Last updated: 14 October 2026

Privacy Notice on the Protection of Personal Data

This notice has been prepared pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on Principles and Procedures for the Fulfilment of the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). It explains how we process your personal data when you visit our website and when you send us an email.

1. Data controller

Masallabs Teknoloji Anonim Şirketi (“Masal Labs”, “we”)
Mustafa Kemal Mh. Dumlupınar Bul. No: 266C İç Kapı No: 26, Çankaya/Ankara, Türkiye
Email: · Phone:

2. What data do we process, for what purposes and on what legal grounds?

2.1 Website visitors: technical logs

• Data: IP address, date and time of access, page requested, browser and device information, referring page.
• Purpose: Ensuring the secure and uninterrupted operation of the website, detecting and remedying errors, and preventing attempts at misuse.
• Legal basis: Our legitimate interest, provided that it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f)).
• Retention period: [14 days]; at the end of this period, the logs are deleted automatically.

2.2 Website visitors: analytics cookies (only if you consent)

• Data: Online identifiers (cookie ID), pages visited and interactions, browser and device information, approximate location derived from the IP address (city level).
• Purpose: To understand, through aggregate statistics, how the website is used and to improve its content.
• Legal basis: Your explicit consent (KVKK Art. 5(1)). Unless you select the “Accept” option in the cookie banner, the analytics tool is not loaded and no data is collected. You may withdraw your consent at any time via the “Cookie settings” link at the bottom of the page.
• Retention period: In Google Analytics, the retention period for event-level data has been set to [2 months].
• For details, please see the Cookie Policy page.

2.3 People who send us emails

• Data: Name and surname, email address, telephone number, organisation and job title, and the content of your message and its attachments.
• Purpose: To respond to your requests and questions, to prepare proposals, and to establish and conduct a business relationship.
• Legal basis: The processing being directly related to the conclusion or performance of a contract (KVKK Art. 5(2)(c)) and our legitimate interest (KVKK Art. 5(2)(f)).
• Retention period: [2 years] from the last correspondence. If a business relationship is established, the data is retained for the periods prescribed by the relevant legislation.

2.4 Job applicants (people who send us a CV by email)

CVs are sent to .

• Data: Identity and contact details, information on education and professional experience, other information contained in your CV and cover letter, interview notes.
• Purpose: Conducting recruitment processes, assessing whether your application is suitable for open positions or positions that may open in the future, and communicating with you.
• Legal basis: The processing being directly related to the conclusion of an employment contract (KVKK Art. 5(2)(c)) and our legitimate interest (KVKK Art. 5(2)(f)). Retaining your CV for future positions after the application process has ended is possible only with your explicit consent (KVKK Art. 5(1)).
• Retention period: No more than [6 months] after the application process has concluded; [12 months] if you give your explicit consent to its retention for future positions.
• Please note: Do not include special categories of personal data in your CV, such as data concerning health, religion, sect, membership of an association or trade union, or criminal convictions. If such data is sent, it will not be taken into consideration and will be deleted. You do not need to include a photograph with your application.

3. Method of collecting personal data

Your personal data is collected electronically: automatically by our servers during your visit to our website, by analytics tools in line with your cookie preferences, and through the emails you send us.

4. Transfer of personal data

Your personal data is transferred to the following recipients only to the extent necessary for the purposes set out above:

Transfers abroad: As our website’s servers are located in Germany and our email service is provided by Google, technical logs, email correspondence and (only with your consent) analytics data are transferred abroad. These transfers are carried out in accordance with Article 9 of KVKK within the framework of [standard contracts notified to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu)].

5. Your rights under KVKK Art. 11

By applying to us as the data controller, you have the right to:

1. learn whether your personal data is processed;
2. request information about the processing if your personal data has been processed;
3. learn the purpose of the processing and whether the data is used in accordance with that purpose;
4. know the third parties, in Türkiye or abroad, to whom your personal data is transferred;
5. request rectification if your personal data has been processed incompletely or inaccurately;
6. request the erasure or destruction of your personal data under the conditions set out in KVKK Art. 7;
7. request that the operations carried out pursuant to items 5 and 6 be notified to the third parties to whom your personal data has been transferred;
8. object to a result arising to your detriment from the analysis of the processed data exclusively by means of automated systems; and
9. request compensation for the damage if you suffer damage as a result of the unlawful processing of your personal data.

6. How to apply

You may submit your requests, in accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), by the following means:

• in writing to our address above (by hand or by post);
• to our registered electronic mail (KEP) address, [KEP address, if any];
• to , from the email address that you have previously notified to us and that is registered in our system.

Your application must include your name and surname, your Turkish identity number (for foreign nationals, your nationality and passport number), your address for service, your email address and telephone number, if any, and the subject of your request.

We will conclude your application free of charge as soon as possible, depending on its nature, and within 30 days at the latest. If the action additionally entails a cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, if you find the response insufficient, or if no response is given in due time, you may lodge a complaint with the Personal Data Protection Board pursuant to KVKK Art. 14.

7. For visitors in the European Union and the European Economic Area

If you visit our website from the EU/EEA and have consented to analytics cookies, your data may also be processed under the EU General Data Protection Regulation (GDPR). In that case, our legal bases are: your consent for analytics (GDPR Art. 6(1)(a)), our legitimate interest for technical logs and email correspondence (Art. 6(1)(f)), and pre-contractual steps for business and recruitment discussions (Art. 6(1)(b)).

Under the GDPR, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Arts. 15–21). You may withdraw your consent at any time; this does not affect the lawfulness of the processing carried out before the withdrawal. Your right to lodge a complaint with the data protection supervisory authority in your country of residence remains unaffected. Google LLC is certified under the EU-U.S. Data Privacy Framework.

8. Changes

We may update this notice in line with changes in legislation or in our data processing activities. The current version is always available on this page; the date of the last update is shown at the top of the page.

If the language versions of this text differ, the Turkish version prevails.