KVKK Disclosure Notice

Under Law No. 6698 on the Protection of Personal Data ("the Law"), INCUBA KLİNİK ARAŞTIRMA TEKNOLOJİLERİ ANONİM ŞİRKETİ ("Incuba") is the data controller for personal data obtained through the incuba.tr website.

Data controller

INCUBA KLİNİK ARAŞTIRMA TEKNOLOJİLERİ ANONİM ŞİRKETİ

Address

Cevizlidere Mah. Mevlana Blv. No: 221/109, Çankaya, Ankara, Türkiye

Tax office and number

Başkent Vergi Dairesi / 4651650336

MERSIS number

0465165033600001

Trade registry number

551031

Email

[email protected]

Your personal data is processed only when you complete the contact form. No visitor accounts are created.

Identity

Full name.

Contact

Email address.

Customer transaction

Organisation (if you provide it) and the information you share in your message.

Transaction security

Automatically generated server logs such as IP address, request time, requested address and browser information.

Special category personal data as defined in Article 6 of the Law is not requested through this site. Please do not include health data, patient information or similar special category data in your message.

• Receiving, evaluating and answering your message
• Putting you in touch with the relevant product or service team
• Conducting pre-contractual discussions
• Information security and keeping the site secure
• Making notifications required by law to competent persons, institutions and authorities

Your personal data is collected electronically when you complete the contact form on the site. Server logs are generated automatically during your visit by our servers in Türkiye and by our network security provider.

Law art. 5/2-c

Directly related to the conclusion or performance of a contract: evaluating your inquiry and conducting pre-contractual discussions.

Law art. 5/2-ç

Necessary for the controller to comply with a legal obligation: statutory retention and notification duties.

Law art. 5/2-f

Necessary for the legitimate interests of the controller, provided your fundamental rights and freedoms are not harmed: answering your message, information security and site security.

The site is hosted on our own servers in Ankara and form content is not stored in a database. Your personal data is transferred only to the extent needed for the purposes above, to the following parties.

Within Türkiye

To competent public institutions where requested or required by law, and to our lawyers and financial advisers for the conduct of legal processes.

Abroad

To the network of Cloudflare, Inc. (United States) for encrypted connections and protection against attacks, and to Microsoft Ireland Operations Limited (Microsoft 365) for delivering form content to our corporate mailbox and storing it there.

Transfers abroad are made in accordance with Article 9 of the Law and related secondary legislation. You can request detailed information about these transfers using the application route below.

Inquiries that do not lead to a contract

At most 2 years after the evaluation is completed.

Inquiries that lead to a contract

For the duration of the contractual relationship and the statutory limitation and retention periods after it ends.

Server logs

At most 90 days. Expired logs are deleted from our servers automatically.

At the end of the period your personal data is erased, destroyed or anonymised under Article 7 of the Law.

By applying to the data controller, you have the right:

• To learn whether your personal data is processed
• To request information about the processing
• To learn the purpose of processing and whether data is used accordingly
• To know the third parties to whom the data is transferred, in Türkiye or abroad
• To request correction of incomplete or inaccurate data
• To request erasure or destruction under the conditions of Article 7 of the Law
• To request that correction, erasure or destruction be notified to third parties who received the data
• To object to an adverse outcome resulting solely from automated analysis
• To claim compensation for damage caused by unlawful processing

To exercise your rights, send your application to [email protected] or in writing to the address above.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include:

• Name, surname and, for written applications, signature
• Turkish ID number for Turkish citizens; for others, nationality and passport number or ID number if any
• Residential or business address for notification
• Email address, phone and fax number for notification, if any
• The subject of the request

Your application is concluded free of charge as soon as possible and within thirty days at the latest. If the action involves an additional cost, the fee set by the Personal Data Protection Board may be charged.

If your application is rejected, you find the answer insufficient, or no answer is given in time, you may complain to the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of your application.