Privacy Policy

Scope and data controller

This privacy policy explains how your personal data is processed when you visit the provscope.com website, use the contact and demo form on the site, and use the Provscope platform at app.provscope.com.

The data controller for your personal data is Provscope Yazılım Ltd. Şti. (Provscope Software Ltd.) (referred to in this policy as “Provscope”, “we”, “us” or “our”).

• Address: Barbaros Mah. Tahran Cad. No: 19/A, Çankaya, Ankara, Türkiye
• Tax office and tax ID (VKN): Cumhuriyet, 9320388325
• Email: baris@provscope.com

For the detailed notice required under Turkish Personal Data Protection Law No. 6698 (“KVKK”), see our personal data protection notice. For information on cookies, see our cookie policy. For users located in the European Union or the European Economic Area (EU/EEA), the General Data Protection Regulation (“GDPR”) is also taken into account to the extent it applies.

Which personal data do we process?

Website visits

The fonts used on our website are hosted on our own server; viewing our pages does not send requests to third-party font or content delivery network (CDN) servers. No analytics, advertising or tracking tools are currently active on provscope.com, and the site does not set cookies for ordinary visitors. Details are in our cookie policy.

Contact and demo form

When you contact us through the form on our website, we process the following information, depending on the language of the form:

• Turkish form: company name, full name, email address, phone number (optional), sector, EU export status, the free-text message you send and the fact that the consent checkbox was ticked.
• English form: name, company name, country, email address, product group, your message and the fact that the consent checkbox was ticked.

In addition, your IP address, the time of submission and the referring page are recorded technically. To prevent automated submissions and abuse (rate limiting), an irreversibly hashed version of your IP address is kept for 10 minutes.

Form submissions are stored as private, non-public records in the website’s database and are sent as an email notification to baris@provscope.com through our own mail server.

Platform users

For users authorised by our customers to use the Provscope platform, we process the following data:

• Account data: name, business email address, company name, role and login credentials. Passwords are stored in hashed form, never in plain text.
• Usage and log data: IP address, browser and device information, timestamps and actions performed on the platform. This data is kept for security and audit trail purposes.

Customer content on the platform

Our customers and their suppliers upload product, material, supplier and emissions data, together with supporting evidence documents, to the platform. This content may contain personal data (for example, an employee name or contact details in a document). For customer content, the customer generally acts as the data controller and Provscope acts as the data processor under the service agreement. For requests concerning personal data in such content, we recommend that you contact the relevant customer (the data controller) first; we provide the necessary assistance on the customer’s instructions.

Why do we use personal data?

• To assess your contact and demo requests, respond to you and determine the scope of service that fits your needs
• To create platform accounts, authenticate users and provide the service in accordance with the agreement
• To secure the platform, detect and prevent unauthorised access and misuse, and maintain an audit trail
• To prevent automated submissions and spam attempts on the website
• To process customer content on the customer’s instructions and provide platform features (for example, data extraction from documents)
• To comply with our legal obligations and respond to lawful requests from competent authorities
• To establish, exercise and defend our legal rights in the event of a dispute

Legal bases

We process your personal data on the following legal bases under Article 5 of the KVKK:

• Processing is directly related to the conclusion or performance of a contract (Art. 5(2)(c)): assessing demo requests and providing the platform service
• Processing is necessary to comply with a legal obligation of the data controller (Art. 5(2)(ç)): retaining commercial records and providing information to competent authorities
• Processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms (Art. 5(2)(f)): security logs, spam prevention and service improvement
• Your explicit consent, where explicit consent is required (Art. 5(1))

For users in the EU/EEA, the corresponding legal bases are GDPR Art. 6(1)(b) performance of a contract or pre-contractual steps, (c) legal obligation, (f) legitimate interests and, where consent is required, (a) consent.

Cookies and analytics

Our website does not use cookies for ordinary visitors. Strictly necessary technical cookies are used only for administrators who log in to the website’s admin area and for authentication on the platform. A Google Analytics 4 integration technically exists on the website but is disabled. If analytics is enabled in the future, it will only run after you have given prior consent, and our cookie policy will be updated accordingly.

Sharing and international transfers

We do not sell your personal data. Your data may be shared with the following categories of recipients only to the extent necessary for the purposes above:

• Hosting and infrastructure providers
• Email service providers
• Analytics providers (only if analytics is enabled in the future and you have given consent)
• AI service providers used to support certain platform features (for example, data extraction from documents)
• Competent public authorities and courts (where legally required)

Some of these providers may be located outside Türkiye, including in the EU or the United States. We carry out international transfers in accordance with Article 9 of the KVKK as amended in 2024: where there is an adequacy decision, where appropriate safeguards are in place (such as standard contracts notified to the Turkish Personal Data Protection Authority), or where one of the exceptional, incidental cases listed in the law applies. For users in the EU/EEA, transfers rely on the safeguards provided in Chapter V of the GDPR (for example, Standard Contractual Clauses).

Retention periods

• Contact and demo form records: up to 2 years after the last contact, unless a contract follows
• Hashed IP address kept for spam prevention: 10 minutes
• Platform account data: for the duration of the contract and thereafter for statutory retention periods (for example, 10 years for commercial records under Turkish law, where applicable)
• Security logs: up to 1 year
• Customer content: deleted or returned to the customer within 90 days after the contract ends, unless the law requires a longer retention period

Data whose retention period has expired is deleted, destroyed or anonymised.

Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss and unlawful processing. These measures include encrypted connections (HTTPS), role-based and layered access control, hashed storage of passwords and security logging of actions.

Your rights

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing, to know the third parties to whom it is transferred, to request its rectification, erasure or destruction, to object to an outcome against you resulting exclusively from analysis by automated systems, and to claim compensation for damage arising from unlawful processing. The full list of rights is in our personal data protection notice.

Users in the EU/EEA have the rights of access, rectification, erasure, restriction of processing, data portability and objection under Articles 15 to 22 of the GDPR, and may withdraw their consent at any time where processing is based on consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

You can send your requests by email to baris@provscope.com or in writing to Barbaros Mah. Tahran Cad. No: 19/A, Çankaya, Ankara, Türkiye. We respond as soon as possible depending on the nature of the request and in any case within 30 days (KVKK Art. 13), or within one month for requests under the GDPR. You also have the right to lodge a complaint with the Turkish Personal Data Protection Board or, if you are in the EU/EEA, with the competent supervisory authority.

Changes to this policy

We update this policy when our processing activities or the applicable law change. The current version is always published on this page, and the date at the end of the page shows when it was last updated. Where appropriate, we also notify platform users of material changes.

Contact

For any questions about this policy or your personal data, contact us at baris@provscope.com or through our contact page.

Last updated: 7 October 2026