Trust & Legal
Privacy Notice
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, and, for data subjects in the European Union, under Article 13 of the General Data Protection Regulation ("GDPR"), to inform people who use MindDX Platform, contact us or visit our site.
Data controller
MindDX Dijital Dönüşüm Teknolojileri A.Ş. ("MindDX"). Contact: info@minddx.ai
Our representative under Article 27 GDPR for data subjects in the EU: a representative will be appointed once we begin serving customers established in the EU; no representative is appointed today.
MindDX is the controller of the personal data described in this notice. The hosting, AI, email and analytics service providers we use to deliver the service are processors acting on behalf of and on the instructions of MindDX.
What data do we process?
- Contact and company details: name, email, phone, company name, role, website.
- Assessment and discovery data: your questionnaire answers, discovery chat content, uploaded documents and the reports produced from them.
- Transaction data: order, invoicing and payment-status information (your card data is not stored by us; it is processed on the payment provider's secure page).
- Technical data: session and language-preference cookies, basic access logs and cookieless, identity-free page/conversion counters (day-and-event totals only; no personal data).
- Usage measurement (Microsoft Clarity): only with your consent; clicks, scrolling and movement between pages, transferred to Microsoft. The contact and billing fields in the purchase form are masked, so their contents never enter a recording. Details: Cookie Policy.
- Web assistant chats: the questions you type into the AI assistant on the site and the answers given; kept pseudonymously (with a random session code not linked to your identity) and with details such as e-mail and phone masked, to improve the service and for quality control. They are linked to you only if you enter your contact details into the form inside the assistant with your explicit consent.
- Support chats: the questions that customers with a support agreement type into the support assistant and the answers given; details such as e-mail and phone are masked before they are recorded.
- In-platform feedback: the message you send through the «Help and feedback» form of the platform you are signed in to, together with your role, your company, the page you sent it from and the application version, is processed on the basis of our legitimate interest in improving our product and fixing errors (KVKK Art. 5(2)(f)). E-mail addresses, phone numbers and similar details in the message are masked automatically on a best-effort basis before sending; this is not anonymisation, so please do not include personal data in your message. The record is seen only by MindDX administrators, is not used for marketing and is not processed by AI; it is deleted automatically after 12 months. Transition period: until our record table is in service, the masked text of your feedback message reaches the team by e-mail only, through our e-mail service provider located in the USA; under the KVKK this is also a transfer abroad.
- Pre-assessment participants: the name, business e-mail and role (entered by the consultant) of people who contribute to a company's pre-assessment at the invitation of a MindDX consultant are processed on the basis of our legitimate interest in delivering the invitation and running the process (KVKK Art. 5(2)(f)); the answers the participant writes are processed on the basis of their explicit consent (KVKK Art. 5(1)). Consent can be withdrawn on the invitation page. The details are presented to the participant on the invitation page in a separate privacy notice.
Your data is collected electronically, partly by automated means, through the platform's forms, sign-in and purchase flows, in-product screens, e-mail and support channels. We do not ask for special categories of personal data (health, biometric data, etc.); please do not enter such data into free-text fields.
Why and on what legal basis do we process it?
| Purpose | Legal basis (KVKK) | GDPR equivalent |
|---|---|---|
| Account creation, sign-in and delivery of the service (Checkup, Discover, reports, consultant review) | Conclusion and performance of a contract (Art. 5(2)(c)) | Art. 6(1)(b) |
| Orders, invoicing and payment | Performance of a contract (Art. 5(2)(c)) and legal obligation (Art. 5(2)(ç)) | Art. 6(1)(b) and (c) |
| Contact, meetings or information you request | Processing directly related to concluding a contract (Art. 5(2)(c)) | Art. 6(1)(b) |
| Support requests and the support assistant | Performance of a contract (Art. 5(2)(c)) | Art. 6(1)(b) |
| Marketing communications (newsletter, guides, campaigns) | Explicit consent (Art. 5(1)) | Art. 6(1)(a) |
| In-platform feedback | Legitimate interest (Art. 5(2)(f)) | Art. 6(1)(f) |
| Quality control of web assistant records | Legitimate interest (Art. 5(2)(f)) | Art. 6(1)(f) |
| Pre-assessment participant invitation / participant answers | Legitimate interest (Art. 5(2)(f)) / explicit consent (Art. 5(1)) | Art. 6(1)(f) / Art. 6(1)(a) |
| Usage measurement (Microsoft Clarity) | Explicit consent (Art. 5(1)) — only with your consent | Art. 6(1)(a) |
| Information security, debugging, usage and cost counters | Legitimate interest (Art. 5(2)(f)) | Art. 6(1)(f) |
Without your explicit consent your data is not used for independent marketing; it is never sold. Where processing is based on explicit consent, you can withdraw it at any time; withdrawal does not affect the lawfulness of earlier processing. If the data needed to conclude and perform the contract is not provided, we cannot deliver the service.
Who is it shared with?
With authorized subprocessors used to deliver the service (hosting, email, payments, AI inference, CRM) under data processing agreements. The current list of these subprocessors is provided to customers and to data subjects on request as an annex to our data processing agreement (DPA), via info@minddx.ai. Disclosure to competent authorities may occur where legally required.
| Recipient category | Purpose | Country |
|---|---|---|
| Application database and file hosting | All persistent records | EU (Germany, Frankfurt) |
| Application servers, cache and server logs | Running the application | Being verified — available on request at info@minddx.ai |
| AI inference (Anthropic) | Report and discovery drafts, assistant answers | USA |
| Text embedding / search (OpenAI) | Search queries and chunks of uploaded documents | USA |
| E-mail delivery | Sign-in links, notifications, report delivery | USA |
| Customer relationship management (CRM) | Contact and meeting requests | Being verified — available on request at info@minddx.ai |
| Payment service | Card payment (card data held only by the provider) | Türkiye |
| Usage measurement (Microsoft Clarity) | Site usage measurement — only with your consent | USA |
| Support ticketing system (customers with a support agreement) | Support requests and chat records | Being verified — available on request at info@minddx.ai |
Where is it stored and transfers abroad
Our application database is hosted in the EU (Frankfurt). Some subprocessor services, such as AI inference, may process data outside the EU. Every transfer to a recipient shown outside Türkiye in the table above is a transfer abroad under the KVKK. These transfers are subject to Article 9 of the KVKK; for the data of data subjects in the EU, Chapter V of the GDPR (Art. 44–49) applies. Details: AI & Data Use.
In-platform feedback and pre-assessment participant records are kept in our application database hosted in the EU (Frankfurt); under the KVKK this is a transfer abroad and it is made with the safeguards required by Article 9 of the KVKK.
How long is it kept?
| Data | Retention period |
|---|---|
| Account and company details | For the duration of the service relationship; identity data is anonymised 12 months after the account is closed |
| Order and invoice records | For the statutory retention period: 10 years (Turkish Commercial Code, Art. 82) |
| Assessment and discovery content and reports | For the duration of the service relationship; 24 months from the end of the contract or service relationship, then deleted or anonymised. Documents you upload are deleted on your request. |
| In-platform feedback | 12 months, then automatic deletion |
| Pre-assessment documents | 24 months from the end of the contract or service relationship, then deleted |
| Pre-assessment participant details and answers | Anonymised 24 months after the process is closed |
| Web assistant chats | Target 90 days — until automatic deletion is in service, this period is a target |
| Support chats | 12 months, then deleted |
| Contact and meeting requests (prospects) | 12 months from the conclusion of the request; if it becomes a service relationship, the same period as account details |
| Technical logs and audit trails | Login attempts 90 days; other technical logs and audit trails for the retention period of the record they relate to |
Personal data is deleted or anonymised no later than the next monthly periodic destruction run once the purpose of processing no longer applies or the retention period stated above has expired. A data subject's erasure request is concluded within 30 days at the latest after their identity has been verified, and the outcome is communicated to them in writing or electronically. Where a statutory retention obligation applies, the data is kept only for that period and purpose.
Cookies and usage measurement
Strictly necessary cookies (session and language preference) are always used. Usage measurement (Microsoft Clarity) is off by default and runs only if you give your consent in the cookie banner; you can withdraw your consent at any time. Details: Cookie Policy.
Processing with AI
Report and discovery drafts and the answers of the web and support assistants are produced through AI providers in the USA; these providers' API services do not use your data to train their own models by default. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you; Checkup and Audit reports pass consultant review. Details: AI & Data Use.
Your rights
To exercise your rights under Article 11 of the KVKK (to learn whether your data is processed, to request information, rectification, erasure, to learn the third parties it was transferred to, to object, and to claim compensation) — and under the GDPR where applicable, including portability — send your request in writing or from your registered e-mail address to info@minddx.ai. Your request is concluded free of charge as soon as possible according to its nature and within 30 days at the latest; if the action entails an additional cost, the tariff set by the Personal Data Protection Board may apply. If you find our answer insufficient, you may lodge a complaint with the Personal Data Protection Board (KVKK Kurulu).
Article 11 of the KVKK also grants the rights to learn the purpose of processing and whether the data is used in line with it, to request that rectification and erasure be notified to the third parties to whom the data was transferred, and to object to an outcome against you that arises exclusively from analysis by automated systems. Data subjects in the EU have the rights of access, rectification, erasure, restriction of processing, data portability and objection under Articles 15–22 GDPR; they may withdraw consent for consent-based processing (Art. 7(3)) and lodge a complaint with the supervisory authority of the EU Member State where they live or work (Art. 77).
This page is published for information purposes. Last updated: 2026-11-08 · Questions: info@minddx.ai