Privacy Policy

1. Scope and definitions

This policy covers the witlabs.studio website operated by WITLABS PROJE GELİŞTİRME A.Ş. ("WIT Labs") and the application and contact forms on the site. The product websites and apps of our ventures (Yuvadan, Fitkültür, Loyexo, Probuddy) are subject to their own policies.

Through the website, WIT Labs aims to collect only the data needed for the stated purposes and to limit access to those who need it for their role.

2. Technical data processed when you visit

When you visit the site, the web server keeps a standard access log for each request: IP address, date and time, the page requested, the referring address and browser information. These logs are used to run the site, troubleshoot errors and keep the site secure.

Cookie banner and consent: when you first open the site, a cookie banner appears at the bottom of the page. It asks for your permission to measure visits with Google Analytics 4; the Accept and Decline options carry the same weight. Before you choose, and if you decline, no request is sent to Google and no Google Analytics cookie is set (verified in our measurement). Your choice is kept in the strictly necessary wl-consent cookie (1 year), which holds only the accepted or declined value, and in an entry of the same name in your browser's local storage (localStorage). You can change or withdraw your choice at any time with the Cookie settings link in the footer of every page.

Google Analytics 4 (only with consent): used to measure visits in aggregate (provider: Google Ireland Limited / Google LLC, "Google"; measurement ID G-1RC33QRVQD). When you accept, your browser downloads the measurement script from www.googletagmanager.com, and Google Analytics sets two first-party cookies: _ga assigns your browser a random identifier, and _ga_1RC33QRVQD keeps the session state for this site's Google Analytics property. According to Google's documentation, both last up to 2 years; in our measurement, the browser stored both cookies for 400 days. The script sends measurement requests to www.google-analytics.com; in our measurement, copies of some requests also went to www.google.com. In our measurement, these requests contained the address (including campaign parameters) and title of the page viewed, the referring address if you came from another page of the site, the identifier from the cookie and a session identifier, browser language, screen resolution, browser and operating system information, and page view, scroll, engagement time and form start events (including the form's address and the name of the first field used); what was typed in the form was not included. As with any web request, your IP address reaches Google; according to Google, Google Analytics 4 does not log or store IP addresses.

The site passes only the analytics storage permission to Google; the permissions for ad storage, user data for advertising and ad personalization stay denied even when you accept, and Google signals and ad personalization signals are turned off in the tag settings. In our measurement, every measurement request carried the flag stating that personalized ads are off (npa=1), and no advertising cookie was set. When you withdraw your consent, the site stops Google Analytics and deletes the _ga and _ga_1RC33QRVQD cookies. You can also install the Google Analytics Opt-out Browser Add-on published by Google (tools.google.com/dlpage/gaoptout ↗). Details and how this was measured: Cookie Policy.

[LEGAL REVIEW REQUIRED] The legal ground for the processing done with Google Analytics, and whether the consent given through the cookie banner qualifies as explicit consent under KVKK, will be confirmed. For what purpose Google processes the www.google.com copies seen in our measurement will be confirmed against Google's documentation.

The site does not use advertising or social media tracking tools. The only information the site itself keeps in your browser is the wl-consent record and campaign information: if you arrive through a campaign link (with the utm_source, utm_medium, utm_campaign, utm_content or utm_term parameters), these parameters are kept in session storage (sessionStorage, key name wl_utm) only while that browser tab stays open, and they are sent to us only if you submit a form, together with that submission. When the tab is closed, the browser deletes this information; this record is not sent anywhere else. Separately, if you have accepted Google Analytics, it sends the page address, including any campaign parameters in it, to Google in its measurement requests (seen in our measurement). Details: Cookie Policy.

3. Information shared through forms

There are four forms. Each form records only the fields you fill in:

Each submission also records the time of submission and a reference number, the address of the page the form was sent from (including preselections in the link, such as the selected application type or thesis), the address of the page you visited before coming to the site (referrer), campaign parameters (UTM) if any, browser information, and a version of your IP address hashed with a secret key (keyed hash, pseudonym). The IP address itself is not stored; the keyed hash is not anonymous data and is protected as pseudonymized personal data. Form information is used to evaluate your application or contact request. The content of each submission is sent to the relevant team by email and may be saved in a customer relationship management (CRM) system for follow-up (see section 6).

4. Purposes of processing

Evaluating applications and requests, contacting you, routing your request to the relevant team, keeping the site and forms secure, measuring in aggregate how the site is used with Google Analytics, and fulfilling legal obligations. Details: KVKK Privacy Notice, issued under KVKK (Türkiye's Personal Data Protection Law No. 6698).

5. Legal grounds

Data is processed on the legal grounds set out in Article 5 of KVKK and, where necessary, Article 6.

[LEGAL REVIEW REQUIRED] A mapping of purposes to legal grounds will be added; the legal ground for the measurement done with Google Analytics will also be set in this mapping.

6. Service providers and data recipients

• Hosting: the site and form records are on the server used by WIT Labs; form records are stored outside the website's public directory.
• Microsoft 365 (email notification): the content of each form submission is automatically forwarded to an internal company email address (info@dcat.com.tr) through D-CAT Group's Microsoft 365 email service, so that the relevant team is informed. The service provider is Microsoft Ireland Operations Limited; data may be processed in Microsoft's data centers in the European Union and the United States. This forwarding constitutes a transfer abroad.
• Zoho CRM (lead record): applications and requests are kept as lead records in a Zoho CRM account opened in the name of Gurulize Inc., to track evaluation and follow-up, and are assigned as tasks to the responsible person. The service is provided by Zoho Corporation; the account is located in Zoho's United States data center (zoho.com). This record constitutes a transfer abroad.
• Google Analytics 4 (visitor measurement, only if you accept in the cookie banner): the provider is Google Ireland Limited / Google LLC. Information about page visits is sent to Google's servers together with the identifier in the _ga and _ga_1RC33QRVQD cookies (see section 2). The site's own code does not send form content to Google Analytics. This constitutes a transfer abroad.
• Fonts: loaded from the site's own server; no third-party font service is used.

[LEGAL REVIEW REQUIRED] The server's hosting provider and location will be confirmed; if the server is located abroad, this will also be stated as a transfer.

Form content is not used for any purpose other than those above, is not transferred to an external form or marketing service, and is not sold. Individual session content is not shared with employers.

7. Transfers abroad

Email notifications of form submissions are sent through Microsoft 365; Microsoft may process data in data centers in the European Union and the United States. Zoho CRM records are kept in Zoho's United States data center (zoho.com). If you have given consent, visit information measured with Google Analytics is sent to Google's servers outside Türkiye. All three constitute transfers abroad.

[LEGAL REVIEW REQUIRED] For Google Analytics, the legal ground, the transfer mechanism under Article 9 of KVKK and the Google entity that is the contracting party (Google Ireland Limited or Google LLC) will be confirmed.

[LEGAL REVIEW REQUIRED] For Microsoft 365 and Zoho CRM, the legal ground and the transfer mechanism under Article 9 of KVKK (standard contract with notification to the Personal Data Protection Board, or explicit consent) will be confirmed. The Zoho CRM account is registered to Gurulize Inc. and is shared with Gurulize's own leads; the role of WITLABS PROJE GELİŞTİRME A.Ş. and Gurulize Inc. toward each other (data processor or separate data controller) and the basis for this transfer will be determined.

[LEGAL REVIEW REQUIRED] The basis for transfers under Article 9 of KVKK will be assessed.

8. Retention and deletion

Data is retained for as long as its purpose and legal obligations require. At the end of that period, it is deleted, destroyed or anonymized.

According to Google's documentation, Google Analytics cookies stay in your browser for up to 2 years (400 days in our measurement); when you withdraw your consent through the Cookie settings link in the footer, the site deletes them, and you can also delete them from your browser at any time. The wl-consent cookie that keeps your choice expires after 1 year.

[LEGAL REVIEW REQUIRED] Exact retention periods and a deletion procedure will be set for form records and server access logs.

[LEGAL REVIEW REQUIRED] The data retention period set on the Google Analytics property will be confirmed and stated here.

9. Information security measures

• The site is served over an encrypted connection (HTTPS).
• Form records are kept outside the web root, in a directory with restricted access.
• In form records, the IP address appears only as a hash made with a secret key (pseudonym).
• The forms are protected against automated submissions with a hidden field, a server-signed timing check and a submission limit.
• Access to records is limited to those who need it for their role.

10. Children's data

The site and forms are not intended for minors. Please do not share personal data about children through the forms.

11. Health and special category data

Our forms do not ask for health data or any other special category of personal data. Data processing in our ventures' products that include healthcare services is subject to each product's own privacy notices and the applicable regulations. Details: Trust, Data and Governance.

12. Third-party links

The site contains links to LinkedIn, dcatgroup.com, gurulize.com and our ventures' websites. When you go to those sites, their own privacy and cookie policies apply.

13. Your rights as a data subject

Your rights under Article 11 of KVKK and how to exercise them are explained in the KVKK Privacy Notice.

14. Changes to this policy

When this policy is updated, the new text is published on this page and the "last updated" date at the top of the page is changed.

15. Contact

WITLABS PROJE GELİŞTİRME A.Ş. · Teknopol İstanbul / Entertech İstanbul · info@dcatgroup.com

[LEGAL REVIEW REQUIRED] The verified full address will be added.