LEGAL DRAFT

KVKK Privacy Notice

LAST UPDATED · SEP 30, 2026DATA CONTROLLER · WITLABS PROJE GELİŞTİRME A.Ş.

DRAFT · PENDING LEGAL REVIEWThis text is not legal advice. It will be reviewed by a lawyer and a KVKK consultant before publication.
CONTENTS

1. Data controller

Under KVKK (Türkiye's Personal Data Protection Law No. 6698), the data controller is WITLABS PROJE GELİŞTİRME A.Ş. ("WIT Labs"). Address: Teknopol İstanbul / Entertech İstanbul. Contact: info@dcatgroup.com.

[LEGAL REVIEW REQUIRED] The full registered address and MERSİS number (Türkiye's central trade registry number) will be added.

2. Personal data we process

Through the forms on witlabs.studio, we process only the information you enter in the form and the submission context below. In addition, only if you choose Accept in the site's cookie banner, site usage data is processed through Google Analytics 4; if you decline or make no choice, Google Analytics is not loaded:

  • Identity and contact details: full name, email, phone (optional).
  • Professional information: LinkedIn or other professional profile URL, title, organization name, field experience, expertise.
  • Application and message content: the problem, thesis, investment focus, area of interest and message text you write in the form.
  • Submission context and transaction security: the time of submission and a reference number, the address of the page the form was sent from (including preselections in the link, such as the selected application type or thesis), the address of the page you visited before coming to the site (referrer), campaign parameters (UTM) if you arrived through a campaign link, browser information (user agent), and a version of your IP address hashed with a secret key known only to WIT Labs (keyed hash, pseudonym). The IP address itself is not stored in form records. The keyed hash is not anonymous data; it is protected as pseudonymized personal data.
  • Cookie preference: your choice in the cookie banner (accepted or declined) is kept in the strictly necessary wl-consent cookie (1 year) and in an entry of the same name in your browser's local storage. This record contains no identifier.
  • Site usage data (Google Analytics 4, only with consent): the random browser identifier and a session identifier in the _ga and _ga_1RC33QRVQD cookies, the address (including campaign parameters) and title of the pages viewed, the referring address if you came from another page of the site, browser language, screen resolution, browser and operating system information, and page view, scroll, engagement time and form start events (including the form's address and the name of the first field used; not what is typed in a form). This list rests on our measurement of September 30, 2026. As with any web request, your IP address reaches Google; according to Google, Google Analytics 4 does not log or store IP addresses. Details: Cookie Policy.

Our forms do not ask for health data or any other special category of personal data. Please do not share this kind of information in your messages.

3. Purposes of processing

  • evaluating founder, expert partner, company and capital partnership applications,
  • contacting you and routing your request to the relevant team,
  • preventing misuse of the forms (spam, automated submissions) and ensuring information security,
  • measuring in aggregate how the site is used, with Google Analytics,
  • fulfilling legal obligations.

Form information is not used for marketing and is not sold to third parties. The cookie banner asks for analytics only; the site gives Google no permission for advertising storage or personalization, Google signals and ad personalization signals are turned off in the tag settings, and in our measurement every measurement request carried the flag stating that personalized ads are off (npa=1).

4. Legal grounds

Under Article 5 of KVKK, your personal data is processed on the following legal grounds: the processing is directly related to the formation or performance of a contract; it is necessary for the data controller to fulfill its legal obligations; and it is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms. If any processing requires explicit consent, that consent will be obtained separately and on an optional basis.

[LEGAL REVIEW REQUIRED] The legal ground for each purpose will be mapped individually. Google Analytics is loaded only with the consent given in the cookie banner; whether this consent qualifies as explicit consent under Article 5 of KVKK, whether it meets the cookie guidance of the Personal Data Protection Authority (KVKK), and the legal ground for the strictly necessary wl-consent cookie will be assessed.

5. Transfers

Form records are kept on the server used by WIT Labs, outside the website's public directory, and are not transferred to an external form service. Personal data may be transferred, only to the extent necessary and limited to the purpose, to authorized public authorities and institutions, to suppliers that provide us with legal and technical services, and to D-CAT Group companies. The data processors we use for form submissions and visitor measurement are:

  • Microsoft 365 (email notification): the content of each form submission is automatically forwarded to an internal company email address (info@dcat.com.tr) through D-CAT Group's Microsoft 365 email service, so that the relevant team is informed. The service provider is Microsoft Ireland Operations Limited; data may be processed in Microsoft's data centers in the European Union and the United States. This forwarding constitutes a transfer abroad.
  • Google Analytics 4 (visitor measurement, only with consent): site usage data is sent to the Google Analytics 4 service provided by Google Ireland Limited / Google LLC, on Google's servers outside Türkiye. This constitutes a transfer abroad. The site's own code does not send form content to Google Analytics.
  • Zoho CRM (lead record): applications and requests are kept as lead records in a Zoho CRM account opened in the name of Gurulize Inc., to track evaluation and follow-up, and are assigned as tasks to the responsible person. The service is provided by Zoho Corporation; the account is located in Zoho's United States data center (zoho.com). This record constitutes a transfer abroad.

[LEGAL REVIEW REQUIRED] For Microsoft 365 and Zoho CRM, the legal ground and the transfer mechanism under Article 9 of KVKK (standard contract with notification to the Personal Data Protection Board, or explicit consent) will be confirmed. The Zoho CRM account is registered to Gurulize Inc. and is shared with Gurulize's own leads; the role of WITLABS PROJE GELİŞTİRME A.Ş. and Gurulize Inc. toward each other (data processor or separate data controller) and the basis for this transfer will be determined.

[LEGAL REVIEW REQUIRED] The server's hosting provider and location will be confirmed; if the server is located abroad, this will also be stated as a transfer.

Fonts are loaded from the site's own server; no third-party font service is used. The only third-party script that can be loaded on the site is Google Analytics' measurement script, and it loads only if you give consent in the cookie banner. In our measurement, copies of some measurement requests were also sent to www.google.com.

[LEGAL REVIEW REQUIRED] For Google Analytics, the transfer mechanism under Article 9 of KVKK (including whether the consent given in the cookie banner is sufficient for this transfer), the Google entity that is the contracting party (Google Ireland Limited or Google LLC) and the purpose of the copies sent to www.google.com will be confirmed.

[LEGAL REVIEW REQUIRED] Recipient groups and the status of transfers abroad (Article 9 of KVKK) will be confirmed.

6. Method of collection

Personal data is collected electronically, partly by automated means, through the forms on the website, by email and in meetings. Site usage data is collected by automated means, through the Google Analytics script and cookies, only if you have given consent in the cookie banner. Your cookie preference is saved in your browser when you make a choice in the banner.

7. Retention and destruction

Data is retained for as long as the purpose of processing requires and for the duration of legal retention obligations. At the end of that period, it is deleted, destroyed or anonymized. The keyed IP hashes kept to prevent form misuse are used for a one-hour submission limit; hashes older than two hours are deleted automatically during later submissions.

According to Google's documentation, Google Analytics cookies stay in your browser for up to 2 years (400 days in our measurement). When you withdraw your consent, the site deletes them; you can also delete them from your browser at any time. The wl-consent cookie expires after 1 year.

[LEGAL REVIEW REQUIRED] Exact retention periods will be written in line with the data inventory; the data retention period set on the Google Analytics property will also be confirmed and stated here.

8. Your rights as a data subject

Under Article 11 of KVKK, you have the right to:

  • learn whether your personal data is processed and, if it is, request information about that processing,
  • learn the purpose of the processing and whether the data is used in line with that purpose,
  • know the third parties in Türkiye or abroad to whom your data is transferred,
  • request correction if your data has been processed incompletely or inaccurately,
  • request deletion or destruction of your data under the conditions set out in Article 7 of KVKK,
  • request that any correction, deletion or destruction be notified to the third parties to whom your data was transferred,
  • object to any outcome against you that arises from analysis of the processed data exclusively by automated systems,
  • claim compensation if you suffer damage because of unlawful processing.

You can exercise these rights by applying to WIT Labs.

You can withdraw the consent you gave for Google Analytics at any time with the Cookie settings link in the footer of every page. When you withdraw it, the site stops Google Analytics and deletes the _ga and _ga_1RC33QRVQD cookies from your browser. Data already sent to Google before withdrawal is not deleted by this.

9. How to submit a request

You can send requests about your rights to info@dcatgroup.com, together with information that allows us to verify your identity. Requests are answered within thirty days at the latest.

[LEGAL REVIEW REQUIRED] Official application channels (a postal address for written requests and a KEP address, Türkiye's registered electronic mail) will be added.

Related documents: Privacy Policy · Cookie Policy · Trust, Data and Governance