01Data controller
The data controller is [legal name of the data controller], [registered address]. The platform is operated on its behalf by [operator acting as data processor, e.g. FEMTECH LTD.].
Contact for privacy questions and requests: [privacy contact email address].
02Personal data we process
- Account data: first and last name, organization, email address, username, and a salted hash of your password (never the password itself).
- Consent data: the date and version of the registration statement you accepted.
- Workshop content: the ideas you submit, attached photos and documents, clarifications, appeals, and the evaluation comments and decisions recorded on them.
- Role data: evaluator roles and vehicle systems assigned to you by the workshop administrators.
- Technical and security data: IP address, sign-in times, failed sign-in attempts, and an audit trail of administrative actions.
Photos can contain embedded metadata (for example the time or the location where they were taken). Remove such information before you upload a file if you do not want to share it.
03Purposes and legal basis
- Creating and securing your account, verifying your email address, and letting you sign in.
- Receiving, evaluating, and reporting cost-reduction ideas within the workshop, and informing you about their status by email.
- Protecting the platform against misuse, investigating security incidents, and meeting legal obligations.
Legal basis: [to be confirmed by the data controller, e.g. KVKK Art. 5(2)(c) performance of a contract, 5(2)(ç) legal obligation, 5(2)(f) legitimate interest; GDPR Art. 6(1)(b), (c), (f)].
04Who receives the data
- The authorized workshop evaluation team of TOFAŞ and Stellantis (cost engineering, system PR, marketing, vehicle synthesis, and technical management) and the workshop administrators.
- Executives who receive the workshop report.
- Service providers acting on our instructions: hosting and object storage (Akamai / Linode, data centre [region]), network security and delivery, including the Cloudflare Turnstile bot check on the sign-in, registration, password and verification-email forms (Cloudflare), and email delivery ([email provider]).
Some of these providers may process data outside Türkiye. Transfers abroad take place only under the safeguards required by KVKK Art. 9 [mechanism to be confirmed].
05How long we keep it
Account data is kept while your account is active and for [period] after the last workshop you took part in. Ideas, attachments, and their evaluation history are kept for [period] to document the workshop results. Security logs are kept for [period]. Database backups are overwritten after 14 days.
06Cookies and browser storage
The platform uses only strictly necessary cookies: one that keeps you signed in and one that protects forms against cross-site request forgery. There are no analytics or advertising cookies. On the sign-in, registration, forgot-password and resend-verification forms, Cloudflare Turnstile checks that a person, not an automated program, submits the form. For this check Cloudflare processes technical signals (your IP address, browser and TLS characteristics, the page and the widget key) on our behalf; Cloudflare also uses these signals as an independent controller to improve its bot detection, as described in Cloudflare's Turnstile privacy addendum. Turnstile sets no advertising or tracking cookies. While you fill in the idea form, an unsent draft of its text fields is kept in your browser on this device. It never leaves the device until you submit the idea, and you can discard it at any time.
07Your rights
Under KVKK Art. 11 (and GDPR Arts. 15–22 where applicable) you can ask whether your data is processed, obtain information and a copy, request correction or deletion, object to processing, and ask which third parties received your data. You can update your name and organization at any time on your account page.
Send requests to [privacy contact email address]. You also have the right to complain to the Personal Data Protection Authority (KVKK) or, where the GDPR applies, to your local supervisory authority.