Privacy Policy
Last updated: 26 July 2026
1. Data Controller
This policy is issued under Turkish Personal Data Protection Law No. 6698 (“KVKK”) by the company operating Sureasy:
| Legal name | DMRICT YAZILIM VE DANIŞMANLIK SAN. VE TİC. LTD. ŞTİ. |
|---|---|
| Trade registry (MERSIS) | 0302143362500001 |
| Address | Gulbahce Mah., Gulbahce Cad., Technology Development Zone No:1/18/5, 35433 Urla / Izmir, Türkiye |
| Registered e-mail (KEP) | [email protected] |
| [email protected] |
2. Controller / Processor Split
Sureasy holds two distinct sets of data, and responsibility differs for each:
- For your account and organisation data (name, e-mail, organisation name, billing details), DMRICT is the controller.
- For participant and survey data — person records, submissions, answers, event and trainer details — your organisation is the controller; DMRICT acts solely as a processor on your behalf.
Informing participants and obtaining consent where required is your responsibility. Sureasy provides participation modes that make this easier, but does not assume the legal obligation.
3. Participation Modes — You Decide How Much Data Is Collected
You choose one of three modes for every survey. The choice directly determines what personal data is collected from participants:
| Mode | Identity data collected | Effect |
|---|---|---|
| Anonymous | None | No participant identity is collected at all. Only a device fingerprint and a hash of the IP address are kept, to softly discourage repeat submissions from the same device. |
| Phone de-duplication | An irreversible hash (HMAC-SHA256) of the phone number | The same person cannot submit twice, yet the phone number cannot be recovered from the record. The number itself is not stored in this mode. |
| Identified | Name, e-mail, phone, company | Submissions are matched to a person record in your organisation. This mode processes the most personal data and should be chosen only when genuinely necessary. |
Our recommendation: if your goal is to measure training quality, anonymous mode is sufficient. Use identified mode only when certificates or per-person follow-up are required.
4. Personal Data We Process
| Category | Data | Source |
|---|---|---|
| Identity & contact (account) | Full name, e-mail address | Sign-up form |
| Account security | Password hash (bcrypt), session data, invitation records | Use of the service |
| Organisation | Organisation name, membership roles, subscription plan, payment records | Sign-up and administration |
| Training content | Event title, date, trainer name, question and template text | Data you enter |
| Participant records | Depending on the mode you choose: name, e-mail, phone, company or only a phone hash or nothing at all | Participants and data you enter |
| Survey answers | Selected options, free-text answers, start/finish time, duration | Participants |
| Abuse prevention | Device fingerprint, hash of the IP address, browser user-agent | Use of the service |
We do not request special categories of personal data. We advise against writing questions that would collect health, belief, trade-union membership or similar data.
5. Use of AI and International Transfers
Sureasy uses AI in two optional features, and these features mean data is transferred to a provider located outside Türkiye. Please read this section carefully.
| Feature | Sent to the provider | Not sent |
|---|---|---|
| Generating questions from material | The text of the training material you supply for question generation | Participant data, account details |
| Report analysis | Answers detached from participant identity (including free-text answers), question text, event title and trainer name | Participant names, e-mails, phone numbers; any link between an answer and a person |
The default provider is EachLabs (an LLM routing service); depending on configuration, Google (Gemini API) may be used instead. Both are located outside Türkiye, and the transfer is assessed under Article 9 of the KVKK.
Points to keep in mind:
- Free-text answers are written by participants themselves. If a participant types their own name or other personal details into that field, that text is also sent to the provider. We recommend warning participants in the question text not to include personal details.
- If your training material contains personal data or trade secrets, remove those parts before using the question-generation feature.
- These features are optional. Unless you use them, none of your data is sent to an AI provider — survey collection, reporting and export all work fully without them.
6. Purposes and Legal Grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Creating the account and providing the service | Formation and performance of a contract |
| Authentication and authorisation | Performance of a contract / legitimate interest |
| Collecting and reporting surveys | The ground determined by your organisation as controller |
| Preventing duplicate submissions, security | Legitimate interest |
| Billing and statutory record-keeping | Legal obligation |
| Measuring website usage | Explicit consent (analytics cookies) |
7. Data Sharing
Your data is never sold or rented to third parties for marketing. Limited sharing takes place only to deliver the service:
| Recipient | Purpose | Location |
|---|---|---|
| Our hosting provider | Server and database hosting | Türkiye |
| Cloudflare, Inc. | TLS termination, DDoS protection | Outside Türkiye (SCC) |
| EachLabs or Google (Gemini) | Only if you use the AI features — see the section above | Outside Türkiye |
| Our e-mail (SMTP) provider | Verification, invitation and notification e-mails | Türkiye |
| Google Analytics | Only if you accept cookies — usage measurement | Outside Türkiye |
8. Retention Periods
| Data | Period |
|---|---|
| Account, event and survey data | For the subscription term; 30 days after closure |
| Participant records | Until you delete them; deletable at any time |
| Device fingerprint and IP hash | 1 year after the survey closes |
| Billing records | 10 years (Turkish Commercial Code Art. 82) |
At the end of the period, data is deleted, destroyed or anonymised. You can export your data at any time.
9. Security
- All traffic is encrypted with TLS.
- Passwords are hashed with bcrypt; never stored in plain text.
- Phone de-duplication uses an irreversible HMAC.
- IP addresses are stored as hashes, not in clear text.
- Organisations are isolated from one another; authorisation is enforced per record.
- Survey links contain unguessable unique tokens.
10. Your Rights
You have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to know the third parties to whom it is transferred, to request correction of incomplete or inaccurate data, to request erasure where the conditions are met, to object to results arising from automated analysis, and to claim compensation for damages.
Send requests to [email protected]; we respond within 30 days at the latest.
If you are a survey participant: the organisation running the survey controls your data. The fastest route is to contact that organisation first, and to write to us if you do not get a response.
11. Cookies
See our Cookie Policy for the cookies we use and how to manage your preferences.
12. Changes
We update this policy when necessary; the current version is always published on this page. We notify you by e-mail of material changes.