1. Data Controller
The data controller for the personal data processing activities described below under Personal Data Protection Law No. 6698 (“KVKK”) is:
GY Elektronik Hizmetler ve Ticaret Limited Şirketi Address: Sadi Konuralp Cad. No: 5/2, 34433 İstanbul Email: support@matbu.ai MERSİS No: 0454165566700001 Trade Registry No: 260742-5
This Privacy Notice covers the personal data processing activities carried out by the Company in its capacity as data controller.
For personal data belonging to third parties that Corporate Users upload to the Platform as part of their own business processes, the User is responsible for the lawfulness of the relevant processing activity; Matbu processes this data in accordance with the User’s instructions as part of providing the Platform service.
2. Personal Data Processed, Purposes and Legal Bases
| Processing activity | Data processed | Purpose | Legal basis |
|---|---|---|---|
| Account creation and management | Email, account information and names supplied by the sign-in provider | Creating and managing the User’s account | KVKK Article 5(2)(c) |
| Provision of the Platform service | Documents or instructions containing the User’s own personal data | Performing OCR, translation and document processing activities requested by the User | KVKK Article 5(2)(c) |
| System and information security | IP address, device/browser information, session, access and security logs | Preventing unauthorized access, misuse and security incidents | KVKK Article 5(2)(f) |
| User support | First name, last name, contact details and content of the support request | Responding to User requests and providing technical support | KVKK Article 5(2)(c) and/or 5(2)(f), depending on the nature of the request |
| Compliance with legal obligations | Account, contact and system records necessary for the relevant activity | Responding to requests from competent authorities and complying with applicable legislation | KVKK Article 5(2)(ç) |
| Protection of legal rights | Records necessary for the relevant dispute | Establishing, exercising or protecting a right | KVKK Article 5(2)(e) |
If content uploaded by the User contains special categories of personal data, the relevant processing conditions set out in Article 6 of the KVKK apply to processing carried out by the Company in its capacity as data controller.
Where a processing activity requires explicit consent, that consent is obtained separately, rather than through acceptance of this Privacy Notice.
3. Methods of Collecting Personal Data
Personal data is collected through:
- account and registration fields,
- information entered and content uploaded to the Platform by the User,
- Platform and server logs,
- support and communication channels, and
- technical services that enable the Platform to operate.
Collection takes place electronically by automated or partially automated means.
4. Transfer of Personal Data
To the extent required by the processing activity, personal data may be transferred to:
- cloud and hosting infrastructure providers,
- artificial intelligence and document processing service providers,
- authentication and security service providers,
- communication and email service providers, and
- public institutions and bodies authorized by law.
Transfers are limited to the purposes of providing the relevant Platform service, ensuring system security, communicating with Users or complying with legal obligations.
5. International Transfers of Personal Data
Personal data may be transferred abroad because technology and infrastructure service providers located abroad are used to provide the Platform.
These transfers are subject to the transfer conditions and appropriate safeguard mechanisms set out in Article 9 of the KVKK.
6. Retention and Disposal
Personal data is retained for as long as required for the purposes for which it is processed and, where legislation imposes a separate retention obligation, for the applicable statutory retention periods.
When the reasons requiring its processing no longer exist, personal data is deleted, destroyed or anonymized in accordance with the KVKK and applicable legislation.
7. Rights of Data Subjects
Under Article 11 of the KVKK, data subjects have the following rights:
- to learn whether their personal data is being processed,
- to request information if their personal data has been processed,
- to learn the purpose of processing and whether their personal data is being used in accordance with that purpose,
- to know the third parties to whom their personal data has been transferred domestically or abroad,
- to request the rectification of incomplete or inaccurately processed data,
- to request the deletion or destruction of their personal data where the applicable conditions are met,
- to request that third parties to whom their data has been transferred be notified of its rectification, deletion or destruction,
- to object to an outcome detrimental to them resulting from analysis exclusively by automated systems,
- to claim compensation for damage suffered as a result of unlawful processing.
8. Requests to the Data Controller
Requests may be submitted:
- in writing to the Company's address above,
- using a secure electronic signature or mobile signature,
- to support@matbu.ai from an email address previously provided to the Company and registered in its systems, or
- by other methods provided for in legislation
Requests are resolved within the period prescribed by the KVKK and applicable legislation.