Personal Data Protection Notice (KVKK)

Odyonom is a cloud-based management software for hearing care centres, provided by Virtual Riddle Teknoloji A.Ş. ("Odyonom", "we"). Address: Maslak Mah., AOS 55. Sok. 42 Maslak B Blok, No: 4/542, Sarıyer, İstanbul · Tel: +90 212 963 03 63 · E-mail: [email protected]

Odyonom is the data controller for odyonom.com visitors and people who request a demo or contact us, for app users' account, sign-in and security data, and for the representative and billing details of subscribing businesses. For patient and staff data entered into the app by hearing centres (Tenants), the Tenant is the data controller; Odyonom processes this data as a data processor on the Tenant's instructions and under the data processing agreement.

This notice covers visitors of odyonom.com and people who contact us or request a demo. It is a separate notice and is not combined with any other text. For patient and staff data entered into the Odyonom app by hearing centres, the hearing centre is the data controller and its own notices apply.

The legal grounds, retention periods and rights relating to app users are set out in the user privacy notice, which is shown on the app's sign-up and invitation screens.

• Identity and contact data (name, organisation, phone, e-mail, number of branches) you send by e-mail: to answer your request, prepare a demo or offer and communicate with you before a contract. Legal ground: Article 5(2)(c), steps prior to entering into a contract, and Article 5(2)(f), legitimate interest.
• Transaction security data (IP address, browser information, timestamps): to provide the website securely and prevent attacks. Legal ground: Article 5(2)(f), legitimate interest.
• Your demo request is sent to us by e-mail only and is not stored in our systems.
• Marketing communications are sent only with your separate consent; a demo request does not count as consent to commercial messages.

Electronically, through e-mail correspondence, website forms where available, and automatically during your visit (server and security logs).

Your data may be transferred to the following recipients, limited to the purposes above:

• Cloudflare (website hosting, connection encryption and content delivery; servers worldwide),
• the e-mail service provider of our company mailbox, where demo requests are kept and from which we reply to you (Google Workspace; abroad, including the United States),
• competent public authorities and courts when legally required.

Most data is hosted in the European Union (Germany). E-mails are sent through servers in the United States (AWS us-east-1); e-mails you send us and demo requests are kept in Google Workspace data centres abroad, including the United States. As the Personal Data Protection Board has not issued an adequacy decision for these countries, these transfers are made under the standard contracts published by the Board under Article 9(4)(c) of the Law.

The full list of sub-processors is in the Privacy Policy.

We keep data for as long as the processing purpose requires and the law prescribes. Retention periods are set out in our retention and destruction policy.

• Website server and content delivery network logs (IP, request): the provider's log retention period, at most 1 year
• Demo requests: in our mailbox, 1 year after the request is closed
• Records of consent to and refusal of commercial messages: 3 years

Under Article 11 of Law No. 6698 you have the right to:

• learn whether your personal data is processed;
• if processed, request information about it;
• learn the purpose of processing and whether data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom data is transferred;
• request correction if it is incomplete or inaccurate;
• request deletion or destruction under Article 7 of the Law;
• request that the correction, deletion or destruction be notified to the third parties to whom data was transferred;
• object to a result against you arising solely from analysis by automated systems;
• claim compensation for damage caused by unlawful processing.

Send your request in writing to Maslak Mah., AOS 55. Sok. 42 Maslak B Blok, No: 4/542, Sarıyer, İstanbul or from an e-mail address you have previously given us and that is registered with us to [email protected]. Requests are answered free of charge within 30 days at the latest (Article 13). If your request is rejected, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request (Article 14).

If you are a patient of a hearing centre, please contact that centre about your data. We forward requests we receive to the centre without delay.