LEGAL DRAFT

Privacy Policy

LAST UPDATED · SEP 30, 2026SCOPE · WITLABS.STUDIO

DRAFT · PENDING LEGAL REVIEWThis text is not legal advice. Final terms for processing, transfers and retention will be published after the data inventory and legal review are complete.
CONTENTS

1. Scope and definitions

This policy covers the witlabs.studio website operated by WITLABS PROJE GELİŞTİRME A.Ş. ("WIT Labs") and the application and contact forms on the site. The product websites and apps of our ventures (Yuvadan, Fitkültür, Loyexo, Probuddy) are subject to their own policies.

Through the website, WIT Labs aims to collect only the data needed for the stated purposes and to limit access to those who need it for their role.

2. Technical data processed when you visit

When you visit the site, the web server keeps a standard access log for each request: IP address, date and time, the page requested, the referring address and browser information. These logs are used to run the site, troubleshoot errors and keep the site secure.

Google Analytics 4: the site uses Google Analytics 4 to measure visits in aggregate (provider: Google Ireland Limited / Google LLC, "Google"; measurement ID G-1RC33QRVQD). Google Analytics writes two first-party cookies to your browser: _ga assigns your browser a random identifier, and _ga_1RC33QRVQD keeps the session state for this site's Google Analytics property. According to Google's documentation, both last up to 2 years; some browsers cap cookie lifetime at 400 days, and in our measurement the browser stored both cookies for 400 days. When a page opens, your browser downloads the measurement script from www.googletagmanager.com. The script then sends measurement requests to Google at www.google-analytics.com and www.google.com. In our measurement, these requests contained the address and title of the page viewed, the identifier from the cookie, browser language, screen resolution, browser and operating system information, and events such as a page view, scrolling and starting a form; what was typed in the form was not included. According to Google's documentation, the referring address is also sent. As with any web request, your IP address reaches Google; according to Google, Google Analytics 4 does not log or store IP addresses. Advertising and remarketing features are not enabled on the Google Analytics property.

There is no cookie consent banner: Google Analytics loads when a page opens, without asking for your consent. You can delete or block witlabs.studio cookies in your browser settings, or install the Google Analytics Opt-out Browser Add-on published by Google (tools.google.com/dlpage/gaoptout ↗). Details and how this was measured: Cookie Policy.

[LEGAL REVIEW REQUIRED] The legal ground for the processing done with Google Analytics, and whether explicit consent (a consent banner) is required in advance under the cookie guidance of the Personal Data Protection Authority (KVKK), will be confirmed.

The site does not use advertising or social media tracking tools. Apart from the Google Analytics cookies, the site sets no other cookies, and it does not write data to your browser's persistent local storage (localStorage). The only information the site itself keeps in your browser is campaign information: if you arrive through a campaign link (with the utm_source, utm_medium, utm_campaign, utm_content or utm_term parameters), these parameters are kept in session storage (sessionStorage, key name wl_utm) only while that browser tab stays open, and they are sent to us only if you submit a form, together with that submission. When the tab is closed, the browser deletes this information; this record is not sent anywhere else. Separately, Google Analytics sends the page address, including any campaign parameters in it, to Google in its measurement requests (seen in our measurement). Details: Cookie Policy.

3. Information shared through forms

There are four forms. Each form records only the fields you fill in:

FormFields
For FoundersFull name, email, phone (optional), LinkedIn or professional profile link (optional for expert partners), application type and, depending on the application type, information on the problem, field experience, expertise, thesis and role
For CompaniesOrganization, full name, title, email, phone (optional), employee count range, area of interest, message (optional)
Capital PartnersOrganization, full name, title (optional), email, phone (optional), investment focus, preferred stage, co-investment approach and message (each optional)
ContactTopic, full name, email, organization (optional), message

Each submission also records the time of submission and a reference number, the address of the page the form was sent from (including preselections in the link, such as the selected application type or thesis), the address of the page you visited before coming to the site (referrer), campaign parameters (UTM) if any, browser information, and a version of your IP address hashed with a secret key (keyed hash, pseudonym). The IP address itself is not stored; the keyed hash is not anonymous data and is protected as pseudonymized personal data. Form information is used to evaluate your application or contact request. The content of each submission is sent to the relevant team by email and may be saved in a customer relationship management (CRM) system for follow-up (see section 6).

4. Purposes of processing

Evaluating applications and requests, contacting you, routing your request to the relevant team, keeping the site and forms secure, measuring in aggregate how the site is used with Google Analytics, and fulfilling legal obligations. Details: KVKK Privacy Notice, issued under KVKK (Türkiye's Personal Data Protection Law No. 6698).

5. Legal grounds

Data is processed on the legal grounds set out in Article 5 of KVKK and, where necessary, Article 6.

[LEGAL REVIEW REQUIRED] A mapping of purposes to legal grounds will be added; the legal ground for the measurement done with Google Analytics will also be set in this mapping.

6. Service providers and data recipients

  • Hosting: the site and form records are on the server used by WIT Labs; form records are stored outside the website's public directory.
  • Microsoft 365 (email notification): the content of each form submission is automatically forwarded to an internal company email address (info@dcat.com.tr) through D-CAT Group's Microsoft 365 email service, so that the relevant team is informed. The service provider is Microsoft Ireland Operations Limited; data may be processed in Microsoft's data centers in the European Union and the United States. This forwarding constitutes a transfer abroad.
  • Zoho CRM (lead record): applications and requests are kept as lead records in a Zoho CRM account opened in the name of Gurulize Inc., to track evaluation and follow-up, and are assigned as tasks to the responsible person. The service is provided by Zoho Corporation; the account is located in Zoho's United States data center (zoho.com). This record constitutes a transfer abroad.
  • Google Analytics 4 (visitor measurement): the provider is Google Ireland Limited / Google LLC. Information about page visits is sent to Google's servers together with the identifier in the _ga and _ga_1RC33QRVQD cookies (see section 2). The site's own code does not send form content to Google Analytics. This constitutes a transfer abroad.
  • Fonts: loaded from the site's own server; no third-party font service is used.

[LEGAL REVIEW REQUIRED] The server's hosting provider and location will be confirmed; if the server is located abroad, this will also be stated as a transfer.

Form content is not used for any purpose other than those above, is not transferred to an external form or marketing service, and is not sold. Individual session content is not shared with employers.

7. Transfers abroad

Email notifications of form submissions are sent through Microsoft 365; Microsoft may process data in data centers in the European Union and the United States. Zoho CRM records are kept in Zoho's United States data center (zoho.com). Visit information measured with Google Analytics is sent to Google's servers outside Türkiye. All three constitute transfers abroad.

[LEGAL REVIEW REQUIRED] For Google Analytics, the legal ground, the transfer mechanism under Article 9 of KVKK and the Google entity that is the contracting party (Google Ireland Limited or Google LLC) will be confirmed.

[LEGAL REVIEW REQUIRED] For Microsoft 365 and Zoho CRM, the legal ground and the transfer mechanism under Article 9 of KVKK (standard contract with notification to the Personal Data Protection Board, or explicit consent) will be confirmed. The Zoho CRM account is registered to Gurulize Inc. and is shared with Gurulize's own leads; the role of WITLABS PROJE GELİŞTİRME A.Ş. and Gurulize Inc. toward each other (data processor or separate data controller) and the basis for this transfer will be determined.

[LEGAL REVIEW REQUIRED] The basis for transfers under Article 9 of KVKK will be assessed.

8. Retention and deletion

Data is retained for as long as its purpose and legal obligations require. At the end of that period, it is deleted, destroyed or anonymized.

According to Google's documentation, Google Analytics cookies stay in your browser for up to 2 years (400 days in some browsers); you can delete them from your browser at any time.

[LEGAL REVIEW REQUIRED] Exact retention periods and a deletion procedure will be set for form records and server access logs.

[LEGAL REVIEW REQUIRED] The data retention period set on the Google Analytics property will be confirmed and stated here.

9. Information security measures

  • The site is served over an encrypted connection (HTTPS).
  • Form records are kept outside the web root, in a directory with restricted access.
  • In form records, the IP address appears only as a hash made with a secret key (pseudonym).
  • The forms are protected against automated submissions with a hidden field, a server-signed timing check and a submission limit.
  • Access to records is limited to those who need it for their role.

10. Children's data

The site and forms are not intended for minors. Please do not share personal data about children through the forms.

11. Health and special category data

Our forms do not ask for health data or any other special category of personal data. Data processing in our ventures' products that include healthcare services is subject to each product's own privacy notices and the applicable regulations. Details: Trust, Data and Governance.

12. Third-party links

The site contains links to LinkedIn, dcatgroup.com, gurulize.com and our ventures' websites. When you go to those sites, their own privacy and cookie policies apply.

13. Your rights as a data subject

Your rights under Article 11 of KVKK and how to exercise them are explained in the KVKK Privacy Notice.

14. Changes to this policy

When this policy is updated, the new text is published on this page and the "last updated" date at the top of the page is changed.

15. Contact

WITLABS PROJE GELİŞTİRME A.Ş. · Teknopol İstanbul / Entertech İstanbul · info@dcatgroup.com

[LEGAL REVIEW REQUIRED] The verified full address will be added.