SEMTU360 Privacy Notice

This is an English translation of the Turkish “Aydınlatma Metni” prepared under the Turkish Personal Data Protection Law no. 6698 (“KVKK”). In case of discrepancy, the Turkish version prevails.

1. Data Controller

This Privacy Notice has been prepared under KVKK to inform data subjects about the personal data processing activities carried out via www.semtu.net and app.semtu.net by:

GMG Technic Makina Sanayi ve Ticaret Limited Şirketi
Address: Koza Mah. 1638. Sok. No:4C, Sheraton Nidya Tower D:514, Esenyurt / İstanbul, Türkiye
Email: info@semtu.net
Phone: +90 212 924 7000

2. Which Personal Data We Process

a) Website and demo request

• Identity: full name
• Contact: phone number, email address
• Company: company name, employee count, facility type
• Request / message: content in the “note” field
• Transaction security: IP, timestamp, user action logs, error/log records
• Cookies and traffic: device and browser data related to cookies used

b) Application user account and sign-in

• Account: email, username, role/permission, locale preference, tenant/company relation
• Authentication: password hash, session data, sign-in/out logs, MFA records
• Transaction security: IP, device/browser, logs, security events

c) Support, audit and service continuity

• Support request content
• In-system action logs
• Email notification logs
• Backup and restore technical records

3. Purposes of Processing

• Receiving, evaluating and responding to your demo request
• Product introduction, demo scheduling and response
• Creating the user account, authorization and secure sign-in
• Providing, maintaining, improving the service and running support processes
• Information security, access control, logging, error tracking, backup and business continuity
• Fulfilling legal obligations
• Establishing, exercising or defending legal claims
• Audit, reporting and internal control processes
• Consent-based marketing communication (only where you provide explicit consent)

4. Collection Method and Legal Basis

Your personal data are collected electronically via:

• Forms on www.semtu.net and app.semtu.net
• User sign-in screens
• Cookies
• Server and application logs
• Email, phone, support requests and similar channels

Legal grounds (KVKK Art. 5):

• Necessity for the conclusion or performance of a contract
• Legal obligation of the data controller
• Establishment, exercise or protection of a right
• Legitimate interests of the data controller, balanced with your fundamental rights
• Your explicit consent, where required

5. Data Transfers

Your personal data may be transferred to public authorities, legal/finance/audit advisors, hosting, infrastructure, email delivery, backup, security, support and integration service providers, in accordance with KVKK Art. 8 and, where applicable, Art. 9.

Where cross-border transfers occur, such transfers are carried out only under appropriate legal mechanisms foreseen by KVKK.

6. Retention Period

Your personal data are retained for the period required by the processing purpose and applicable laws. At the end of the retention period, the data are deleted, destroyed or anonymized in accordance with the applicable legislation.

7. Your Rights as a Data Subject

Under KVKK Art. 11, you have the right to:

• Learn whether your personal data are processed
• Request information on processing activities
• Learn the purpose and whether the data are used in accordance with that purpose
• Be informed about third parties (domestic/foreign) to whom data are transferred
• Request rectification of incomplete or incorrect data
• Request deletion or destruction
• Request that rectification, deletion or destruction be notified to third parties
• Object to outcomes that arise against you purely as a result of automated analysis
• Claim compensation for damages arising from unlawful processing

8. How to Apply

• Email: info@semtu.net
• Post / in-person: Koza Mah. 1638. Sok. No:4C, Sheraton Nidya Tower D:514, Esenyurt / İstanbul, Türkiye

Requests will be answered within the legal period, not exceeding 30 days.

9. Note on Customer Tenant Data

Where operational data of customer companies (maintenance, work orders, HSE, quality, reporting, documents etc.) are processed through the SEMTU360 application, the relevant customer is in most cases the data controller, and GMG Technic acts as the data processor. For such data, the customer’s/employer’s own privacy notice may also apply.