Privacy Notice (KVKK)

As Clevel Yapay Zeka ve Teknoloji A.Ş. ("Clevel" or the "Company"), we attach great importance to the protection of your personal data. This Privacy Notice has been prepared pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform you about the personal data processed when you visit the clevel.group website (the "Site") and use the forms on the Site.

1. Data Controller

Your personal data is processed by the Company, acting as data controller, whose details are set out below:

• Company name: Clevel Yapay Zeka ve Teknoloji A.Ş.
• Address: İçerenköy Mah., Umut Sk. No:10 Kat: 16, Ataşehir/İstanbul
• Email: hello@clevel.group
• Website: https://clevel.group

2. Personal Data Processed

Depending on the features you use, the following categories of personal data may be processed through the Site:

Data category	Personal data	Where it is collected
Identity	Full name	Contact form, demo request form
Contact	Email address, telephone number	Contact form, demo request form
Corporate information	Organisation or company name, sector, fleet size, country	Contact form, demo request form
Request information	Relevant group company, subject, message content, date of the request	Contact form, demo request form
Transaction security	Salted hash of the IP address, browser and device information (user-agent), access time, requested page	Server and access logs
Cookie consent record	Anonymous visitor ID, consent decision and categories, policy version, language, page on which the decision was made, IP hash, user-agent, timestamp	Cookie consent panel
Analytics and marketing data	Cookie identifiers, page view and interaction information, advertising measurement data	Only the analytics and marketing cookies you have consented to
Marketing permission	Permission status, date and channel of the permission or refusal	Explicit consent checkbox

Your IP address is not kept in our records in plain form; it is converted into a salted hash using a method that is difficult to reverse and stored in that form. As this hash is pseudonymous data, it retains its character as personal data and is covered by this Notice.

We do not request special categories of personal data, such as health, religion or ethnic origin, on the Site. Please do not share such information in form messages. If such information is submitted, it will not be processed and will be deleted, unless it is necessary for responding to your request.

3. Purposes of Processing and Legal Grounds

Your personal data is processed in accordance with the general principles set out in Article 4 of the KVKK and on the basis of the legal grounds listed in Article 5 of the KVKK, as specified for each purpose in the table below:

Purpose	Relevant data categories	Legal ground
Receiving and evaluating your contact and demo requests and responding to you	Identity, contact, corporate information, request information	Processing is directly related to the conclusion or performance of a contract (Art. 5/2-c); legitimate interest of the data controller (Art. 5/2-f)
Forwarding your request to the group company you have selected or that is relevant to your request	Identity, contact, corporate information, request information	Explicit consent (Art. 5/1 and Art. 8/1)
Sending marketing communications about products, services, events and campaigns	Identity, contact, marketing permission	Explicit consent (Art. 5/1); consent to commercial electronic messages under Law No. 6563
Providing the basic functions of the Site (language preference, remembering your cookie preference)	Cookie consent record	Legitimate interest of the data controller (Art. 5/2-f)
Ensuring information security, detecting misuse and attacks, and fixing errors	Transaction security	Compliance with a legal obligation (Art. 5/2-ç, KVKK Art. 12); legitimate interest of the data controller (Art. 5/2-f)
Applying your cookie preferences and proving the consent you have given	Cookie consent record	Compliance with a legal obligation (Art. 5/2-ç); establishment, exercise or protection of a right (Art. 5/2-e)
Measuring Site usage and improving the Site	Analytics data	Explicit consent (Art. 5/1)
Measuring advertising conversions and displaying interest-based advertising	Marketing data	Explicit consent (Art. 5/1)
Responding to requests from competent authorities and protecting our rights in potential disputes	All relevant categories	Compliance with a legal obligation (Art. 5/2-ç); establishment, exercise or protection of a right (Art. 5/2-e)

Processing based on explicit consent is not carried out if you do not give your consent. Not giving your consent does not prevent us from responding to your request.

4. Method of Collection

Your personal data is collected electronically: directly from you through the contact and demo request forms, and by partly or fully automated means through server logs and cookies. Analytics and marketing cookies are activated only if you consent to the relevant category in the cookie consent panel. For detailed information, please see our Cookie Policy.

5. Transfer of Personal Data

5.1 Domestic Transfers

In accordance with Article 8 of the KVKK and limited to the purposes set out above, your personal data may be transferred to the following groups of recipients:

• Group companies: For the purpose of your request being evaluated by the relevant group company and a response being provided to you, on the basis of your explicit consent.
• Service providers: Suppliers providing services such as hosting, email and information technology support, acting as data processors on behalf of the Company and bound by confidentiality and data security obligations, under Art. 5/2-c and Art. 5/2-f.
• Competent public authorities and institutions and judicial authorities: Within the scope of our obligations arising from legislation, pursuant to Art. 5/2-ç.
• Legal and financial advisers and auditors: For the purposes of protecting rights and fulfilling legal obligations, under Art. 5/2-ç and Art. 5/2-e.

5.2 Transfers Abroad

The Site runs on servers hosted in Türkiye, and the information you submit through the forms is stored on these servers. However, your personal data may be transferred abroad in the following cases:

• Media files: Images and similar media files on the Site are served through a cloud storage and content delivery service located abroad. When these files are loaded in your browser, your IP address and browser information are, as a technical necessity, transmitted to the relevant service provider.
• Analytics and marketing services: The providers of analytics and marketing tools, which run only if you give your consent, may process data on their servers abroad.

These transfers are carried out within the framework of the conditions set out in Article 9 of the KVKK; that is, where there is an adequacy decision of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, the Turkish data protection authority), where one of the appropriate safeguards listed in the Law is provided, or where one of the exceptional cases provided for in the Law applies.

6. Retention Periods

Your personal data is retained for as long as necessary for the purpose for which it is processed and for the period prescribed by the relevant legislation:

Data	Retention period
Contact and demo request records	2 years from the conclusion of the request; if the request leads to a contractual relationship, for the periods prescribed by the relevant legislation
Marketing communication permission	Until consent is withdrawn; permission and refusal records for 3 years from the end of the permission
Server and access logs	2 years
Cookie consent records	3 years
Cookies	The period specified for each cookie in the Cookie Policy

When the retention period expires or the purpose of processing no longer exists, your personal data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Where there is an ongoing dispute or a request from a competent authority, the relevant data may be retained until that process is concluded.

7. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, by applying to the Company, you have the right to:

• Learn whether your personal data is being processed,
• Request information about the processing if your personal data has been processed,
• Learn the purpose of processing of your personal data and whether it is used in line with that purpose,
• Know the third parties, in Türkiye or abroad, to whom your personal data has been transferred,
• Request the rectification of your personal data if it has been processed incompletely or inaccurately,
• Request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK,
• Request that the rectification, deletion or destruction be notified to the third parties to whom your personal data has been transferred,
• Object to any outcome to your detriment arising from the analysis of the processed data exclusively by automated systems,
• Claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

You may withdraw the consent you have given for processing based on explicit consent at any time; withdrawal does not affect the lawfulness of the processing carried out until that time.

Data subjects located in the European Union or the European Economic Area also have additional rights to the extent that the General Data Protection Regulation (GDPR) applies. For details, please see our Privacy Policy.

8. How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests concerning your rights in Turkish through one of the following channels:

• In writing: By delivering your request bearing your wet signature in person to İçerenköy Mah., Umut Sk. No:10 Kat: 16, Ataşehir/İstanbul, or by sending it through a notary public,
• By email: To hello@clevel.group, using a secure electronic signature or mobile signature, or from an email address you have previously notified to the Company and that is registered in our systems.

Your application must include the following information:

• Name, surname and, if the application is in writing, signature,
• For citizens of the Republic of Türkiye, Turkish identity number; for foreign nationals, nationality, passport number or, if any, identity number,
• Residential or business address for notifications,
• Email address, telephone or fax number for notifications, if any,
• Subject of the request and, if any, related information and documents.

We kindly ask you to write "Request for Information under the Personal Data Protection Law" in the subject line of your application. We may request additional information to verify your identity.

Your application will be concluded free of charge as soon as possible depending on the nature of the request, and within 30 (thirty) days at the latest. If the process requires an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.

If your application is rejected, if you find the response insufficient, or if no response is given in due time, you may file a complaint with the Personal Data Protection Board pursuant to Article 14 of the KVKK within 30 (thirty) days from the date you learn of the response and, in any case, within 60 (sixty) days from the date of application.

9. Changes

This Privacy Notice may be updated in line with changes in legislation or in our data processing activities. The current version is always published on this page. Related documents: Privacy Policy, Cookie Policy, Explicit Consent Statement.