The notice Lutfios LLC gives under Turkish Law No. 6698 on the Protection of Personal Data, in English.
Turkish data protection law (KVKK) requires a controller to give data subjects a specific notice. This is the English rendering of that notice; the Turkish version is the operative one and is available from the language switch at the top of this page.
If the GDPR is what applies to you, the Privacy Policy is the document you want. This one covers the same processing under Turkish law.
The controller is Lutfios LLC, a limited liability company organised under the laws of the United States. Lutfios LLC is not established in Türkiye; the law applies to the extent that services are offered to people in Türkiye. Contact: privacy@onmesse.com.
We do not process special categories of personal data and ask that none be entered into the platform. Even at a health-tourism fair, patient or health information must not be entered.
Data is collected by fully automated means in an electronic environment: what you enter, the email address a manager at your company gives when inviting you, and technical data generated by your browser or device.
The grounds in Article 5 of the Law that we rely on are: Art. 5/2(c), directly related to the conclusion or performance of a contract; Art. 5/2(ç), necessary for compliance with a legal obligation; Art. 5/2(f), necessary for our legitimate interests provided your fundamental rights are not harmed — security, abuse prevention, delivery records and platform measurement; and Art. 5/1, your explicit consent, for commercial messages and push notifications, which you may withdraw at any time.
Under Article 8, data may be shared with other participants in an edition you joined, other members of your company, service providers processing on our instructions under contract (hosting and infrastructure, email delivery, notification delivery, error and performance monitoring, AI model providers, search-performance data providers), and public authorities entitled to it by law.
Because the controller is established in United States and some providers operate abroad, personal data is transferred outside Türkiye. Under Article 9, where the destination country is not covered by an adequacy decision of the Board, transfers are made on one of the appropriate safeguards listed in that article — in particular the standard contract published by the Board. You may ask at privacy@onmesse.com which safeguard a specific transfer relies on.
Data is kept for as long as needed for the purpose it was processed for, having regard to statutory limitation periods: account and participation data for the life of the account, after which it is anonymised; session recordings for 90 days; raw IP addresses for ten years, after which they are erased and only an irreversible hash and the derived country remain; email and accounting records for the period required by law.
Send your request, with information establishing your identity, to privacy@onmesse.com, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. A request from the email address registered on your account is treated as identity-verified; because that address is the credential for the account, we may ask you to confirm control of it first.
We answer as soon as possible and within thirty days at the latest. If your request is refused, our answer is inadequate, or we do not answer in time, you may complain to the Personal Data Protection Board within thirty days of learning our answer and in any case within sixty days of your application.