Política de privacidad

Privacy Policy

This Privacy and Cookie Policy (the "Privacy Policy") explains the scope within which, the purposes for which, the period for which and the safeguards under which personal data are processed on the website and platform offered under the heyAtlas brand. Detailed information for each group of data subjects is set out in the Personal Data Processing Notice (the "Notice").

1. Purpose and Scope

1.1. This Privacy Policy covers the website at the domain www.heyatlas.net (the "Website"), the demo request form and meeting appointment flow on the Website, the chat assistant on the Website where it is made available, and the heyAtlas platform offered through the user panel on the same domain (the "Platform").

1.2. This Privacy Policy has been prepared on the basis of Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary legislation. Where Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") applies to data subjects in the European Economic Area, Sections 4.10, 8.4 and 13.3 also apply.

1.3. This Privacy Policy is for information purposes only; it is not intended to obtain approval or explicit consent from data subjects. In the limited cases where explicit consent is required, consent is obtained through separate, subject-specific texts and a separate approval step: for demo requests, the Explicit Consent Statement for Processing Personal Data in Connection with a Demo Request (the "Demo Consent Statement"); for commercial electronic messages, the Commercial Electronic Message Consent (the "Commercial Message Consent").

1.4. The relationship with merchants or legal entities subscribing to the Platform (each a "Customer") is governed by the heyAtlas Platform Services Agreement and Terms of Use (the "Master Agreement") and, with respect to personal data processed on behalf of the Customer, by the heyAtlas Data Processing Agreement (the "DPA"). With respect to data processed on behalf of the Customer, the DPA prevails in the event of any conflict between this Privacy Policy and the DPA.

1.5. In this Privacy Policy, "User" means the natural persons (employees and authorised representatives) to whom a Customer or a sales partner grants access to the Platform.

2. Data Controller and Contact

2.1. The data controller for the processing activities described in this Privacy Policy and listed in Section 3.1 is the following company, which owns the heyAtlas brand and operates the Platform (the "Provider" or "heyAtlas"):

2.2. Questions and requests concerning personal data may be sent to hello@heyatlas.net, to the KEP address in Section 2.1 or to the postal address. Users may also use the support request screen within the Platform. The procedure for applications under Article 11 KVKK is set out in Section 9 of the Notice.

3. Data Controller and Data Processor Roles

3.1. The Provider is the data controller for the following processing activities: operation and security of the Website; management of demo and appointment requests; commercial electronic messages; the Website chat assistant where it is made available; opening of User accounts, authentication, authorisation and security records; contract acceptance records; credits, orders, invoicing and collection; support requests; relationships with sales partners and suppliers; and the generation of anonymous or aggregated statistics.

3.2. For data that a Customer uploads to the Platform or processes through the Platform ("Customer Data"), the Customer is the data controller and the Provider is the data processor. The main personal data within Customer Data are: contact cards of the Customer's customers, carriers, agents and other business contacts (name, e-mail, telephone, title, tax number); e-mails and attachments received and sent through channels connected to the Platform; Microsoft Teams messages; quotation, booking and shipment records; contact details automatically extracted from e-mail signatures; and the business content of Users' conversations with the artificial intelligence assistant on the Platform. The Provider processes these data only on the Customer's instructions and in accordance with the DPA.

3.3. Data subjects whose data form part of Customer Data should direct their rights under Article 11 KVKK primarily to the relevant Customer as data controller. Any such application received by the Provider is forwarded to the relevant Customer without undue delay, and the Provider assists the Customer to the extent of reasonable technical means in accordance with the DPA. Informing these persons and, where necessary, obtaining their explicit consent is the obligation of the Customer.

3.4. Sales partners (resellers) are data controllers independent of the Provider with respect to the personal data they process in their relationships with their own customers. Third-party services that a Customer connects to the Platform (e-mail and document services, ERP and TMS systems, carrier systems, e-invoicing, banking and payment systems) are subject to their own privacy terms.

4. Personal Data Processed and Purposes of Processing

4.1. When the Website is visited, the IP address, browser and device information, the page requested, the time of the request and the language preference are processed for the purposes of delivering the Website, ensuring information security, distinguishing bot and abusive traffic and remembering your language preference. No analytics, advertising or tracking cookies are used on the Website (Section 9).

4.2. In the demo request form, name and surname, business e-mail, company name, team size, telephone, message and, if selected, the appointment time are processed; the IP address, browser information and language information are processed when the form is submitted. The mandatory fields are name and surname and business e-mail; all other fields are optional. These data are processed to evaluate your request, contact you, create the appointment and send the meeting invitation, assign the request to an account manager, conduct the demo meeting, prepare a quotation at your request and prevent abuse of the form (a hidden honeypot field and a daily request limit per IP address). The explicit consent given under the Demo Consent Statement and the optional Commercial Message Consent are recorded together with the version of the approved text and the time of approval for evidentiary purposes.

4.3. Where the Commercial Message Consent has been given, the e-mail address and telephone number for which it was given and the name and surname are processed to send commercial electronic messages containing product, service, campaign, event, newsletter and survey content by e-mail, SMS and voice call. This processing relies on the Commercial Message Consent, which also constitutes explicit consent for the purposes of KVKK. The consent is optional and the demo request does not depend on it. You may withdraw the consent at any time, without giving reasons and free of charge; an opt-out notice is processed within 3 business days.

4.4. A User account is opened upon invitation by a Customer, a sales partner or the Provider. In this context, name and surname, e-mail address, username, role and permissions, the associated Customer or sales partner, language and notification preferences, an irreversible hash of the password, multi-factor authentication records, session, login and security events, IP address, device and browser information, and transaction and activity records on the Platform are processed. The purposes are: opening and managing the account; authentication and authorisation; providing the Platform under the Master Agreement; information security and prevention of abuse; recording credit consumption and transactions; and sending service notices concerning security, maintenance, releases, contract changes and price changes.

4.5. When the Master Agreement and the Supplemental Terms are accepted, the name of the accepting User, the accepted text and its version number, the timestamp, the IP address and the device and browser information are stored in an unalterable form. For orders, credits, payments and invoices, the trade name, address, tax office and number of the invoice addressee (for sole proprietorships, the tax identification number, which is the Turkish identity number), payment and bank transaction information and the contact details of the relevant authorised persons are processed.

4.6. For requests submitted through the support request screen within the Platform or by e-mail, name and surname, contact details, the content of the request, attachments and correspondence, and the technical records required to resolve the request are processed. Authorised personnel of the Provider may obtain limited access to a Customer account for support and security purposes; such access is read-only as a rule and is subject to additional verification, a time limit and an audit trail.

4.7. The identity, contact, title, contract, order, current account and payment information of the authorised representatives and employees of sales partners and suppliers are processed for the purposes of establishing and conducting the relationship, invoicing, payment and fulfilling obligations arising from legislation.

4.8. The Provider does not intend to collect special categories of personal data listed in Article 6 KVKK through the Website or the Platform. Please do not enter such data in the demo form, the chat assistant, support requests or other free-text fields. The lawfulness of any such data contained in Customer Data is the responsibility of the Customer.

4.9. The processing activities above rely on the following legal grounds: Article 5(2)(a) KVKK, being expressly provided for by law; Article 5(2)(c), being directly related to the establishment or performance of a contract; Article 5(2)(ç), being necessary for the Provider to comply with a legal obligation; Article 5(2)(d), the data having been made public by the data subject; Article 5(2)(e), being necessary for the establishment, exercise or protection of a right; and Article 5(2)(f), the Provider's legitimate interests, provided that the fundamental rights and freedoms of the data subject are not harmed. Explicit consent is sought only for the following processing: the transfer of demo request data to service providers abroad, as an additional basis alongside the other mechanisms under Article 9 KVKK; the sending of commercial electronic messages and the transfer of the contact data used for that purpose to service providers abroad; and analytics or advertising cookies, should they be used in future. The mapping of purposes and legal grounds for each group of data subjects is set out in Section 5 of the Notice.

4.10. Where the GDPR applies, Article 5(2)(a) and (ç) KVKK are assessed under Article 6(1)(c) GDPR (legal obligation), Article 5(2)(c) KVKK under Article 6(1)(b) GDPR (performance of a contract or pre-contractual steps), Article 5(2)(d), (e) and (f) KVKK under Article 6(1)(f) GDPR (legitimate interests), and explicit consent under Article 6(1)(a) GDPR (consent). For processing based on legitimate interests, the interests are the secure and functional delivery of the service, responding to requests, conducting business relationships and protecting rights.

4.11. If fields marked as mandatory are not completed, the relevant request cannot be processed; if strictly necessary cookies are blocked, it may not be possible to sign in to the Platform.

5. Website Chat Assistant

5.1. The artificial-intelligence-supported chat assistant, which can be used on the Website without signing in, is available only where and for as long as the Provider makes it available. Use of the assistant is entirely optional; demo requests and the other functions of the Website do not depend on use of the assistant.

5.2. When the assistant is used, the messages you write and the assistant's replies, a random anonymous session identifier that does not directly identify you, the path of the Website page you are on, and language and time information are processed. To prevent abuse, bot verification (Cloudflare Turnstile) may be performed and your IP address may be used momentarily for access control; the IP address is not written to the assistant conversation records.

5.3. Your messages are transmitted to the artificial intelligence service provider OpenAI (USA) to generate replies; this transmission constitutes a transfer of personal data abroad (Section 8). Assistant conversations are retained for 180 days for the purposes of reviewing reply quality and detecting abuse, and are deleted at the end of that period.

5.4. Please do not enter your name, contact details, special categories of personal data or personal data of third parties in the assistant; you may use the demo form for contact requests. The assistant's replies are generated by artificial intelligence, may be inaccurate or incomplete, and do not constitute an offer, a commitment or legal, financial or professional advice on behalf of the Provider.

6. Processing with Artificial Intelligence

6.1. The Platform uses artificial intelligence models for content generation, classification and information extraction. For this purpose, the following content is transmitted to the artificial intelligence service provider OpenAI (USA): messages written by Users to the artificial intelligence assistant on the Platform; the conversation transcript together with tool outputs; e-mails and attachments received by the Platform (for classification, information extraction and response generation); where full-content processing of e-mails is enabled, additionally the e-mail in full, including quoted and forwarded earlier correspondence and attached e-mails, together with the images embedded in its body and its audio attachments for transcription (the content of video attachments is not transmitted); files uploaded in bulk data entry; audio recordings sent by Users to the artificial intelligence assistant on the Platform or via Microsoft Teams (for transcription); and, where it is made available, messages written to the Website chat assistant.

6.2. Customer Data are not used to train the general models of the artificial intelligence service provider. The artificial intelligence service provider may retain the content transmitted to it for a limited period for the purpose of abuse monitoring under its own terms of service.

6.3. Records of artificial intelligence calls and tool runs are retained for 180 days for the purposes of debugging, security, cost control and verification of credit consumption.

6.4. The automation and autonomy levels of the Platform are selected and configured by the Customer. The Customer is the data controller with respect to suggestions generated, messages sent and decisions taken through the Platform concerning the Customer's business contacts. In the processing activities for which it is the data controller, the Provider does not take decisions about data subjects that are based solely on automated processing and produce legal effects on them. Your right to object under Article 11(1)(g) KVKK is reserved.

7. Transfer of Personal Data and Sub-processors

7.1. The Provider may transfer personal data only for the purposes stated in this Privacy Policy and the Notice, and in accordance with Articles 8 and 9 KVKK, to the following groups of recipients: sub-processors used to provide the service (Section 7.2); competent public authorities and institutions, judicial authorities and enforcement offices; advisers providing legal, financial advisory and independent audit services, and e-invoice and e-archive service providers; banks and payment institutions for payment transactions; with respect to Customers acquired through a sales partner or assigned to a sales partner by the Provider, the relevant sales partner, limited to orders, invoicing, subscription management and usage summaries and, for these purposes, the Customer's company contact and invoicing contact details (the company e-mail address and telephone number; the name and surname of the contact person; the name and surname, e-mail address and telephone number of the invoicing contact person; the invoicing e-mail address); and, in the event of a transfer of the business or of the contract, the transferee. The Customer's business content is not shared with sales partners.

7.2. As at the publication date of this Privacy Policy, the sub-processors used by the Provider are:

7.3. Customers can access the current list of sub-processors on the Settings › Data page of the Platform; changes to sub-processors are notified to the Customer in accordance with the procedure in the DPA. Other data subjects may request the current list from hello@heyatlas.net.

7.4. The Provider does not sell or rent personal data and does not make them available to third parties for their own marketing purposes. Connections to Google Workspace and Microsoft 365 accounts are engaged when the Customer connects those accounts to the Platform; the Customer may connect more than one account. In that case, the Platform may send from the relevant mailbox to the extent authorised by the Customer for each account; for Microsoft 365 accounts, it may read the inbox to the extent that the incoming mail pipeline or the automation trigger is enabled for that mailbox. In a mailbox where both the incoming mail pipeline and the automation trigger are disabled, message headers are read only to match replies and non-delivery notifications received for messages sent by the Platform from that mailbox. These header details are displayed on the Customer's inbox screen in the Platform. For Google Workspace accounts, the inbox is not read.

8. Transfers Abroad

8.1. From the perspective of Türkiye, the entire infrastructure of the Platform is located abroad. Data are hosted primarily in data centres in the European Union (Germany and Finland). In the following flows, data may also be transferred outside the EU: in artificial intelligence processing, to the USA (OpenAI); in Cloudflare and Google services, to countries in which those providers' global infrastructure is located. In addition, some of the service providers are headquartered in the USA; owing to their support, maintenance and security processes or the legislation to which they are subject, data hosted in the EU may be accessed from outside the EU.

8.2. Transfers abroad are carried out in accordance with Article 9 KVKK: on the basis of an adequacy decision where one exists for the country, a sector within the country or the international organisation concerned; where none exists, on the basis of one of the appropriate safeguards listed in Article 9(4) KVKK, in particular the standard contracts announced by the Personal Data Protection Board (the "Board"); and, where neither an adequacy decision nor an appropriate safeguard exists, only for transfers of an incidental nature, on the basis of one of the cases listed in Article 9(6) KVKK. In every case, the transfer relies on one of the processing conditions in Article 5 or Article 6 KVKK.

8.3. As an additional basis alongside the other mechanisms under Article 9 KVKK, explicit consent is requested through the Demo Consent Statement with respect to the transfer of demo request data to hosting, database, e-mail and calendar service providers abroad, and through the Commercial Message Consent with respect to the transfer of the contact data used for sending commercial electronic messages to service providers abroad. These texts also provide information on the possible risks of the transfer. Explicit consent applies to the extent that the transfer cannot rely on another Article 9 KVKK mechanism.

8.4. Where the GDPR applies, transfers outside the European Economic Area are carried out on the basis of the transfer tools provided for in Chapter V of the GDPR, in particular adequacy decisions of the European Commission or standard contractual clauses adopted by the Commission. Information on the safeguards applied may be requested through the channels in Section 2.2.

9. Cookies and Similar Technologies

9.1. A cookie is a small text file placed in your browser by a website you visit and sent back to that website with subsequent requests. The Website and the Platform use only cookies that are strictly necessary for the service to function or functional cookies intended to remember a preference you have made. All of these cookies are first-party cookies.

9.2. The cookies used are:

9.3. Your browser's local storage is used only to store interface preferences (view and window states) and, where it is made available, the anonymous session identifier of the Website chat assistant. These data can be deleted through your browser settings.

9.4. Access to the Website and the Platform is provided through Cloudflare's network and security services; Cloudflare Turnstile bot verification may be used on the Website. These services may process technical signals such as the IP address and browser characteristics to distinguish malicious traffic, and may use short-lived security identifiers. These identifiers are strictly necessary; the Provider does not use them for advertising or profiling purposes.

9.5. Strictly necessary and functional cookies do not rely on explicit consent, as they are necessary to provide the service you request; they rely on the Provider's legitimate interest in providing the service securely and functionally under Article 5(2)(f) KVKK and, where the User is a party to the contract, also on Article 5(2)(c).

9.6. No analytics, advertising, targeting, social media or third-party tracking cookies are used on the Website or the Platform. Should cookies of this kind be used in future, this Privacy Policy will be updated in advance and such cookies will be activated only after your explicit consent has been obtained; declining consent will not prevent you from using the Website.

9.7. You can view, delete and block cookies through your browser settings. If you block strictly necessary cookies, you may be unable to sign in to the Platform or to complete multi-factor authentication; if you delete the language cookie, your language preference will be reset.

10. Retention Periods and Destruction

10.1. Personal data are retained for the period provided for in the relevant legislation or for as long as necessary for the purpose for which they are processed. When the period expires, the data are deleted, destroyed or anonymised in accordance with Article 7 KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

10.2. The main retention periods are set out below. For records constituting Customer Data, different periods announced according to the Customer's plan and the Customer's settings on the Platform are reserved.

10.3. When the contractual relationship ends, the Customer may export its data within 30 days from termination. Customer Data and User account data are deleted or anonymised within 90 days from termination, subject to statutory retention obligations. Company records are not deleted but are set to inactive status; personal data contained in these records, in particular the identity and contact details of sole proprietorships, are deleted or anonymised when the statutory retention periods expire.

10.4. Backups are taken every night in encrypted form and retained in 3-day and 4-week cycles. Deleted data leave the backups in the ordinary cycle and in any event within 60 days. Backups are used only for restoration in the event of data loss or disaster.

11. Data Security

11.1. In accordance with Article 12 KVKK, the Provider applies the following technical and organisational measures for the security of personal data: encrypted connections (TLS); field-level encryption (AES-256-GCM) of the Customer's access credentials for external systems; multi-factor authentication that is mandatory for the Provider's administrator staff accounts and optional for Customer and sales partner accounts; role-based authorisation; audit trails; nightly encrypted backups; additional verification, a time limit and an audit trail for access by Provider personnel to Customer accounts; and confidentiality obligations of personnel.

11.2. These measures do not constitute any certification or any commitment to a particular service level. No system provides complete security; Users also contribute to the security of their own accounts by keeping their passwords confidential and enabling multi-factor authentication.

11.3. In the processing activities for which the Provider is the data controller, if personal data are unlawfully obtained by others, the data subject and the Board are notified in accordance with Article 12(5) KVKK within the period and in the manner provided for in legislation. Breaches concerning Customer Data are notified to the Customer in accordance with the DPA.

12. Persons Under 18

12.1. The Website and the Platform are intended for merchants and businesses engaged in professional activities; they are not directed at persons under the age of 18. The Provider does not knowingly collect personal data of persons under 18. If it becomes apparent that such data have been collected, the data are deleted without undue delay.

13. Rights of the Data Subject

13.1. Under Article 11 KVKK, you have the right to learn whether your personal data are processed; to request information if they have been processed; to learn the purpose of processing and whether they are used in accordance with that purpose; to know the third parties to whom they are transferred in Türkiye or abroad; to request rectification if they are incomplete or inaccurate; to request deletion or destruction within the framework of Article 7 KVKK; to request that rectification, deletion and destruction be notified to the third parties to whom they have been transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

13.2. Applications are made using the procedure in Section 9 of the Notice and are concluded free of charge within 30 days at the latest; where the action entails an additional cost, the fee in the tariff determined by the Board may be charged. If your application is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Board under Article 14 KVKK. Applications concerning Customer Data are subject to Section 3.3.

13.3. Where the GDPR applies, you also have the right to access your personal data, to request their rectification or erasure, to request restriction of processing, to object to processing based on legitimate interests, to request data portability for processing carried out by automated means on the basis of consent or contract, to withdraw your consent at any time with effect for the future, and to lodge a complaint with the supervisory authority in your country. These rights may be exercised through the contact channels in Section 2.2.

14. Changes and Effectiveness

14.1. The Provider may update this Privacy Policy to reflect changes in its processing activities, sub-processors or legislation. A new version is published on the Website with its version number and publication date; material changes are also notified to Users within the Platform. Where the purpose of processing changes, data subjects are separately informed before processing for the new purpose begins. In the relationship with the Customer, the provisions of the Master Agreement on amendments are reserved.

14.2. This version takes effect on the publication date stated below: 21 Oct 2026

Version: 6 · Published: 21 Oct 2026