---|
| Running the website, ensuring information security, preventing misuse | Art. 5/2-f of the Law: legitimate interest of the data controller, provided it does not harm the data subject's fundamental rights and freedoms |
| Producing aggregate visit and performance statistics | Art. 5/2-f: legitimate interest |
| Redirecting users on the organization login page to the right organization address | Art. 5/2-c: performance of a contract; Art. 5/2-f: legitimate interest |
| Receiving, assessing and answering demo, trial, quote and contact requests | Art. 5/2-c: necessary to enter into a contract; Art. 5/2-f: legitimate interest |
| Entering into and performing customer contracts, setup, support and billing | Art. 5/2-c: entering into and performing a contract |
| Meeting obligations under tax and commercial law, providing information to competent authorities | Art. 5/2-ç: legal obligation |
| Protecting rights in legal disputes | Art. 5/2-e: establishing, exercising or protecting a right |
| Sending commercial electronic messages about product updates and events | Art. 5/1: explicit consent, and approval obtained under Article 6 of Law No. 6563 (optional; answering your request does not depend on this approval) |
5. Method of collection
Your personal data is collected:
- electronically through forms on the website;
- automatically through server logs of the website and the organization login redirect infrastructure;
- by email, phone, WhatsApp and in meetings;
- through documents issued in quote, contract and invoicing processes.
6. Transfers of personal data
Your personal data may be transferred to the following recipients, limited to the purposes above and in line with Articles 8 and 9 of the Law:
| Recipient | Purpose |
|---|---|
| Hosting and content delivery providers (Vercel, Cloudflare) | Publishing and securing the website, aggregate statistics |
| Email delivery provider (Resend) | Forwarding form content to our team and sending you emails |
| Hosting provider of ENA Innovation's central infrastructure (Huawei Cloud) | Organization login redirect and notification infrastructure |
| Accounting, legal and audit advisers | Legal obligations and protection of rights |
| Competent public authorities | Requests from authorities empowered by law |
International transfers: Vercel's and Resend's infrastructure is located in the USA; Cloudflare operates a global network. Transfers to these providers are made under Article 9 of the Law and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, relying on appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board [signature of a standard contract and notification to the Authority to be confirmed for each provider]. If you contact us via WhatsApp, your messages are processed abroad on WhatsApp's (Meta's) infrastructure.
The current list of our service providers is on the Sub-processors page.
7. Retention period
Your personal data is kept for as long as the purpose of processing requires and for the periods set by applicable law; when the period ends, it is deleted, destroyed or anonymized. Retention periods are detailed in Section 9 of the Privacy Policy.
8. Your rights under Article 11 of the Law
By applying to the data controller, you have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used for that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- request correction if it is incomplete or inaccurate;
- request deletion or destruction under the conditions in Article 7 of the Law;
- request that correction, deletion and destruction be notified to the third parties to whom the data was transferred;
- object to a result against you arising from analysis of the data exclusively by automated systems;
- claim compensation if you suffer damage due to unlawful processing.
9. How to apply
You can send requests regarding your rights in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Application methods and the information your application must contain are explained on the Data Subject Request page. Your application is concluded free of charge within 30 days at the latest; if the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.