LEGAL
Privacy Policy
This policy explains how CavgaLabs Teknoloji, Yazılım, Danışmanlık, Ar-Ge San. ve Tic. Ltd. Şti. processes personal data across all of its activities. It is prepared to fulfil our disclosure obligation under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK).
Data controller
Your personal data is processed by the following company acting as data controller:
- Legal name: CAVGALABS TEKNOLOJİ YAZILIM DANIŞMANLIK ARGE SANAYİ VE TİCARET LİMİTED ŞİRKETİ
- Address: Akdeniz Mah. Cumhuriyet Blv. No: 120, 35220 Konak / İzmir, Türkiye
- MERSIS (central registry) no: 0203092612500001
- Trade registry no: 275211 (İzmir)
- Tax ID: 2030926125 (Konak Tax Office)
- Phone: +908508402503
- Email: iletisim@cavgalabs.com
- Registered electronic mail (KEP): cavgalabs@hs01.kep.tr
Scope
This policy covers every activity of the company in a single document rather than separate notices per product, so that it is possible to trace which data arises from which activity in one place.
- The cavgalabs.com website and its subpages
- omni-panel and other software / SaaS products (web and mobile applications)
- Communication conducted over WhatsApp Business
- 3D printing, laser engraving and physical manufacturing orders
- Software and R&D consultancy services
- IoT and embedded systems products
Our role: controller versus processor
This distinction matters legally and is not the same across all of our activities.
For website visitors, our direct customers, our suppliers and anyone who contacts us, we act as DATA CONTROLLER. We determine the purposes and means of processing.
By contrast, for data concerning the customers, staff or orders of a business that uses our software such as omni-panel, we act as DATA PROCESSOR. The controller of that data is the business using the software. We access such data only to provide the service, deliver technical support and resolve faults, acting on that business's instructions.
If you are a customer of a business that uses our software and you have a request regarding your own data, please contact that business first. If you send the request to us, we will direct you to the relevant business.
Personal data we process
| Activity | Data processed |
|---|---|
| Website visit | IP address, browser and device information, pages visited, time of visit, referring address |
| Contact form / email | Name, email address, phone number, message content and any attachments |
| WhatsApp Business communication | Phone number, WhatsApp profile name, message content, media sent, message timestamps |
| Software / SaaS subscription | Name, job title, email, phone, business details, tax identification details, invoice and payment records, usage logs |
| Manufacturing order | Name, delivery address, phone, order contents, uploaded design files, invoicing details |
| Consultancy / contract | Name, job title, authorised signatory details, signature circular, trade registry details, bank account details |
| Job application | Education, experience and contact details included in your CV |
We do not request special categories of personal data (health, religious belief, biometric data and similar). Please do not send us such data; anything received inadvertently is deleted without delay.
Purposes of processing
- Formation and performance of the contract and fulfilment of orders or subscriptions
- Preparing quotations and maintaining commercial communication
- Delivering products and services, technical support and fault resolution
- Invoicing, collection and keeping financial records
- Meeting legal obligations under tax, commercial and consumer legislation
- Ensuring information security and preventing misuse and fraud
- Measuring and improving service quality
- Sending commercial electronic messages where you have given explicit consent
- Exercising the right of defence in legal disputes
Legal bases
Your personal data is processed on the legal bases set out in Article 5 of the KVKK:
| Legal basis | Where it applies |
|---|---|
| Necessary for the formation or performance of a contract (Art. 5/2-c) | Orders, subscriptions, consultancy and support processes |
| Compliance with a legal obligation (Art. 5/2-ç) | Issuing invoices, keeping books, retaining financial and commercial records |
| Legitimate interest (Art. 5/2-f) | Information security, prevention of misuse, service improvement |
| Establishment and protection of a right (Art. 5/2-e) | Retaining evidence in the event of a dispute |
| Explicit consent (Art. 5/1) | Commercial electronic messages, non-essential cookies |
Transfers of data
Your personal data may be transferred to the parties below, limited to the purposes stated above. We never sell, rent or transfer your data to third parties for marketing purposes.
- Within Türkiye: certified public accountants and independent audit providers, e-invoice integrator, banks and payment institutions, courier and logistics companies, legal advisers
- Authorised public authorities: solely within the scope of requests and obligations arising from legislation
- Outside Türkiye: providers of hosting, database, email and messaging infrastructure
| Service provider | Purpose | Data location |
|---|---|---|
| Supabase | Database and authentication | Frankfurt / EU |
| Vercel | Website and application hosting | EU / US |
| Meta Platforms Ireland Ltd. | WhatsApp Business messaging infrastructure | EU / US |
| Apple and Google | Mobile application distribution and notification services | EU / US |
Transfers abroad are carried out under Article 9 of the KVKK, on the basis of an adequacy decision, standard contractual clauses or other appropriate safeguards provided by law, or on the basis of your explicit consent.
Retention periods
Your personal data is retained for as long as the purpose of processing requires and for the minimum periods prescribed by legislation. Once the period expires, the data is deleted, destroyed or anonymised.
| Data type | Retention period | Basis |
|---|---|---|
| Invoices and financial documents | 5 years | Tax Procedure Law, Art. 253 et seq. |
| Commercial books and records | 10 years | Turkish Commercial Code, Art. 82 |
| Contracts and annexes | 10 years from termination | Turkish Code of Obligations, Art. 146 (limitation period) |
| Correspondence and WhatsApp messages | 2 years from last contact | Legitimate interest |
| Server and access logs | 1 year | Information security |
| Subscription account data | 30 days after account closure | Termination of contract |
| Job applications and CVs | 1 year | Explicit consent |
Your rights
Under Article 11 of the KVKK you have the right to apply to the data controller and:
- Learn whether your personal data is processed
- Request information if it has been processed
- Learn the purpose of processing and whether the data is used in accordance with that purpose
- Know the third parties to whom the data is transferred, in Türkiye or abroad
- Request rectification if the data is incomplete or inaccurate
- Request erasure or destruction within the conditions set out in the law
- Request that rectification, erasure or destruction be notified to third parties to whom the data was transferred
- Object to a result against you arising from analysis carried out solely by automated systems
- Claim compensation if you suffer damage due to unlawful processing
How to submit a request
You may submit your requests through the following channels, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- In writing with a wet signature to our registered address: Akdeniz Mah. Cumhuriyet Blv. No: 120, 35220 Konak / İzmir, Türkiye
- From your registered electronic mail (KEP) address to: cavgalabs@hs01.kep.tr
- With a secure electronic signature or mobile signature to: iletisim@cavgalabs.com
- From the email address registered in our systems to: iletisim@cavgalabs.com
Your request is concluded within 30 days at the latest and is free of charge as a rule. If the response exceeds ten pages, a fee determined by the Personal Data Protection Board may be charged. If your request is rejected or is not answered in time, you may file a complaint with the Personal Data Protection Board.
Communication over WhatsApp Business
When you contact us via WhatsApp, we process your phone number, your WhatsApp profile name and the content of the messages you send. This communication runs on the WhatsApp Business Platform provided by Meta Platforms Ireland Ltd., and messages are transmitted through Meta's servers.
Data you send us over WhatsApp is used solely to respond to your request, provide support and perform the contractual relationship.
Meta's own data processing practices are governed by the WhatsApp Privacy Policy and fall outside the scope of this policy.
To stop receiving commercial messages from us, simply reply with the word DUR (Turkish for STOP). Our commercial electronic messages are registered with the Turkish Message Management System (İYS).
Cookies
Our website uses only cookies strictly necessary for the site to function, together with cookies that measure visit statistics. We do not use advertising or third-party tracking cookies.
Vercel Analytics, which we use for visit measurement, does not place a persistent cookie identifying visitors and does not collect personal data.
You can block or delete cookies at any time through your browser settings. If strictly necessary cookies are blocked, some parts of the site may not work.
Data security
We apply technical and administrative measures to prevent unlawful processing of and unlawful access to personal data.
- Encryption in transit using TLS
- Row-level access authorisation at the database layer
- Role-based access control following the principle of least privilege
- Access logging and regular review
- Regular backups with encryption at rest
- Data processing agreements concluded with service providers
In the event of unlawful acquisition of personal data, notification is made to the affected individuals and to the Personal Data Protection Board without delay, pursuant to Article 12/5 of the KVKK.
Changes
This policy may be updated in line with changes in legislation or in our activities. The current version is always published on this page and its effective date appears at the top. For material changes we additionally notify our registered users.