Privacy Policy

This Privacy Policy (“Policy”) sets forth the procedures and principles regarding the processing of personal data during the use of the website (“Website”) operated by Cwork LLC Technologies (hereinafter referred to as “Company”) and the use of artificial intelligence, technologies, and software solutions provided by Company. As Company, we are not merely a software provider but a technology partner that has adopted the “Privacy by Design” principle. With this in mind, we have adopted full compliance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) and related secondary regulations, as well as international data protection standards (such as the GDPR), as an integral part of our corporate culture.

The details of our Company, which holds the status of “Data Controller” under the KVKK, are as follows:

• Company Name — Cwork LLC Technologies
• Address — 1760 N Jog Rd #120, West Palm Beach, FL 33411, USA
• Email — hello@cwork.ai

The privacy, integrity, and security of the data you share while visiting our Website or using the artificial intelligence technologies, and all other software solutions we offer are our top priority. Company has designed its technological infrastructure in accordance with the highest cybersecurity standards. Through this Policy, we aim to provide transparent information regarding the purposes for which your personal data is processed, to whom it may be disclosed, our data collection methods, and the rights you possess as a data subject.

The scope of the information we collect and our purposes for processing it vary depending on the nature of your interaction with the Website:

• Visitor: users who visit the Website without logging in, solely for informational purposes (limited technical data and cookies).
• User/Customer: individuals who license Company software solutions, request a demo, or subscribe to our newsletter (identity, contact, and transaction security data).

Company collects the following data — either directly from you (via forms) or through automated methods (cookies and server logs) — as part of providing the Website, artificial intelligence technologies, and all other software services:

These data categories include information provided to us when creating an account, requesting a demo, or filling out contact forms:

• Identification information: first name, last name, Turkish ID number (TCKN) (if legally required), signature (in corporate authorization processes).
• Contact information: email address, phone number, business address, LinkedIn profile, or social media usernames.
• Professional experience data: information about the organization/company you work for, job title, area of expertise (for personalizing services and corporate licensing processes).
• Request and complaint management: feedback, support requests, and technical or legal details specific to your business — which you share at your own discretion — via the channels through which you contact us (email, live support, etc.).

The following data is automatically recorded by our systems to improve your experience, ensure cybersecurity, and for analytical purposes while you use the Website:

• Transaction security and device information: IP address, device type (PC/mobile), operating system and version, browser type and language settings, screen resolution, network type, time zone settings, and device identifiers (UUID).
• Usage and interaction data: your browsing activity on the Website (clickstream), pages visited, links clicked, time spent on pages, search queries, and error logs (log records).
• Location data: approximate location information derived from your IP address (at the city/country level). Your device's GPS-based precise location data is not processed unless you provide your explicit consent.

If you log in from multiple devices (for example, both a mobile phone and a desktop computer), your profile information may be analyzed to identify your interactions across devices in order to ensure uninterrupted service and perform security verifications.

Employee health data maintained within the website, artificial intelligence, and other software solutions provided by the Company may only be processed by the "Workplace Physician" and authorized Occupational Health and Safety (OHS) personnel who are under the obligation of confidentiality, pursuant to Article 6 of the Law No. 6698 on the Protection of Personal Data (KVKK). The Platform technically ensures this security through Role-Based Access Control (RBAC). Your Institution, acting as the Data Controller, bears the sole responsibility for ensuring that such authorization assignments are executed in compliance with applicable laws

This Policy covers only the data of Website visitors and individuals who communicate directly with our Company. With regard to personal data that our corporate customers — who license Company's artificial intelligence technologies, and other software solutions (SaaS) — upload or process within the relevant platform as part of their own operations:

• the corporate customer acts as the “Data Controller”,
• Company acts as the “Data Processor”.

The procedures for processing this data uploaded to the Company infrastructure by our customers fall outside the scope of this Policy and are subject to the provisions of the “User Agreement” entered into between the parties and the “Data Processing Agreement” (DPA), which is an integral part of that agreement. Company undertakes to process this data solely in accordance with the Customer's instructions and within the limits of the agreement.

As Company, we process your personal data based on the legal grounds specified in Article 5 of the KVKK and for the limited purposes set forth below.

As part of our corporate partnerships, this data pertains to representatives of our corporate clients or business partners.

• Processed data: first and last name, Turkish ID Number (TCKN)/Foreign ID Number (YKN)/passport number, signature circular, power of attorney information, MERSIS number.
• Purposes of processing: Management of contractual processes, verification of signing authority, fulfillment of notification obligations to official authorities, digitalization of occupational health and safety (OHS) processes, and the execution of predictive risk analytics and reporting.
• Legal basis: the conclusion or performance of a contract (KVKK Art. 5/2-c), the data controller's legal obligation (Art. 5/2-ç), and legitimate interest (Art. 5/2-f).

This data is processed to enable effective communication with you and to provide our services.

• Processed data: email address, cell/work phone number, business address, country/city of residence, job title.
• Purposes of processing: Management of goods and services sales and after-sales support processes, execution of finance and accounting operations, execution of activities aimed at ensuring customer satisfaction, digitalization of occupational health and safety (OHS) processes, and the execution of predictive risk analytics and reporting.
• Legal basis: the conclusion or performance of a contract (Art. 5/2-c) and our legitimate interests, provided that such processing does not infringe upon fundamental rights (Art. 5/2-f).

Given that Company is a platform involving artificial intelligence technology, and other software, these data are of critical importance for regulatory compliance and the management of potential disputes.

• Processed data: application records related to artificial intelligence technology, and all other software.
• Purposes of processing: Execution and follow-up of legal affairs, providing information to competent authorities and institutions (e.g., BTK, KVKK, judicial authorities, etc.), auditing of regulatory compliance processes, digitalization of occupational health and safety (OHS) processes, and the execution of predictive risk analytics and reporting.
• Legal basis: the necessity of data processing to establish, exercise, or protect a right (Art. 5/2-e) and legal obligation (Art. 5/2-ç).

When you choose to log in to the Website via social media platforms (Google, LinkedIn, etc.), your publicly available profile information, username, and access tokens shared via the relevant third-party platform are transferred to our system. Important note: the scope of this data is limited to the permissions you grant in the privacy settings of the relevant social media platform. Company cannot be held responsible for the data collection policies of these platforms.

Limited data may be collected through advertisers, business partners, or publicly available sources (such as the Commercial Registry Gazette, LinkedIn, etc.) for the purposes of improving our services, verifying corporate identity, and preventing fraud.

Company processes the personal data it collects along the fundamental lines outlined below to ensure the sustainability of the artificial intelligence technologies it offers, as well as all other software solutions; to fulfill its legal obligations; and to optimize the user experience:

• Service provision: Operation of the Website, the Company's artificial intelligence technologies, and all other software solutions with all their functionalities; management of membership and licensing processes; digitalization of occupational health and safety (OHS) processes; and the execution of predictive risk analytics and reporting.
• Support and communication: addressing your technical support requests, providing service updates, system notifications, and user guides.
• Personalization: ensuring that the Website's content is presented in the most suitable and effective manner based on your and your device's technical specifications.

• System security: Protection of the Website and user data against cyberattacks, unauthorized access, and fraud, digitalization of occupational health and safety (OHS) processes, and the execution of predictive risk analytics and reporting.
• Audit and compliance: conducting compliance activities, maintaining records to serve as evidence in legal disputes, and responding to information requests from government authorities.

• Usage analysis: Improving product features and developing new modules by analyzing how you use the Website via your devices through anonymized or aggregated data; digitalization of occupational health and safety (OHS) processes, and the execution of predictive risk analytics and reporting.
• Performance measurement: monitoring the performance of the services provided and developing business strategies based on user segmentation.

• Personalized content: subject to your consent in accordance with applicable laws, sending you newsletters, special offers, and industry updates that may interest you.
• Advertising optimization: displaying promotions and advertisements that may interest you based on your experience on the Website.

Your personal data is shared only for the following purposes and only to the extent each purpose requires:

• Analytics provider — Google Analytics 4, for website usage statistics, and only if you give explicit consent to analytics cookies.
• Hosting and database provider (Supabase) — to store form submissions.
• Email infrastructure provider (Google Workspace (Gmail))— to deliver contact form notifications and newsletter messages.
• Competent public authorities — where required by our legal obligations.

We do not sell or rent your personal data to third parties for advertising purposes.

Company relies on service providers established outside your country. Your personal data may therefore be transferred abroad in the following cases:

• Website usage statistics: If you give explicit consent to analytics cookies, your browser and browsing data are processed through Google Analytics 4 by Google LLC / Google Ireland Limited. Until you consent, no request is sent to Google and no transfer takes place.
• Contact and newsletter records: Data you submit through our forms is stored on Supabase infrastructure and delivered via Google Workspace (Gmail).

These transfers are carried out under Article 9 of the KVKK and Chapter V of the GDPR, on the basis of your explicit consent or appropriate safeguards (standard contractual clauses).

Company retains your personal data for as long as necessary to fulfill the purposes of processing or within the legal timeframes prescribed by law (such as statutes of limitations).

• Account information: retained for as long as your membership remains active. If you close your account, it will be deleted, destroyed, or anonymized during the first disposal period following the expiration of the periods required by our legal obligations (e.g., Law No. 5651 or the Tax Procedure Law).
• Technical note: the complete removal of information from backups and cached systems may take additional time due to system security protocols.
• Contact form records: Your name, email address, company name, and message are retained for 2 years to respond to your request and to serve as evidence in the event of a dispute. They are deleted at the end of this period.
• Newsletter subscription: only your email address and the channel you subscribed through are stored. Your record is deleted when you unsubscribe.

Pursuant to Article 11 of the Personal Data Protection Law (KVKK), you have the right to learn whether your personal data is being processed, to request information if it has been processed, to request the correction of incomplete or incorrect data, and to request its deletion. You may submit your requests to our Company using the following methods, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller:

• Written application: by submitting a hand-signed petition, along with documents verifying your identity, in person or through a notary public to our Company headquarters at “1760 N Jog Rd #120, West Palm Beach, FL 33411, USA”.
• Electronic request: by sending an email to hello@cwork.ai using the email address you previously provided to our Company and which is registered in our system. (If you are sending from an email address other than your registered one, the use of a secure electronic signature or mobile signature is mandatory as required by regulation.)

Your requests will be processed free of charge as soon as possible and no later than thirty (30) days, depending on their nature. However, if the process incurs additional costs, a fee based on the tariff set by the Personal Data Protection Board may apply.

Company may update this Privacy Policy at any time in accordance with evolving technological conditions, newly offered services, or changing legal requirements. Updates take effect as soon as they are published on the Website. We recommend that our users periodically check the “Last Updated” date.