Privacy Policy and Personal Data Processing Notice

How we collect, use, share and protect your personal data

1. Introduction and Scope

Fizix Information Technologies Ltd. (“Fizix”, the “Company”, “we”) values the privacy and the security of the personal data of everyone who visits our website at https://fizix.ai (the “Site”), fills in forms on the Site, subscribes to our newsletter, contacts us or applies for a job (the “Data Subject”, “you”).

This Privacy Policy and Information Notice (the “Policy”) has been prepared to inform you about which of your personal data is processed, for what purposes and on which legal grounds, to whom and for what purposes it may be transferred, how long it is retained, and what rights you have regarding this data.

The Policy has been prepared taking into account the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and its secondary legislation, the Law No. 6563 on the Regulation of Electronic Commerce and, to the extent they apply to you, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and the Data Protection Act 2018 (“UK GDPR”), as well as other data protection regulations applicable in your country of residence.

This Policy applies only to the Site and the activities carried out through the Site. Data processed while using Fizix products and services (including devices, the cloud platform and mobile applications) is subject to the relevant agreements and the notices specific to those services. Detailed information on cookies and similar technologies is provided in the Cookie Policy, which forms an integral part of this Policy.

2. Data Controller

The data controller for your personal data under this Policy is:

Item Details Company name Fizix Information Technologies Ltd. Address Üniversiteler, 1606. Cd. C3 Blok İç Kapı No: Z63, 06800 Çankaya/Ankara, Türkiye Trade Registry / MERSIS No 0811137322800001 Email hello@fizix.ai

3. Personal Data We Process

Depending on how you use the Site, the following categories of your personal data may be processed:

Data category Data processed Identity First name, last name. Contact Email address, phone number, country/city and postal address (if you share them). Professional information Your company/organisation, job title and role, industry. Requests, feedback and suggestions Messages, questions, quote and demo requests, feedback, suggestions and complaints you send via forms, email or other channels; comments and content you may share on the Site if such features are offered in the future. Job applications CV and cover letter content; education, work experience, skills and any other information you voluntarily share in your application. Marketing and preferences Newsletter subscription, records of consent to and refusal of commercial electronic messages, communication preferences, cookie preferences. Transaction security and digital footprint IP address, date and time, device and browser type, operating system, language setting, referring page, pages visited, session and interaction data (clicks, scrolling, time on page), cookies and similar identifiers.

Special categories of personal data: We do not request special categories of personal data through the Site, such as data on health, religion, beliefs, ethnic origin, political opinions, trade union membership, criminal convictions, or biometric or genetic data. Please do not include such data in forms, messages or your CV. Any such data you share voluntarily will be deleted or anonymised as soon as possible.

Data relating to third parties: If you provide us with personal data relating to another person (for example, references in your CV or a colleague on whose behalf you make a request), you confirm that you have informed that person and, where necessary, obtained their permission. You are responsible for the accuracy and currency of the information you provide to us.

4. How Personal Data Is Collected

Your personal data is collected electronically, by fully or partially automated means: (i) directly from you through the contact, quote, demo, newsletter and job application forms on the Site and through channels such as email and telephone; (ii) automatically through cookies, server logs and similar technologies while you visit the Site; and (iii) through the suppliers we use for hosting, analytics and communication processes related to the Site.

5. Processing Purposes and Legal Grounds

Your personal data is processed for the purposes listed below, on the legal grounds shown opposite each purpose, in a manner that is relevant, limited and proportionate to the purpose:

Purpose Data categories processed Legal ground Receiving, assessing and responding to your contact, quote, demo and information requests; conducting pre-contractual discussions Identity, contact, professional information, requests Necessary for entering into or performing a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b); legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f) Assessing your feedback, suggestions and complaints; improving the quality of our products and services Identity, contact, feedback and suggestions Legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f) Sending newsletters; promotional and marketing communications about our products, services, events and content Identity, contact, professional information, marketing and preferences Explicit consent / consent to commercial electronic messages (KVKK Art. 5/1; Law No. 6563 Art. 6; GDPR Art. 6/1-a); legitimate interest where permitted by law Receiving and assessing job applications and running recruitment processes Identity, contact, professional information, job applications Necessary for entering into a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b); explicit consent for retaining the application for future positions Operating and providing the Site, ensuring its security, fixing errors, and preventing misuse and unlawful access Legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f); legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6/1-c) Analysing Site usage, producing statistics, and improving content and user experience (through non-essential cookies) Transaction security and digital footprint, cookie preferences Explicit consent (KVKK Art. 5/1; GDPR Art. 6/1-a) Complying with legal obligations; responding to requests from competent authorities All relevant categories Legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6/1-c); expressly provided for by law (KVKK Art. 5/2-a) Establishing, exercising and defending rights in legal disputes; meeting the burden of proof Establishment, exercise or protection of a right (KVKK Art. 5/2-e); legitimate interest (GDPR Art. 6/1-f)

We do not process your personal data for any purpose incompatible with the purpose for which it was collected. We do not sell your personal data. We do not carry out solely automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you using data collected through the Site.

Fields marked as mandatory in forms are necessary for us to handle your request; if you do not provide this information, we may be unable to fulfil your request.

6. Newsletter and Commercial Electronic Messages

If you subscribe to our newsletter or consent to receive commercial electronic messages, your contact details are processed to send you newsletters, announcements, event invitations and promotional content. You may withdraw your consent at any time, without giving any reason and free of charge, by using the “unsubscribe” link in each message, by writing to hello@fizix.ai or, where applicable, via the Turkish Message Management System (İYS). Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Job Applications

The CV and application information you send via the Site or by email is processed only by authorised persons involved in the process, solely for the purpose of assessing your application and running the recruitment process. If your application is unsuccessful, your information is retained for the period specified in Section 10, as evidence in case of possible disputes and, if you consent, to be considered for suitable future positions.

8. Recipients of Personal Data and Purposes of Transfer

Your personal data may be transferred to the following groups of recipients, limited to the purposes stated above, on a strict “need to know” basis and with the necessary technical and organisational measures in place:

Our group companies: Fizix’s parent company, subsidiaries and affiliates, so that your request can be handled by our team in the relevant country and to carry out our activities.

Our service providers (data processors): Suppliers in Türkiye and abroad that provide services for developing, hosting and operating the Site, form and content management, cloud and email infrastructure, customer relationship management, newsletter delivery, web and session analytics, information security and technical support. These suppliers process your data only on our instructions and under contractual confidentiality and security obligations.

Our business partners: Authorised distributors, resellers and solution partners in your region, to the extent necessary to fulfil your request and where permitted by law.

Our advisers: Lawyers, accountants, auditors and similar advisers bound by confidentiality, for the conduct of legal, financial and audit processes.

Competent public authorities: Competent judicial and administrative authorities, to comply with legal obligations or respond to a lawful request.

Parties to corporate transactions: The relevant parties and their advisers in transactions such as mergers, demergers, acquisitions, investments or asset transfers, under confidentiality obligations and to the extent required by the transaction.

9. International Transfers of Personal Data

Fizix operates internationally, and some of the service providers listed above have servers located outside Türkiye, the United Kingdom and the European Economic Area (including the United States). Your personal data may therefore be transferred outside your country of residence.

Transfers from Türkiye abroad are carried out in accordance with Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, where there is an adequacy decision, where one of the appropriate safeguards such as the standard contracts published by the Turkish Personal Data Protection Board is in place, or where one of the exceptions provided for in the Law applies. Transfers from the EU and the UK are based on adequacy decisions or appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. You can request information about the safeguards applied by writing to hello@fizix.ai.

10. Retention Periods

Your personal data is retained for as long as necessary for the purpose for which it is processed and for the retention and limitation periods set out in the applicable legislation; at the end of that period it is deleted, destroyed or anonymised. The periods we apply are as follows:

Data / process Retention period Form records held in the Site infrastructure Deleted from the Site infrastructure within 90 business days at the latest after being transferred to the systems where our business processes are run. Contact, quote and demo requests, feedback and suggestions 2 years from the date of last contact. If the request results in a contractual relationship, for the term of the contract and 10 years after its termination. Newsletter subscriptions and commercial electronic message records Until you withdraw your consent; consent and refusal records are kept for 3 years after the consent ceases to be valid. Job applications and CVs Up to 1 year after the application process is completed. If you are hired, the statutory periods for personnel files apply. Cookies and analytics data The periods specified in the Cookie Policy; usage data in analytics tools for up to 14 months. Access and security logs The period set out in the applicable legislation; otherwise up to 2 years. Data subject requests and records relating to legal proceedings 10 years after the request is concluded or for the applicable statute of limitations.

11. Data Security

To prevent unlawful processing of and unlawful access to your personal data and to ensure its safekeeping, we take technical and organisational measures appropriate to the nature of the data processed, taking into account the state of the art and the cost of implementation (such as access authorisation, encrypted communication, confidentiality and data processing commitments with suppliers, and employee awareness).

However, no data transmission over the internet and no electronic storage method can be guaranteed to be completely secure. In the event of a data breach affecting your personal data, we will notify the competent authorities and, where necessary, you, within the timeframes and in the manner required by applicable law.

12. Cookies and Similar Technologies

In addition to cookies that are strictly necessary for the Site to function, the Site uses analytics and functionality cookies and similar technologies if you give your consent. For detailed information on the types of cookies used, their purposes, retention periods and how you can manage your preferences, please see the Cookie Policy.

13. External Links

The Site may contain links to third-party websites, social media pages or services not operated by us. If you click on these links, you will be redirected to the relevant third party’s site. Fizix is not responsible for the content, security or personal data processing practices of such sites; we recommend that you review the privacy policy and terms of use of every site you visit.

14. Minors

The Site is intended for business customers and professionals and is not directed at persons under the age of 18. We do not knowingly collect personal data from persons under 18. If you are under 18, please do not send us personal data through the Site. If we become aware that data belonging to a minor has been sent to us without the consent of their parent or guardian, that data will be deleted.

15. Your Rights as a Data Subject

15.1. Your rights under the KVKK

Under Article 11 of the KVKK, anyone whose personal data is processed under the KVKK has the right to apply to the data controller to:

learn whether their personal data is processed;

request information if their personal data has been processed;

learn the purpose of processing and whether the data is used in line with that purpose;

know the third parties in Türkiye or abroad to whom their personal data is transferred;

request the correction of their personal data if it is incomplete or inaccurate;

request the deletion or destruction of their personal data under the conditions set out in Article 7 of the KVKK;

request that the correction, deletion and destruction be notified to third parties to whom the personal data has been transferred;

object to a result against them arising from the analysis of the processed data exclusively by automated systems;

claim compensation for damage suffered as a result of unlawful processing of their personal data.

15.2. Your rights under the GDPR, UK GDPR and similar regulations

If you are located in the European Economic Area, the United Kingdom or another country granting similar rights, you also have the right, subject to the conditions of the applicable law, to:

access your personal data and obtain a copy of it;

request the correction of inaccurate or incomplete data;

request the erasure of your data (“right to be forgotten”);

request the restriction of processing of your data;

object to processing based on legitimate interest and to processing for direct marketing purposes;

receive your data in a structured, commonly used and machine-readable format and request its transfer to another controller (data portability);

withdraw your consent at any time where processing is based on consent (withdrawal does not affect the lawfulness of prior processing);

not be subject to discriminatory treatment for exercising your rights;

lodge a complaint with the data protection authority in your country (for example, the Information Commissioner’s Office – ICO in the UK, or the supervisory authority of your EU member state of residence).

15.3. How can you exercise your rights?

You can submit your requests in writing, in Turkish or English, together with information identifying you and the subject of your request, to hello@fizix.ai or to our postal address given in Section 2. For applications under the KVKK, the methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller (written application, registered electronic mail (KEP), secure electronic signature, or the email address registered in our system) apply.

Your request will be concluded free of charge as soon as possible depending on its nature, and within thirty (30) days at the latest (within one month under the GDPR and UK GDPR; this period may be extended where permitted by law). If the process requires an additional cost, a fee may be charged in accordance with the tariff set out in the applicable legislation.

For the security of your data, we may need to verify your identity and request additional information before responding to your request. These rights are not absolute and are subject to the exceptions and limitations provided by law. Manifestly unfounded, repetitive or excessive requests may be refused to the extent permitted by law.

If your request is refused, if you find the response insufficient, or if no response is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board within thirty days of learning of the response and, in any case, within sixty days of the application date.

16. Your Choices and Acceptance of the Policy

For processing activities that require your explicit consent (such as non-essential cookies and commercial electronic messages), giving or withholding consent is entirely your choice; withholding consent does not prevent you from accessing the Site, and you may withdraw any consent you have given at any time.

Processing activities that do not require explicit consent are carried out on the legal grounds described in this Policy and limited to the scope set out here. By continuing to use the Site and sending us information through forms, you acknowledge that you have read and understood this Policy and have been informed that your personal data will be processed as described here. If you do not accept the practices described in this Policy, please stop using the Site and sending us personal data.

17. Changes to the Policy

Fizix reserves the right to update this Policy at any time in line with changes in legislation, its activities or the technologies it uses. The current version takes effect on the date it is published on the Site, and the date at the top of the document is updated accordingly. For changes that materially affect the processing of your data, additional notice will be given via the Site or other appropriate channels and, where necessary, your consent will be obtained again. We recommend that you review the Policy regularly.

18. Contact

For any questions, requests or applications regarding this Policy or the processing of your personal data, you can reach us at hello@fizix.ai or via the contact details in Section 2.