Privacy Policy
Last updated: 21 October 2026
This page explains what personal data the KDM promotional site processes, why, on what legal basis, where it is kept and for how long. This site has no advertising, analytics tools or cookies. Personal data is processed in only three situations: delivering pages to you, when you submit the demo request form, and when you use the workspace finder.
1. Scope and data controller
This notice covers kdm.org.tr (Turkish) and ctm.org.tr (English). It is based on the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the GDPR. Data controller:
- Trade name: U2 AI Studio Teknoloji Anonim Şirketi
- Registered office: Ahi Evran OSB Mah. Erkunt Cad. No: 3 İç Kapı No: 41, Sincan / Ankara, Türkiye
- MERSIS: 0883124471000001 · Ankara Trade Registry: 434199 · Tax office / number: Sincan, 8831244710
- E-mail: info@u2aistudio.com · KEP: u2aistudio@hs01.kep.tr
- Phone: +90 850 346 82 82 · +1 415 712 78 82
Employee data processed in the KDM workspaces of client companies (for example yourcompany.ctm.org.tr) is outside the scope of this notice. For that data the company concerned is the data controller and U2 AI Studio is the data processor.
Two further documents sit alongside this one and cover their topics in more detail: the KVKK Privacy Notice and the Cookie Policy.
2. Data processed, purposes and retention
The table below is the complete picture; no other data is collected.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Connection data: IP address, time of request, page requested, browser information | Delivering pages to you; security of the site and abuse prevention | KVKK Art. 5/2-f; GDPR Art. 6(1)(f) | Our server logs record the page requested, response status and duration; the IP address is not written to the log. It is kept only in memory as a rate-limit counter, for at most 30 minutes. |
| Demo request form: name, work e-mail, company, optional phone, employee range, subject and message | Responding to your request; handling demo, proposal and pre-contract processes | KVKK Art. 5/2-c and 5/2-f; GDPR Art. 6(1)(b) and 6(1)(f) | The form is not written to a database; it is delivered as e-mail and kept in our corporate mailbox for 24 months from the last correspondence. |
| Workspace finder: e-mail address and one-time code | Showing you the KDM workspaces you belong to | KVKK Art. 5/2-c; GDPR Art. 6(1)(b) | Your e-mail address and the code are not stored in plain text; only keyed digests (HMAC) are kept. The code is valid for 3 minutes and digest records are deleted within 24 hours. |
Theme preference (only if you press the theme button): the value koyu or acik | Remembering your chosen appearance on your next visit | Kept on your device and never sent to us | Until you clear your browser's site data |
No decisions are made about you by automated systems; no profiles or scores are produced.
Please do not send performance, health or disciplinary records of your employees or other special categories of personal data (health, religious or philosophical beliefs, biometric and genetic data, criminal convictions, trade union membership) through the form or when writing to us. If such data reaches us anyway, we delete it rather than continue processing it.
3. We do not ask for consent
No processing on this site relies on explicit consent. Responding to a request you send us is a case where Article 5/2 of the KVKK permits processing without explicit consent: it is directly related to the establishment or performance of a relationship you initiated (Art. 5/2-c) and to our legitimate interest in responding to your request (Art. 5/2-f). The checkbox on the form is not consent; it only confirms that you have read the privacy notice. Asking for consent where another legal basis applies would misrepresent the basis of processing, so we do not ask for it.
Submitting the form does not add you to any mailing list, and no commercial electronic messages are sent. If a newsletter is offered in future, it will be a separate opt-in step with prior consent under Article 6 of Law No. 6563.
4. Where data is kept and who sees it
Form messages are read only by the team that will respond to your request; access is limited by role. Parties involved:
- Amazon Web Services: the servers on which the site and the KDM platform run (AWS Istanbul Local Zone) and delivery of form messages as e-mail (Amazon Simple Email Service, Frankfurt, Germany). The contracting party in Türkiye is AWS Turkey Pazarlama Teknoloji ve Danışmanlık Hizmetleri Limited Şirketi.
- Let's Encrypt (Internet Security Research Group): providing TLS certificates. No visitor data is shared in this process.
- Our domain name (DNS) service provider: when resolving the address, it processes the IP address of the DNS resolver making the query.
- Our corporate e-mail provider: delivering and storing messages that reach info@u2aistudio.com.
- Our legal and financial advisers and, where the law requires disclosure, competent public authorities.
The site loads no third-party scripts, font services, maps, videos or social media plug-ins; fonts and all images are served from our own domain. We do not sell, rent or trade personal data or share it for anyone else's marketing.
5. International transfers
The site is served from our servers in Istanbul. Form messages are delivered through the Frankfurt (Germany) region of Amazon Simple Email Service and may be stored on our e-mail provider's servers abroad. These transfers take place within the framework permitted by Article 9 of the KVKK and in line with decisions of the Personal Data Protection Board and, where the GDPR applies, on the basis of the transfer mechanisms in Chapter V.
6. Cookies and local storage
This site sets no cookies. When you press the theme button, your choice is written to your browser's local storage under the key kdm-site-tema; it stays on your device, is not a cookie and is never sent to us. Details are in the Cookie Policy.
7. Security
The site is served only over HTTPS/TLS; HTTP requests are redirected to HTTPS, and a strict content security policy (CSP) and HSTS header are sent to the browser. The form and the workspace finder are protected by rate limits and measures against automated submissions.
No system can be made completely secure, and we do not claim any certification or accreditation we do not hold. If a breach occurs that is likely to pose a risk to you, we notify the Personal Data Protection Board and the persons concerned under Article 12/5 of the KVKK and, where the GDPR applies, under Articles 33 and 34.
8. Your rights and how to exercise them
Under Article 11 of the KVKK you have the right:
- to learn whether your personal data is processed (Art. 11/1-a);
- to request information about the processing if it has been processed (b);
- to learn the purpose of processing and whether the data is used in line with that purpose (c);
- to know the third parties in Türkiye or abroad to whom your personal data is transferred (ç);
- to request correction if your personal data is incomplete or inaccurate (d);
- to request erasure or destruction of your personal data under the conditions in Article 7 of the KVKK (e);
- to request that corrections, erasures or destructions made under (d) and (e) be notified to the third parties to whom the data was transferred (f);
- to object to an outcome against you arising from the analysis of processed data exclusively by automated systems (g);
- to claim compensation for damage suffered due to unlawful processing of your personal data (ğ).
Where the GDPR applies, you also have the rights of access, rectification, erasure, restriction, objection and data portability, and the right to lodge a complaint with a supervisory authority.
You may submit requests under Article 11 of the KVKK through the channels listed in Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller:
- In writing: Ahi Evran OSB Mah. Erkunt Cad. No: 3 İç Kapı No: 41, Sincan / Ankara, Türkiye (in person with proof of identity, or through a notary).
- Registered e-mail (KEP): u2aistudio@hs01.kep.tr
- With a secure electronic signature or mobile signature: to info@u2aistudio.com.
- From an e-mail address you have previously notified to us and that is registered in our systems: to info@u2aistudio.com.
Under Article 5/2 of the Communiqué, your application must include your name and surname and, if written, your signature; your Turkish ID number if you are a Turkish citizen, or your nationality and passport or ID number if you are not; your address for service; your e-mail address, phone and fax number if any; and the subject of your request.
Your application is concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request; if the process requires an additional cost, the fee in the tariff set by the Board may be charged (KVKK Art. 13). If your application is rejected, you find the response insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board within thirty days of learning the response and in any case within sixty days of your application (KVKK Art. 14).
9. Children's data
This site and our services are not directed at people under 18, and we do not knowingly collect personal data from this age group. If you believe someone under 18 has sent us data, write to info@u2aistudio.com and we will delete it.
10. Changes to this notice
We update this page when something on the site changes, for example when a service provider changes or a new function is added. Updates apply going forward from the date they are published here. If a change would require your explicit consent, we will ask for it separately rather than infer consent from your continued use of the site.
11. Contact
For privacy questions and requests under Article 11 of the KVKK: info@u2aistudio.com · KEP u2aistudio@hs01.kep.tr · +90 850 346 82 82 · +1 415 712 78 82 · Ahi Evran OSB Mah. Erkunt Cad. No: 3 İç Kapı No: 41, Sincan / Ankara, Türkiye.