KVKK Notice

Pursuant to Turkish Personal Data Protection Law No. 6698 ("KVKK") and related regulations, CerebrAI VortX Nöroteknoloji ve Yazılım Sistemleri Ltd. Şti. ("the Company" or "CerebrAI-VortX"), acting as data controller, processes personal data of natural persons ("Data Subjects") who visit our website, fill in our contact forms, use our services, or otherwise contact us, in accordance with this Notice.

This Notice is issued to fulfill our obligation under KVKK Art. 10.

1.1 Identity and Contact

• •Name, surname
• •Email address
• •Phone (optional)
• •Company / organization (optional)

1.2 Inquiry / Communication Content

• •Message or request content submitted via the contact form

1.3 Transaction Security Data

• •IP address
• •Browser type and version, OS, language preference
• •On-Site navigation data (page, time, referring URL)
• •Records related to cookies and similar technologies
• •Security logs collected via Cloudflare

• •Receiving, evaluating, and responding to inquiries
• •Operating Site infrastructure and ensuring security
• •Measuring Site performance and improving user experience (aggregate / anonymized)
• •Compliance with legal obligations (laws, court / regulatory orders)
• •Pursuing the Company's legitimate interests (fraud prevention, information security)
• •Sending updates / announcements with your explicit consent

• •Necessary for performance of contract (Art. 5/2-c): handling your inquiry, providing services.
• •Compliance with legal obligation (Art. 5/2-ç): retention and reporting required by law.
• •Legitimate interest of the controller (Art. 5/2-f): Site security, fraud detection, aggregate analytics.
• •Mandatory without prejudice to fundamental rights (Art. 5/2-f): log analysis.
• •Explicit consent (Art. 5/1): non-essential cookies, newsletter / announcement subscription (if any) — withdrawable at any time.

4.1 Domestic Transfers

Your data may be transferred to authorized employees, professional advisors bound by confidentiality (lawyers, accountants, auditors), and legally authorized public authorities upon request, as required for business operations.

4.2 International Transfers

Because the Site runs on global infrastructure provided by Cloudflare Inc., connection metadata such as your IP address may be processed transiently on Cloudflare edge servers in different regions.

Such international transfers are conducted under Standard Contractual Clauses (SCCs) and appropriate technical safeguards in accordance with KVKK Art. 9.

Personal data is collected through forms you submit on the Site, email correspondence, and automated means via the Site's technical infrastructure (cookies, server logs) — i.e. partially automated / automated means.

Pursuant to KVKK Art. 11, you may apply to the Company to:

• •Learn whether your personal data is processed
• •Request information regarding processing
• •Be informed of the purpose and proper use
• •Know third parties to whom data is transferred (domestically or abroad)
• •Request rectification of incomplete or inaccurate data
• •Request deletion or destruction within the conditions of KVKK Art. 7
• •Request notification of correction / deletion to third parties to whom data has been transferred
• •Object to results derived solely from automated analysis
• •Claim compensation for damages caused by unlawful processing

To exercise these rights, please submit your request including the following information, per the Communiqué on the Procedures and Principles of Application to the Data Controller:

• •Name, surname, and signature if written
• •Turkish ID number for citizens; nationality and passport / ID number for foreigners
• •Address for notification (residence or workplace)
• •Email, phone, and fax (if any)
• •Subject of the request

Channels

• •Email: info@cerebrai-vortx.com (from your registered email or with secure e-signature)
• •Postal mail: Ulubağ Mah. Recep Tayyip Erdoğan Blv. Harran Üniversitesi Teknokent No:287 A, İç Kapı No: Z1, Haliliye / Şanlıurfa, Türkiye

Your request will be resolved within 30 days based on its nature. If your request is rejected, the response is insufficient, or no response is given within the period, you may lodge a complaint with the Personal Data Protection Authority (kvkk.gov.tr).

The Company is obliged to register with the Data Controllers' Registry Information System (VERBİS) where required by law. The status of our registration and registry number, when finalized, will be added to this Notice.