Privacy and Security Policy
DATASURGERY Software and Consulting Inc. (“Traick”) attaches the utmost importance to the privacy and security of your personal data. In order to enable you to use our website available at https://www.datasurgery.com.tr/ (the “Website”), certain personal data belonging to you (“you” or the “User”) may be collected. This Privacy and Security Policy (the “Policy”) explains how Traick collects, processes, uses, stores, protects, and, where applicable, shares the personal data collected through the Website.
As a company established and operating in Türkiye, Traick processes personal data in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), as well as other applicable legislation.
Our Privacy and Security Policy may be updated from time to time. Any amendments will be published on our Website. By continuing to use the Website after such amendments become effective, you acknowledge and accept the updated version of this Policy.
This Policy explains: which personal data we collect, how and why we process your personal data, with whom we may share your personal data, the legal grounds for processing your personal data, your rights regarding your personal data, the measures we take to protect your personal data and how you may contact us regarding our privacy practices.
Scope
This Policy applies to: visitors accessing our Website, users of hospitals and/or registered institutions using our services, personnel responsible for managing the Website, individuals contacting us through the contact form available on the Website, and individuals communicating with us via e-mail or other communication channels.
Processed Data
When you visit our Website, we may automatically process certain technical information, including your IP address.
In addition, we may collect your contact information, including your e-mail address and telephone number. If you contact us through the contact form available on the Website, we may also collect your first name, your last name and your e-mail address, which you voluntarily provide for communication purposes.
Methods of Collecting Personal Data
Your personal data may be collected automatically when you visit our Website or directly from you through e-mail correspondence, application forms, contact forms and other communications you voluntarily submit. For example, when you complete the contact form available on our Website, you voluntarily provide the personal data specified in this Policy.
Purposes of Processing Personal Data
We process your personal data for the following purposes:
- providing, delivering, operating and improving our products and services;
- performing and managing contractual relationships with our customers, suppliers and business partners;
- managing demo requests and quotation processes;
- providing technical support;
- communicating with you regarding our products, services, events, programs and promotional activities;
- ensuring information and system security;
- receiving, evaluating and responding to requests, inquiries and applications;
- creating, maintaining and managing your user account;
- communicating with you regarding your requests and transactions;
- fulfilling our legal and regulatory obligations.
Your personal data are processed in accordance with Article 5 of the Turkish Personal Data Protection Law No. 6698 (KVKK), based on one or more of the following legal grounds: processing is necessary for the establishment or performance of a contract, processing is necessary for compliance with our legal obligations, processing is necessary for the establishment, exercise or protection of a legal claim, or processing is necessary for our legitimate interests, provided that such processing does not violate your fundamental rights and freedoms.
Where explicit consent is required under applicable legislation, your personal data will be processed only upon obtaining your explicit consent.
How We Use Your Personal Data
We use the personal data we collect in compliance with applicable data protection laws and solely for legitimate business purposes, while respecting your privacy.
Your personal data may be processed for the following purposes: providing and maintaining our products and services, creating and managing user accounts, responding to your requests, inquiries and support applications, communicating with you regarding your requests and our products or services, managing demonstration requests, quotations and sales processes, maintaining the security, availability and performance of our systems, preventing unauthorized access, fraud and misuse, improving system performance and user experience, complying with applicable legal and regulatory obligations, including record retention and reporting requirements, responding to requests from competent public authorities where required by law and improving our business operations and service quality. Traick may process personal data on behalf of its customers only to the extent necessary for providing the services requested and only by authorized personnel.
Except where your explicit consent is required under applicable law, your personal data is processed only on the legal grounds provided under the applicable legislation. Personal data are processed in a manner that is limited, proportionate and relevant to the purposes for which they are collected and are never processed for incompatible or unnecessary purposes.
Sharing of Personal Data
Your personal data may be shared, where necessary and proportionate, with our business partners, suppliers and service providers that assist us in providing our products and services, including providers of payment processing, accounting, customer support and similar operational services.
To maintain our information technology infrastructure, certain personal data may be processed through third-party cloud service providers. Accordingly, personal data may be stored in third-party data centers for hosting, backup and security purposes, provided that appropriate legal safeguards and technical and organizational security measures are implemented in accordance with applicable legislation.
The management of servers, network infrastructure, operating systems and physical security may also be performed by specialized third-party infrastructure providers. In such cases, Traick remains responsible for application-level access control and configuration management. For operational and technological reasons, the cloud service provider and/or the geographical location of the data center may change over time.
Medical imaging data processed by Traick are anonymized and cannot be associated with identifiable natural persons.
For the purposes of ensuring system security, preventing unauthorized access and fraudulent activities, providing technical support, monitoring and improving system performance, maintaining information security, complying with legal obligations and preserving evidence in the event of legal disputes, the following categories of log data may be processed where necessary: IP address, request identifier, timestamp, user identification information, records accessed or modified, type of operation performed (creation, update or deletion), values before and after modification and fields affected by the relevant transaction. Such log records are processed solely for security, auditing, troubleshooting and system integrity purposes.
As part of our infrastructure services, we utilize third-party cloud service providers. Accordingly, your personal data may be stored or processed on servers located outside Türkiye. In such cases, cross-border data transfers are carried out in accordance with Article 9 of the Turkish Personal Data Protection Law (KVKK) and all applicable legal requirements, while appropriate technical and organizational safeguards are implemented.
Where necessary for anonymization, data labeling or similar data processing activities, Traick may receive support from third-party service providers acting as data processors. Such providers process personal data solely on behalf of Traick and strictly in accordance with our documented instructions. Access to personal data is limited to the extent necessary for the provision of the relevant services. Following the completion of anonymization processes, only anonymized data are used where possible. Access rights are granted on a need-to-know basis and are restricted both in scope and duration.
Data Security Principles
Traick implements appropriate technical and organizational measures to protect personal data against unauthorized access, unlawful processing, alteration, disclosure, loss, destruction or damage. We also require our infrastructure providers, subcontractors and business partners to maintain security standards consistent with our own. However, no method of transmission over the Internet or method of electronic storage can be guaranteed to be completely secure. Therefore, although we continuously review and improve our security measures in line with technological developments and industry best practices, we cannot guarantee absolute security.
Traick processes personal data by implementing, among others, the following security measures: system architecture segregation, role-based access control (RBAC), authorization matrices, data minimization, limited logging, encrypted data transmission, secure authentication mechanisms and continuous monitoring of system security.
Although we take reasonable administrative, technical and physical safeguards to protect your personal data from unauthorized access, disclosure, loss or destruction, no security system can provide absolute protection against all potential risks.
Cookies
Our Website uses only strictly necessary session cookies to ensure the secure operation of the Website and the proper functioning of its essential features. These session cookies are created temporarily to maintain the continuity of your browsing session and are automatically deleted once you close your browser. Traick does not use third-party cookies for analytics, advertising, marketing, behavioral tracking or profiling purposes.
Your Rights
Your personal data are processed pursuant to Article 5 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) based on one or more of the following legal grounds:
- where processing is necessary for the establishment or performance of a contract;
- where processing is necessary for compliance with a legal obligation to which the data controller is subject;
- where processing is necessary for the establishment, exercise or protection of a legal claim; and
- where processing is necessary for the legitimate interests pursued by the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject.
Subject to the conditions set forth under the applicable legislation, you have the right to: learn whether your personal data are being processed, request information regarding the processing of your personal data, learn the purposes for which your personal data are processed and whether they are used in accordance with those purposes, learn the third parties to whom your personal data have been transferred within Türkiye or abroad, request the rectification of incomplete or inaccurate personal data, request the deletion, destruction or anonymization of your personal data where the legal conditions are met, request notification of any rectification, deletion or destruction made to your personal data to third parties to whom such data have been transferred, object to a result arising against you through the exclusive analysis of processed data by automated systems, and claim compensation for damages incurred as a result of the unlawful processing of your personal data. Requests relating to these rights shall be evaluated and concluded in accordance with the provisions of the KVKK and the applicable secondary legislation.
Retention, Deletion, Destruction and Anonymization of Personal Data
Personal data processed for the purposes specified in this Policy shall be retained only for as long as necessary to fulfill the relevant processing purposes or to comply with the retention periods prescribed under applicable legislation. Once the purposes requiring the processing of personal data cease to exist and the applicable statutory retention periods expire, Traick shall securely delete, destroy or anonymize such personal data in accordance with the Turkish Personal Data Protection Law, the applicable secondary legislation and its internal data retention and destruction procedures. Where data have been anonymized so that they can no longer be associated with an identified or identifiable natural person, Traick may continue to use such anonymized data for statistical, analytical, research, product improvement and similar legitimate purposes.
Amendments
Traick reserves the right to amend or update this Privacy and Security Policy at any time in order to reflect changes in applicable legislation, technological developments, business operations or data processing practices. Whenever this Policy is updated, the revision date will also be updated accordingly, and the revised version will become effective upon publication on the Website unless otherwise stated. We encourage you to review this Policy periodically to remain informed about how we process and protect your personal data. Traick further reserves the right, at its sole discretion, to modify, suspend or discontinue any part of the Website and to amend the legal notices and policies published thereon. Your continued use of the Website following any amendments constitutes your acceptance of the revised Policy.
Contact Information
If you have any questions, comments or concerns regarding this Privacy and Security Policy or the processing of your personal data, or if you wish to exercise any of your rights under the applicable data protection legislation, you may contact us using the details below:
Company Title: DATASURGERY Software and Consulting Inc.
Address: Ahmet Yesevi Mah. Kerem Sk. No 9, A-Blok, Ofis No: 404-13, Pendik, İstanbul, Türkiye
Tax No: 2711980029
E-mail: info@traick.ai
KEP Address: datasurgeryas@hs01.kep.tr