Privacy Policy
How ENA Innovation processes personal data on the www.enafeedback.com website and in the EnaFeedback service.
Effective date: · Last updated:
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This Privacy Policy explains how your personal data is processed when you visit the www.enafeedback.com website, contact us by form, email or phone, when your organization is an EnaFeedback customer, and when you leave feedback at a location that uses EnaFeedback. The information required under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is also provided in the KVKK Privacy Notice.
1. Who we are
ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation", "we") is a technopark company located at Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye. EnaFeedback is a product of ENA Innovation.
For questions about personal data: support@enainnovation.com
2. Our role: data controller or data processor?
ENA Innovation acts in one of two roles, depending on the data:
| Activity | ENA Innovation's role | Data controller |
|---|---|---|
| Running the website; contact, demo and trial requests | Data controller | ENA Innovation |
| Contracts, billing and support with customer organizations | Data controller | ENA Innovation |
| Commercial electronic messages you opted in to | Data controller | ENA Innovation |
| Data processed in an EnaFeedback Customer Environment (visitor feedback, hygiene ratings, tickets, staff and user records, survey responses, etc.) | Data processor | The organization using EnaFeedback (the Customer) |
If you scanned the QR code of an organization such as a hospital, university or municipality and left feedback, that organization is the data controller for your data. Please exercise your rights regarding that data with the organization first. ENA Innovation processes such data only on the organization's instructions and to provide the service.
3. Data processed on the website
3.1. When you visit the website
- Technical logs: our website is hosted on Vercel. When you access the site, your IP address, browser and device information, the requested page and the time are processed in the hosting provider's server logs to run and secure the site.
- Aggregate visit statistics: we use Vercel Web Analytics and Speed Insights. These tools do not use cookies, do not track visitors across sites and give us only aggregate data such as page views, country, device type and page performance. See the Cookie Policy for details.
- Organization login redirect: when you enter your organization code on the "Login" page, your browser connects to ENA Innovation's central redirect service (go.enainnovation.com) to send you to your organization's EnaFeedback address. This service keeps access logs that include IP address, browser information and country.
3.2. When you fill in a form or write to us
Our contact, demo, free trial and quote forms ask for: full name, work email, phone, organization, your role, sector, approximate number of locations, request type and your message. The form content is sent to our team as an email through ENA Innovation's notification infrastructure and its email service provider (Resend).
When you contact us by email, phone or WhatsApp, the content of the conversation and your contact details are processed. When you use WhatsApp, WhatsApp's (Meta's) own privacy terms also apply.
3.3. Commercial electronic messages
If you tick the optional box in a form, we may email you about product updates and events. This approval is obtained under Turkish Law No. 6563 on the Regulation of Electronic Commerce and its regulation, and is recorded in the Message Management System (İYS) [İYS registration to be confirmed]. You can withdraw your approval at any time using the link in each message or by writing to support@enainnovation.com.
4. Data processed in the customer relationship
When your organization is, or is considering becoming, an EnaFeedback customer, we process the full name, title and work contact details of authorized and contact persons, quote, contract and invoice details, and support requests and correspondence.
To set up a Customer Environment, we use the full name and email address of the organization's first administrator. Administrator user accounts are kept with our identity provider, Logto.
5. Data processed in the EnaFeedback service (as data processor)
Depending on the Customer's configuration, the following data may be processed in a Customer Environment:
| Group | Data categories |
|---|---|
| Visitors (patients, companions, students, guests, etc.) | Optional name, phone and email; feedback subject and message; photo, video and audio attachments; hygiene rating; survey responses; selected language; device, operating system and browser information; IP address at feedback submission; session identifiers |
| Field staff | Full name, email, phone, role and status; staff code stored only as a one-way hash; registered device (passkey) details; mobile device details; cleaning and control logs; check-in and check-out times and locations |
| Organization administrators and team members | Name, email, phone, roles; activity and audit records (including IP address and browser information) |
In addition, QR code, NFC tag and live display redirects run through ENA Innovation's central infrastructure (ENA Cloud). This infrastructure logs the IP address, browser information, referring address, code and result for each redirect.
If AI features are switched on, feedback text (sentiment analysis), audio and video attachments (transcription) and text to be translated are sent to the AI provider. AI usage logs do not store prompts or content.
The Customer decides the purposes, legal grounds and retention periods for this data. For details, please refer to the privacy notice of the organization concerned.
6. Purposes and legal grounds (as data controller)
| Purpose | Data categories | Legal ground (KVKK Art. 5) |
|---|---|---|
| Running and securing the website | IP address, browser and device information, access logs | Legitimate interest (Art. 5/2-f) |
| Aggregate visit and performance statistics | Aggregate, non-identifying usage data | Legitimate interest (Art. 5/2-f) |
| Answering demo, trial, quote and contact requests | Identity, contact and professional details, request content | Necessary to enter into a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Entering into and performing customer contracts, billing, support | Identity, contact and professional details, customer transaction and financial details | Performance of a contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| Legal obligations (tax and commercial law, requests from authorities) | Invoice and contract records | Legal obligation (Art. 5/2-ç) |
| Protecting rights in legal disputes | Relevant records | Establishing, exercising or protecting a right (Art. 5/2-e) |
| Sending commercial electronic messages | Name, email, preference and approval records | Explicit consent (Art. 5/1) and commercial message approval under Article 6 of Law No. 6563 |
For visitors from the European Economic Area, the corresponding GDPR legal grounds are contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interest (Art. 6(1)(f)) and consent (Art. 6(1)(a)).
7. Recipients
We do not sell your personal data. Data is shared only with the following recipients, limited to the purpose:
- Our service providers (data processors): hosting, content delivery, email and SMS delivery, identity, error monitoring and AI services. Current list: Sub-processors. The website also uses Vercel (hosting and aggregate analytics).
- Competent public authorities: on request of authorities empowered by law.
- Professional advisers: lawyers, accountants and auditors, under confidentiality obligations.
- The customer organization: data we process as data processor is made available to the authorized users of the Customer, which is the data controller.
8. International transfers
Some of our service providers are located abroad or use infrastructure abroad. In particular:
- our website is hosted on Vercel (USA), which also provides the aggregate analytics;
- form content and service emails are sent through Resend (USA);
- all traffic to EnaFeedback environments and ENA Innovation's central infrastructure passes through Cloudflare, a global network, which also provides DNS for the website's domain;
- when AI features are on, content is sent to the AI provider (Google by default).
These transfers are made under Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. For transfers to countries without an adequacy decision, we rely on one of the appropriate safeguards provided in the law, such as the standard contracts announced by the Personal Data Protection Board; standard contracts are notified to the Personal Data Protection Authority within five business days of signature. [It is to be confirmed for each provider that the standard contract has been signed and notified to the Authority.] In exceptional cases where an appropriate safeguard cannot be provided, transfers are made only under the incidental transfer conditions listed in Article 9/6 of the KVKK.
The hosting region of a Customer Environment is stated in the agreement with the Customer.
9. Retention periods
| Data | Retention period |
|---|---|
| Website server logs | For the hosting provider's standard log retention period [period to be confirmed] |
| Aggregate analytics data | Kept as aggregate, non-identifying data |
| Demo, trial and contact requests that do not lead to a contract | [2 years] from the last contact |
| Customer contracts, invoices and related correspondence | 10 years from the end of the contract (taking into account the Turkish Commercial Code, tax law and the limitation periods in the Turkish Code of Obligations) |
| Commercial message approval and opt-out records | 3 years from withdrawal of approval (under the applicable regulation) |
| Data in a Customer Environment (as data processor) | The period set by the Customer; deleted from live systems within 30 days after the contract ends |
When the period ends, data is deleted, destroyed or anonymized.
10. Security measures
Our main technical and organizational measures to protect personal data are:
- A separate application stack, separate database and separate database user for each Customer.
- All traffic passes through Cloudflare and is encrypted in transit with TLS.
- Administrator access by invitation only, with role-based authorization built on 7 roles and 35 permission scopes.
- Staff codes stored only as a one-way hash (Argon2id), with temporary lockout after failed attempts.
- Provider and AI keys connected by the Customer stored encrypted with AES-256-GCM.
- Activity written to audit records protected against tampering by a chained hash (HMAC).
- Rate limiting, security headers, and masked display of some contact details in the admin panel.
- Automated source code security scans for software releases.
- Regular database backups.
- Confidentiality obligations for our staff and access limited to what their role requires.
Our ISO 27001 and ISO 9001 certification processes are in progress. No system is completely secure; if a data breach occurs, we make the notifications required by law.
11. Your rights
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing; to know the recipients to whom it is transferred; to request correction, deletion or destruction; to request that these actions be notified to recipients; to object to a result against you arising from automated analysis; and to claim compensation for damage caused by unlawful processing. People covered by the GDPR also have the rights to restriction of processing, data portability and objection.
See the Data Subject Request page for how to apply. If your request concerns data processed by an EnaFeedback customer, we recommend that you contact that organization first; we forward such requests that reach us to the organization concerned.
12. Children
Our website is aimed at business buyers and is not directed at people under 18. Decisions on processing children's data at locations using EnaFeedback belong to the organization that is the data controller.
13. Changes
We may update this policy. The current version is published on this page with its effective and update dates.
14. Contact
- Legal name: ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş.
- Address: Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye
- Personal data: support@enainnovation.com
- General: support@enainnovation.com
- Phone: 0850 308 45 91