Privacy at cognipeer.com.

1. Information We Collect

This Website Privacy Policy (the “Policy”) explains how BİLSATEK YAZILIM VE TEKNOLOJİ ANONİM ŞİRKETİ, (“Cognipeer,” “we,” “our,” or “us”), collects and processes personal data when you visit https://cognipeer.com/ (the “Site”).

1.1. Data Controller Information

For the purposes of applicable data protection laws, the data controller in relation to personal data processed through the Site is:

BİLSATEK YAZILIM VE TEKNOLOJİ ANONİM ŞİRKETİ, a company duly incorporated under the laws of the Republic of Türkiye.

Registered Address: Çifte Havuzlar Mah. Eski Londra Asfaltı Cad., Kuluçka Mrk. A1 Blok No: 151/1C, İç Kapı No: B35, Esenler/İstanbul, Türkiye
Contact Email: hello@cognipeer.com
Istanbul Trade Registry Number: 1017007

Cognipeer determines the purposes and means of processing personal data in connection with the operation of the Site, contact and demo requests, website security, analytics and related business communications.

1.2. Scope of this Policy

This Policy applies only to Cognipeer’s public corporate and marketing website, including its public contact, content and demo-redirect pages.

This Policy does not govern Cognipeer Studio, Pulse, Console, Developer Hub, sign-in or account areas, APIs, customer-operated portals, or prompts, conversations, files, knowledge sources, traces and other customer-controlled content processed through Cognipeer products. Separate product privacy notices and, where applicable, customer agreements and data processing terms govern those activities.

1.3. Categories and Sources of Personal Data

Contact and Enquiry Data: first name, last name, email address, subject, message and any other information you choose to provide through the Site’s contact form or by email.

Demo and Scheduling Data: information you submit through the third-party booking page, such as your contact details, organisation, role, selected meeting time, notes and meeting metadata.

Business and Professional Data: your employer or organisation, job title, professional interests, use case and information relating to a prospective or existing business relationship, where you provide it or it is obtained as described below.

Device, Network and Security Data: IP address, browser type and version, device type, operating system, language, approximate location derived from IP address, referring URL, timestamps, request identifiers, server logs, error records and security events.

Usage, Cookie and Preference Data: pages viewed, interactions, session and traffic information, consent choices and information collected through cookies, pixels, tags, local storage or similar technologies, subject to the choices described in this Policy and our Cookie Policy.

Correspondence Data: records of communications, follow-up messages, support or complaint details and actions taken in response.

The public Site does not require you to create a Cognipeer product account or submit payment-card information. Please do not include special-category personal data, confidential customer content or unnecessary personal data in a contact or demo request. If you follow a link to a Cognipeer product or another service, the privacy notice applicable to that service will apply.

1.4. Children’s Data

The Site is designed for business and professional audiences and is not directed to children. It is intended for individuals aged 18 or over.

We do not knowingly collect personal data from children through the Site. If we learn that a child’s personal data has been submitted unlawfully, we will take reasonable steps to delete it.

A customer’s deployment or configuration of a Cognipeer product for use involving children is outside the scope of this Policy and requires separate legal, contractual, transparency, consent and safeguarding assessments.

Please contact us using the details in Section 12 if you believe that a child’s personal data has been submitted through the Site.

2. How We Use Your Personal Data and Our Legal Bases

We process personal data collected through or in connection with the Site for the purposes and on the legal bases described below. The legal basis used depends on the context and applicable law.

2.1. Communications and Enquiries

We may process your personal data to:

1. Respond to contact-form submissions, emails, privacy requests, questions and other communications.
2. Manage follow-up correspondence, provide requested information and maintain records of the request and our response.

Legal Basis: our legitimate interests in responding to business and website enquiries and maintaining effective communications; steps requested by you before entering into a contract; compliance with legal obligations; or consent where required.

2.2. Demo Booking and Business Development

Where you choose to book a demo, we may process your personal data to:

1. Arrange, confirm, reschedule and conduct the meeting.
2. Understand your organisation’s requirements, prepare relevant information and respond to your request.
3. Administer the prospective business relationship and carry out proportionate business-to-business follow-up.

Legal Basis: steps requested by you before entering into a contract and our legitimate interests in developing and managing business relationships. Where required by applicable electronic-marketing rules, we rely on consent.

2.3. Operating, Securing and Improving the Site

We may process technical, network and usage data to:

1. Deliver the Site and its requested functionality.
2. Protect the Site, systems and communications against fraud, spam, malicious activity and unauthorised access.
3. Monitor availability, diagnose faults, investigate incidents and maintain business continuity.
4. Produce aggregate statistics and understand how the Site performs.
5. Improve navigation, accessibility, content and user experience.
6. Establish, exercise or defend legal claims and enforce applicable website terms.

Legal Basis: our legitimate interests in providing a secure, reliable and effective Site, protecting our rights and systems, and improving our public information. Non-essential analytics are based on consent where required.

2.4. Cookies, Analytics and Similar Technologies

Depending on the technology used and your choices, we may process cookie, tag, preference and usage data to:

1. Remember privacy and cookie choices and provide functions that are strictly necessary for the Site or consent mechanism.
2. Measure Site traffic and performance after obtaining consent where required.
3. Deploy and manage permitted tags through a tag-management tool.
4. Enable optional embedded or third-party content where you choose to activate it.
5. Maintain evidence of consent, refusal or withdrawal and honour your preferences.

Legal Basis: consent for non-essential technologies; and our legitimate interests or another permitted basis for technologies that are strictly necessary to provide the Site or record privacy choices. See Section 8 and our Cookie Policy.

2.5. Direct Marketing

If Cognipeer uses contact or demo details for direct marketing, we may process the relevant business contact data to:

1. Send product, service, event or business updates where you requested them or where otherwise permitted by law.
2. Measure engagement with marketing communications where permitted.
3. Record and respect opt-outs, objections and suppression preferences.

Legal Basis: consent where required, or our legitimate interests in proportionate business-to-business marketing where permitted by applicable law. You may object to direct marketing at any time.

2.6. Legal Compliance and Corporate Purposes

We may process personal data to:

1. Comply with legal, regulatory, accounting and record-keeping obligations.
2. Respond to lawful requests from courts, regulators, public authorities or law-enforcement bodies.
3. Protect rights and safety; prevent misuse; manage disputes; and support a financing, reorganisation, merger, acquisition or sale, subject to appropriate safeguards.

Legal Basis: compliance with a legal obligation and our legitimate interests in protecting our rights, managing risk and administering our business.

3. How We Share Personal Data

We do not sell personal data collected through the Site for monetary consideration. We do not use customer-controlled product content for targeted advertising through the Site.

We may disclose personal data, where necessary and proportionate, to the following categories of recipients:

• Website, Hosting and Security Providers: Amazon Web Services (AWS) provides the Site’s hosting infrastructure in Germany (Frankfurt, eu-central-1). Other providers may support content delivery, databases, backups, monitoring, spam prevention and cybersecurity.
• Communication and Form Providers: email, contact-form handling, customer-relationship management and business communication providers.
• Analytics, Tag and Consent Providers: providers used for permitted analytics, tag management and consent or preference management.
• Scheduling and Meeting Providers: including the provider used for the demo-booking link and meeting administration.
• Professional Advisers: legal counsel, accountants, auditors, insurers and other advisers bound by duties of confidentiality.
• Authorities and Protected Parties: courts, regulators, law-enforcement bodies or other parties where disclosure is required by law or reasonably necessary to protect rights, safety and security.
• Corporate Transaction Recipients: prospective purchasers, investors, lenders and advisers involved in a financing, restructuring, merger, acquisition or asset sale, subject to appropriate safeguards.
• Your Organisation: where you contact us or book a meeting on its behalf and sharing is reasonably expected in that business context.

Service providers process personal data under appropriate contractual, confidentiality and data-protection obligations. The current providers and processing locations relevant to the Site include Amazon Web Services (AWS) for hosting infrastructure in Germany (Frankfurt, eu-central-1); WordPress and Fluent Forms for website and form processing; Site Mailer for website email delivery; Google services, including Google Analytics 4 through Google Site Kit and Google Calendar for demo scheduling; Cloudflare for website security, network delivery and abuse prevention; and cognipeer’s own consent interface together with WP Consent API for cookie-preference management. Providers other than AWS may process information in Türkiye, the EEA, the United Kingdom, the United States and other locations depending on the relevant provider infrastructure and configuration.

4. How Long We Retain Personal Data

We retain each category of personal data for the period reasonably necessary for the relevant purpose, taking into account the duration of the business relationship, the date of the last meaningful interaction, applicable legal and accounting obligations, security requirements and limitation periods.

We apply the following retention periods:

1. Contact-form and general enquiry records: 12 months from the last meaningful interaction.
2. Demo-booking and prospective-customer records: 24 months from the last meaningful interaction.
3. Direct-marketing records: until you opt out or 24 months after the last meaningful marketing interaction; suppression records may be retained as necessary to respect the opt-out.
4. Server, security and diagnostic logs: up to 90 days, unless a longer period is required to investigate a security incident, prevent abuse or comply with law.
5. Cookie-consent and preference records: 180 days; individual cookie durations are listed in the Cookie Policy and preference centre.

When retention is no longer required, we delete, destroy or anonymise the information. Deletion from backups and distributed systems may take place on a delayed cycle of up to 90 days, unless a longer period is required by law or needed for legal claims.

5. Data Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures may include access controls, role-based permissions, transport encryption, secure configuration, logging, monitoring, supplier controls, confidentiality commitments, backups, vulnerability management and incident-response procedures, as appropriate to the risk.

No method of transmission or storage is completely secure. Although we work to protect personal data, we cannot guarantee absolute security.

6. Your Privacy Rights and Choices

(a) Access and Rectification: you may request access to your personal data and correction of inaccurate or incomplete data.

(b) Erasure and Restriction: you may request deletion or restriction where the applicable conditions are met.

(c) Objection: you may object to processing based on legitimate interests and may object to direct marketing at any time.

(d) Portability and Withdrawal: where applicable, you may request data portability and withdraw consent at any time, without affecting processing already carried out lawfully.

(e) Automated Decisions and Complaints: you have rights relating to certain solely automated decisions and may complain to the competent data-protection authority.

To exercise a privacy right, contact us at: hello@cognipeer.com.

We may ask for information reasonably necessary to verify your identity or authority. We will respond without undue delay and, where the GDPR applies, generally within one month, subject to any lawful extension.

You may lodge a complaint with the supervisory authority in the EEA country where you live or work, or where the alleged infringement occurred. We would appreciate the opportunity to address your concern first, but this does not affect your right to complain.

6.1. Automated Decision-Making

The public Site is not intended to make decisions based solely on automated processing that produce legal or similarly significant effects on visitors. If this changes, this Policy will be updated and any information required by law will be provided.

7. International Transfers

Cognipeer is established in Türkiye. The Site’s hosting infrastructure is provided by Amazon Web Services (AWS) in Germany (Frankfurt, eu-central-1). Personal data may also be processed by other service providers in Türkiye, the EEA, the United Kingdom, the United States and other countries, depending on the providers used for the Site, communications and demo scheduling. Google, Cloudflare, Site Mailer and other providers may process data through their applicable infrastructure locations and contractual safeguards.

Where a transfer is subject to Chapter V of the GDPR, we use an applicable legal mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. Other lawful transfer mechanisms may apply under other applicable laws.

You may contact us to request further information about applicable safeguards and, where legally available, a copy of the relevant contractual safeguards, subject to appropriate redactions.

8. Cookies and Third-Party Services

The Site may use cookies, local storage, tags, pixels and similar technologies. Their names, providers, purposes, categories and durations are described in our separate Cookie Policy and consent preference centre, available through Cookie Settings.

Strictly necessary technologies may be used to provide a service requested by you, secure the Site or record your privacy choices.

Analytics, advertising, personalisation or other non-essential technologies will be activated only after valid consent where required.

The Site may use tag-management functionality to deploy and manage permitted tags. A tag manager does not by itself define the purpose of processing; the tags configured within it determine what information is collected and which providers receive it.

(a) Contact Form: the Site collects first name, last name, email address, subject and message. The form is handled through Fluent Forms, submissions are stored in the Site’s WordPress database, and website email delivery is handled through Site Mailer. Website form submissions are not currently sent to a CRM through a direct form integration.

(b) Demo Booking: the Site redirects you to a Google Calendar booking page. Information entered there is processed in the Google environment and may be shared with Cognipeer to arrange the meeting. The booking flow may request contact details, organisation or role information, selected meeting time, notes and related meeting metadata, depending on the fields presented in the booking interface. Google may process this information through its international infrastructure in accordance with the applicable Google Workspace configuration and terms.

(c) External and Social Links: links to external websites, social networks, documentation or product pages are governed by the relevant third party’s or product’s privacy information when you leave the Site.

(d) Maps and Embedded Content: the Site currently links to external map pages for office locations. If a map, video or other third-party content is embedded in future and requires consent, it should remain blocked until you choose to load it.

(e) Third-Party Responsibility: independent third-party services may act as separate controllers for their own processing. Their notices should be reviewed before information is submitted.

(f) Browser Controls: browser settings may allow you to delete or block cookies, but doing so may affect Site functions. Browser controls do not replace the Site’s consent choices where those choices are legally required.

(g) Consent Records: we may retain records of the choice, timestamp, consent version and technical information needed to demonstrate and honour that choice.

Non-essential tags and technologies should not be enabled before a valid choice has been recorded where consent is required.

You may withdraw or change your cookie consent at any time by selecting “Cookie Settings” in the Site footer. Withdrawal does not affect processing already carried out lawfully before withdrawal.

Refusing or withdrawing consent to non-essential technologies should not prevent access to the core public Site, although optional content or features may remain unavailable.

9. Provision of Information, Sources and Product Links

Fields marked as required in the contact or booking flow are needed to respond to or arrange the request. Providing other information is voluntary.

1. If you do not provide required contact details, we may be unable to respond, schedule a demo or provide requested information.
2. Do not submit account passwords, payment-card data, special-category data or confidential customer content through the public contact form.
3. We collect personal data directly from you when you use the contact form, email us, book a demo or communicate with us.
4. We collect technical and usage data automatically from your browser, device, network and permitted cookies or similar technologies.
5. We may receive booking and meeting information from Google Calendar or another scheduling provider you use.
6. For proportionate business-to-business follow-up, we may receive professional information from your organisation, a colleague who refers you, or publicly available professional sources, where permitted by law.

Product Links and Customer Content

The Site links to Studio, Pulse, Console, Developer Hub, documentation and sign-in or sign-up pages. Those services may process account information, prompts, conversations, files, knowledge sources, traces, integrations and other product data that are not covered by this Website Policy.

1. Review the privacy notice displayed for the relevant Cognipeer product before creating an account or submitting product content.
2. Where a customer organisation determines the purposes and means of processing customer-controlled content, Cognipeer may act as its processor or service provider under the applicable agreement.
3. If you interact with a Cognipeer-powered portal or AI experience operated by another organisation, direct privacy questions about that organisation’s processing to the relevant operator unless the applicable notice states otherwise.

Use of contact or demo content for AI model training, evaluation or product improvement: contact-form and demo-request content is not used to train general-purpose Cognipeer AI models.

Customer-selected AI providers and product configurations are outside the scope of this Website Policy and must be addressed in the relevant product notice and contractual documentation.

If you include personal data about another individual in a message, you should have authority to provide it and should share only what is necessary.

If we receive personal data indirectly and Article 14 of the GDPR applies, we will provide any additional information required by law within the applicable period, unless an exception applies.

10. Changes to This Policy

We may update this Policy to reflect changes in the Site, technologies, providers, applicable law or our practices. We will update the “Last Updated” date at the top of the document and provide additional notice where required. If a change materially affects processing based on consent, we will obtain a new consent where required.

11. Applicable Law, Statutory Remedies and Representation

11.1. Applicable Law

Cognipeer is operated by a company incorporated in Türkiye. The GDPR applies to relevant processing where its territorial scope requirements are met, without prejudice to other mandatory data-protection laws.

This Policy is a transparency notice and is not intended to create a contract or reduce any mandatory right, remedy, jurisdiction or supervisory-authority power available under applicable law.

Commercial website use and contractual disputes may also be addressed in the Website Terms of Use, but those terms cannot waive mandatory data-protection rights.

Nothing in this Policy prevents you from exercising a right or bringing a claim before a competent supervisory authority or court where applicable law permits.

11.2. Statutory Remedies

Any dispute-resolution clause in another agreement applies only to the extent legally permissible and does not restrict the right to lodge a complaint with a competent data-protection authority or to seek a judicial remedy under the GDPR.

The competent supervisory authority and court depend on the applicable law and the circumstances of the processing.

11.3. EEA and UK Representation

Where applicable law requires Cognipeer to appoint a representative in the EEA or the United Kingdom in connection with processing covered by this Policy, Cognipeer will maintain the required representation and make the relevant representative information available as required by law.

12. Contact Information for Privacy Inquiries

If you have any questions, requests or complaints about this Policy or how personal data is handled through the Site, contact: