Privacy Notice on the Processing of Personal Data for Website Visitors

1. Identity of the Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller in respect of the personal data obtained when you visit the website www.apilex.ai (the “Website”) is Fitty Teknoloji Anonim Şirketi (“Apilex” or the “Company”), whose registered office is at Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. A1 Blok No: 151/1C İç Kapı No: B34 Esenler/İstanbul and whose tax identification number is 3881624490. This Privacy Notice has been prepared pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

You may contact us at privacy@apilex.ai in relation to data protection and privacy requests.

2. Scope of this Privacy Notice

This Privacy Notice covers only the processing of personal data obtained by automated means when you visit the Website, such as your IP address, cookies and similar technologies, and browser/device information.

Personal data that you share through the contact form, demo request and support request channels, as well as personal data relating to applications submitted via the careers page, fall outside the scope of this notice and are addressed in separate privacy notices specific to those processes.

Personal data processing activities relating to Users and Customers who register with the Apilex Platform (app.apilex.ai) and receive Services through the Platform, and to User Content uploaded by them, also fall outside the scope of this notice and are governed by a separate privacy notice and by the principles set out in the Apilex Terms of Use and the Service Sales Agreement.

3. Categories of Personal Data Processed

In connection with your visit to the Website, your personal data may be processed in the following categories:

The Marketing Information category is processed only if you consent to the relevant cookies; the other categories are processed automatically in order to ensure that the Website operates in a secure and functional manner.

4. Purposes of Processing Personal Data

Your personal data are processed by Apilex for the following purposes, consistently with the purposes set out in our Company’s Personal Data Processing Inventory (VERBİS) record:

• Conducting Communication Activities (displaying the Website and ensuring that it operates in a secure and functional manner),
• Where you have given consent, Conducting Marketing Analysis Studies and Conducting Advertising / Campaign / Promotion Processes (promotional and campaign communications),
• Conducting Information Security Processes (analysing Website usage statistics and preventing misuse, unauthorised access and cybersecurity risks),
• Conducting Activities in Compliance with Legislation and Providing Information to Authorised Persons, Institutions and Organisations (fulfilling legal obligations and responding to requests of authorised public institutions and organisations),
• Follow-up and Conduct of Legal Affairs (managing legal disputes and protecting Apilex’s legitimate interests).

5. Method of Collection of Personal Data and Legal Basis

Your personal data are collected by automated means through cookies and similar technologies when you access the Website. These data are processed on the legal grounds set out in Article 5 of the KVKK, namely the existence of your explicit consent (in particular in respect of marketing cookies), the fulfilment of a legal obligation, and Apilex’s legitimate interest (ensuring the security and operability of the Website).

6. Transfer of Personal Data

Your personal data may be transferred to suppliers and business partners from whom services are procured for the hosting of the Website, the provision of its security, and the operation of analytics and marketing tools (Sub-processors), to our advisers where deemed necessary, and to authorised public institutions and organisations, subject to the conditions set out in Articles 8 and 9 of the KVKK and limited to the relevant purpose. The current list of Sub-processors is available at www.apilex.ai/scc.

Where the servers of certain suppliers from whom we procure services are located abroad, your personal data may be transferred abroad in accordance with Article 9 of the KVKK and the regulations of the Personal Data Protection Board on transfers of data abroad, upon fulfilment of our applicable statutory obligations.

7. Retention Period of Personal Data

Your personal data are retained, consistently with the Apilex Privacy Policy, for the periods specified below by data category:

Upon expiry of the specified periods or where the purpose of processing ceases to exist, your personal data shall be deleted, destroyed or anonymised in accordance with Apilex’s retention and destruction policy and the provisions of the KVKK. Longer limitation or retention periods prescribed by applicable legislation are reserved.

8. Measures Taken in Relation to Data Security

Apilex takes appropriate technical and administrative measures, including in particular those listed below as declared in our VERBİS record, pursuant to Article 12 of the KVKK, in order to prevent the unlawful processing of and access to your personal data and to ensure their preservation:

• Use of encryption, firewalls, up-to-date anti-virus systems and intrusion detection/prevention systems,
• Ensuring network and application security and using a closed-system network for data transfers over the network,
• Establishing an access authorisation matrix and implementing and monitoring a user account management and authorisation control system,
• Regularly maintaining access logs and promptly reporting personal data security issues,
• Conducting penetration tests and regular/random internal audits and identifying existing risks and threats,
• Having established and implementing personal data security policies and procedures,
• Periodically auditing data-processor service providers in respect of data security and raising their awareness,
• Data security training for employees, confidentiality undertakings and authorisation matrix practices.

9. Cookies

Cookies are used on the Website in order to ensure the functionality of the site, to measure usage statistics and to present content tailored to your preferences. Detailed information on the types of cookies, the purposes for which they are used and how you may manage your preferences is available in the Cookie Policy.

10. Your Rights as a Data Subject

Pursuant to Article 11 of the KVKK, you may apply to Apilex to exercise the following rights:

• To learn whether your personal data are being processed,
• To request information if your personal data have been processed,
• To learn the purpose of processing of your personal data and whether they are used in accordance with that purpose,
• To know the third parties to whom your personal data are transferred in Turkey or abroad,
• To request the rectification of your personal data if they have been processed incompletely or inaccurately,
• To request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK,
• To request that the operations carried out pursuant to your requests for rectification, deletion and destruction be notified to third parties to whom your personal data have been transferred,
• To object to the occurrence of a result against you by means of the analysis of your processed data exclusively through automated systems,
• To request compensation for damage if you suffer damage due to the unlawful processing of your personal data.

11. Method of Application and Contact

You may submit your requests relating to the rights listed above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, together with documents verifying your identity, by e-mail to privacy@apilex.ai, by secure electronic signature or mobile signature to the registered electronic mail (KEP) address fittyteknoloji@hs03.kep.tr, or in writing to the Company’s address at Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. A1 Blok No: 151/1C İç Kapı No: B34 Esenler/İstanbul. Your application will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request; however, if the transaction requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

12. Changes and Updates

Apilex reserves the right to amend this Privacy Notice in line with legislative changes or updates to business processes. The current text is published on the Website and enters into force as of the date of publication.