Privacy Policy

1. Who we are

This Privacy Policy is issued by Sepenta Eğitim Danışmanlık Yazılım Turizm Ticaret Limited Şirketi ("Sepenta," "we," "us," or "our"), an Agile and AI consultancy, training, and apprenticeship provider based in Kuşadası, Aydın, Türkiye.

We act as the data controller (KVKK: "veri sorumlusu"; GDPR: "controller") for the personal data we collect through our website and in the course of our consultancy, training, and apprenticeship services.

2. Data we collect

We collect personal data directly from you, and limited technical data automatically when you visit our website.

Data you provide to us

• Contact and enquiry data: name, email address, phone number, and the content of any message you send us (for example, via email or phone).
• Programme applicant data: where you apply to Sepenta LaunchPad, FastTrack, Pro, or an apprenticeship, we may collect your CV, work history, educational background, and related information you choose to share.
• Client and business contact data: where we provide consultancy or training to your organisation, we may collect the business contact details of your employees or representatives.

Data collected automatically

• Technical and usage data: IP address, browser type and version, device type, general location (derived from IP), pages visited, and referring website, collected when you browse our site.
• Cookie data: as described in Section 5 below.

We do not knowingly collect special categories of personal data (such as health, religious belief, or biometric data) through our website. Please avoid including such information when contacting us, unless it is strictly necessary and relevant.

3. How we use your data

We use the personal data described above to:

• Respond to enquiries and correspond with you;
• Assess and process applications for our training programmes and apprenticeships;
• Deliver, administer, and improve our consultancy and training services;
• Send you information you have requested, such as programme details or proposals;
• Operate, secure, and improve our website;
• Comply with our legal, tax, and regulatory obligations under Turkish law; and
• Establish, exercise, or defend legal claims.

We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects concerning you.

4. Legal basis for processing

Under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR"), we rely on the following legal bases:

Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal, by contacting us using the details in Section 13.

5. Cookies & similar technologies

Our website currently uses only strictly necessary and functional elements required for the site to load and display correctly — for example, resources needed to render our web fonts (see Section 6). We do not currently deploy advertising cookies or third-party analytics cookies.

If we introduce analytics, marketing, or other non-essential cookies in the future, we will update this policy and, where required by KVKK or GDPR, request your consent through a cookie banner before those cookies are set. You will always be able to manage or withdraw cookie consent through your browser settings, which let you block or delete cookies at any time; please note that blocking essential cookies may affect site functionality.

6. Third-party services

We share limited data with the following categories of third parties, solely to operate our website and business:

• Google Fonts (Google LLC): our website loads typefaces from Google's font service. Loading these fonts causes your browser to connect to Google's servers, which may process your IP address. This connection is used only to serve font files.
• Email and communications providers: when you contact us, your message is handled through our business email provider in order for us to respond.
• IT, hosting, and professional service providers: providers who support our website, systems, and business operations, acting under confidentiality obligations and only as needed to provide their service to us.
• Public authorities: where required by Turkish law or a valid legal request.

We do not permit these providers to use your personal data for their own marketing purposes.

7. International transfers

Some of the third parties described in Section 6, including Google, may process data outside Türkiye and the European Economic Area, including in the United States. Where we transfer personal data internationally, we take steps required under KVKK Article 9 (including relying on the recipient's binding undertaking or an adequacy decision of the Turkish Personal Data Protection Board, where applicable) and, where GDPR applies, under GDPR Chapter V (such as standard contractual clauses or an adequacy decision), to ensure your data continues to receive an appropriate level of protection.

8. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, including to satisfy any legal, accounting, or reporting requirements. As a general rule:

• Enquiry and correspondence data is retained for as long as needed to handle your enquiry and for a reasonable period afterwards in case of follow-up, typically up to 2 years.
• Programme applicant data is retained for the duration of the application and selection process, and, if unsuccessful, for a limited period afterwards unless you ask us to delete it sooner.
• Client and contractual records are retained for the periods required under Turkish commercial and tax law (generally up to 10 years for certain financial records).

When data is no longer needed, we securely delete, destroy, or anonymise it.

9. Data security

We implement appropriate technical and organisational measures, such as access controls, encryption in transit, and limiting access to personal data to authorised personnel, to protect your personal data against unauthorised access, loss, misuse, or alteration, in line with our obligations under KVKK Article 12 and GDPR Article 32. No method of transmission or storage is completely secure, but we work to use commercially acceptable means to protect your data.

10. Your rights

Depending on where you are located, you have rights under KVKK and/or the GDPR regarding your personal data.

Rights under the Turkish KVKK (Article 11)

You have the right to:

• Learn whether your personal data is being processed;
• Request information about the processing, if data has been processed;
• Learn the purpose of processing and whether data is used in line with that purpose;
• Know the third parties to whom your data is transferred, domestically or abroad;
• Request correction of incomplete or inaccurate data;
• Request deletion or destruction of your data, subject to legal requirements;
• Request that any correction, deletion, or destruction be notified to third parties to whom the data was transferred;
• Object to a result that is to your detriment, arising from analysis of your data exclusively through automated systems; and
• Claim compensation for damage arising from unlawful processing.

Rights under the EU GDPR

If GDPR applies to the processing of your data, you additionally have the right to:

• Access your personal data and receive a copy of it;
• Rectify inaccurate or incomplete data;
• Erasure of your data ("right to be forgotten"), in certain circumstances;
• Restrict processing, in certain circumstances;
• Data portability, receiving your data in a structured, machine-readable format;
• Object to processing based on legitimate interests or for direct marketing;
• Withdraw consent at any time, where processing is based on consent; and
• Lodge a complaint with a supervisory authority, such as your local EU data protection authority.

To exercise any of these rights, please contact us using the details in Section 13. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law (generally within 30 days under KVKK, and one month under GDPR).

You may also lodge a complaint with Türkiye's Personal Data Protection Board (Kişisel Verileri Koruma Kurumu, "KVKK Kurumu"), or, if the GDPR applies to you, with the data protection authority in your EU member state of residence.

11. Children's privacy

Our website and services are directed at adults and organisations seeking consultancy, training, or apprenticeship opportunities. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will post the updated version on this page with a revised "Last updated" date. We encourage you to review this page periodically.