LEGAL DRAFT

KVKK Privacy Notice

LAST UPDATED · SEP 30, 2026DATA CONTROLLER · WITLABS PROJE GELİŞTİRME A.Ş.

DRAFT · PENDING LEGAL REVIEWThis text is not legal advice. It will be reviewed by a lawyer and a KVKK consultant before publication.
CONTENTS

1. Data controller

Under KVKK (Türkiye's Personal Data Protection Law No. 6698), the data controller is WITLABS PROJE GELİŞTİRME A.Ş. ("WIT Labs"). Address: Teknopol İstanbul / Entertech İstanbul. Contact: info@dcatgroup.com.

[LEGAL REVIEW REQUIRED] The full registered address and MERSİS number (Türkiye's central trade registry number) will be added.

2. Personal data we process

Through the forms on witlabs.studio, we process only the information you enter in the form and the submission context below. In addition, when you visit the site, site usage data is processed through Google Analytics 4:

  • Identity and contact details: full name, email, phone (optional).
  • Professional information: LinkedIn or other professional profile URL, title, organization name, field experience, expertise.
  • Application and message content: the problem, thesis, investment focus, area of interest and message text you write in the form.
  • Submission context and transaction security: the time of submission and a reference number, the address of the page the form was sent from (including preselections in the link, such as the selected application type or thesis), the address of the page you visited before coming to the site (referrer), campaign parameters (UTM) if you arrived through a campaign link, browser information (user agent), and a version of your IP address hashed with a secret key known only to WIT Labs (keyed hash, pseudonym). The IP address itself is not stored in form records. The keyed hash is not anonymous data; it is protected as pseudonymized personal data.
  • Site usage data (Google Analytics 4): the random browser identifier in the _ga and _ga_1RC33QRVQD cookies, the address and title of the pages viewed, browser language, screen resolution, browser and operating system information, and page view, scroll and form start events (not what is typed in a form); according to Google's documentation, also the referring address. As with any web request, your IP address reaches Google; according to Google, Google Analytics 4 does not log or store IP addresses. Details: Cookie Policy.

Our forms do not ask for health data or any other special category of personal data. Please do not share this kind of information in your messages.

3. Purposes of processing

  • evaluating founder, expert partner, company and capital partnership applications,
  • contacting you and routing your request to the relevant team,
  • preventing misuse of the forms (spam, automated submissions) and ensuring information security,
  • measuring in aggregate how the site is used, with Google Analytics,
  • fulfilling legal obligations.

Form information is not used for marketing and is not sold to third parties. Advertising and remarketing features are not enabled on the Google Analytics property.

4. Legal grounds

Under Article 5 of KVKK, your personal data is processed on the following legal grounds: the processing is directly related to the formation or performance of a contract; it is necessary for the data controller to fulfill its legal obligations; and it is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms. If any processing requires explicit consent, that consent will be obtained separately and on an optional basis.

[LEGAL REVIEW REQUIRED] The legal ground for each purpose will be mapped individually. Google Analytics cookies are loaded without consent; the legal ground for this processing, and whether explicit consent is required in advance under the cookie guidance of the Personal Data Protection Authority (KVKK), will be assessed.

5. Transfers

Form records are kept on the server used by WIT Labs, outside the website's public directory, and are not transferred to an external form service. Personal data may be transferred, only to the extent necessary and limited to the purpose, to authorized public authorities and institutions, to suppliers that provide us with legal and technical services, and to D-CAT Group companies. The data processors we use for form submissions and visitor measurement are:

  • Microsoft 365 (email notification): the content of each form submission is automatically forwarded to an internal company email address (info@dcat.com.tr) through D-CAT Group's Microsoft 365 email service, so that the relevant team is informed. The service provider is Microsoft Ireland Operations Limited; data may be processed in Microsoft's data centers in the European Union and the United States. This forwarding constitutes a transfer abroad.
  • Google Analytics 4 (visitor measurement): site usage data is sent to the Google Analytics 4 service provided by Google Ireland Limited / Google LLC, on Google's servers outside Türkiye. This constitutes a transfer abroad. The site's own code does not send form content to Google Analytics.
  • Zoho CRM (lead record): applications and requests are kept as lead records in a Zoho CRM account opened in the name of Gurulize Inc., to track evaluation and follow-up, and are assigned as tasks to the responsible person. The service is provided by Zoho Corporation; the account is located in Zoho's United States data center (zoho.com). This record constitutes a transfer abroad.

[LEGAL REVIEW REQUIRED] For Microsoft 365 and Zoho CRM, the legal ground and the transfer mechanism under Article 9 of KVKK (standard contract with notification to the Personal Data Protection Board, or explicit consent) will be confirmed. The Zoho CRM account is registered to Gurulize Inc. and is shared with Gurulize's own leads; the role of WITLABS PROJE GELİŞTİRME A.Ş. and Gurulize Inc. toward each other (data processor or separate data controller) and the basis for this transfer will be determined.

[LEGAL REVIEW REQUIRED] The server's hosting provider and location will be confirmed; if the server is located abroad, this will also be stated as a transfer.

Fonts are loaded from the site's own server; no third-party font service is used. The only third-party script loaded on the site is Google Analytics' measurement script.

[LEGAL REVIEW REQUIRED] For Google Analytics, the transfer mechanism under Article 9 of KVKK and the Google entity that is the contracting party (Google Ireland Limited or Google LLC) will be confirmed.

[LEGAL REVIEW REQUIRED] Recipient groups and the status of transfers abroad (Article 9 of KVKK) will be confirmed.

6. Method of collection

Personal data is collected electronically, partly by automated means, through the forms on the website, by email and in meetings. Site usage data is collected by automated means when you visit the site, through the Google Analytics script and cookies.

7. Retention and destruction

Data is retained for as long as the purpose of processing requires and for the duration of legal retention obligations. At the end of that period, it is deleted, destroyed or anonymized. The keyed IP hashes kept to prevent form misuse are used for a one-hour submission limit; hashes older than two hours are deleted automatically during later submissions.

According to Google's documentation, Google Analytics cookies stay in your browser for up to 2 years (400 days in some browsers); you can delete them from your browser at any time.

[LEGAL REVIEW REQUIRED] Exact retention periods will be written in line with the data inventory; the data retention period set on the Google Analytics property will also be confirmed and stated here.

8. Your rights as a data subject

Under Article 11 of KVKK, you have the right to:

  • learn whether your personal data is processed and, if it is, request information about that processing,
  • learn the purpose of the processing and whether the data is used in line with that purpose,
  • know the third parties in Türkiye or abroad to whom your data is transferred,
  • request correction if your data has been processed incompletely or inaccurately,
  • request deletion or destruction of your data under the conditions set out in Article 7 of KVKK,
  • request that any correction, deletion or destruction be notified to the third parties to whom your data was transferred,
  • object to any outcome against you that arises from analysis of the processed data exclusively by automated systems,
  • claim compensation if you suffer damage because of unlawful processing.

You can exercise these rights by applying to WIT Labs.

9. How to submit a request

You can send requests about your rights to info@dcatgroup.com, together with information that allows us to verify your identity. Requests are answered within thirty days at the latest.

[LEGAL REVIEW REQUIRED] Official application channels (a postal address for written requests and a KEP address, Türkiye's registered electronic mail) will be added.

Related documents: Privacy Policy · Cookie Policy · Trust, Data and Governance