Privacy Policy

1. Data Controller

This policy is issued under Turkish Personal Data Protection Law No. 6698 (“KVKK”) by the company operating Sureasy:

2. Controller / Processor Split

Sureasy holds two distinct sets of data, and responsibility differs for each:

• For your account and organisation data (name, e-mail, organisation name, billing details), DMRICT is the controller.
• For participant and survey data — person records, submissions, answers, event and trainer details — your organisation is the controller; DMRICT acts solely as a processor on your behalf.

Informing participants and obtaining consent where required is your responsibility. Sureasy provides participation modes that make this easier, but does not assume the legal obligation.

3. Participation Modes — You Decide How Much Data Is Collected

You choose one of three modes for every survey. The choice directly determines what personal data is collected from participants:

Our recommendation: if your goal is to measure training quality, anonymous mode is sufficient. Use identified mode only when certificates or per-person follow-up are required.

4. Personal Data We Process

We do not request special categories of personal data. We advise against writing questions that would collect health, belief, trade-union membership or similar data.

5. Use of AI and International Transfers

Sureasy uses AI in two optional features, and these features mean data is transferred to a provider located outside Türkiye. Please read this section carefully.

The default provider is EachLabs (an LLM routing service); depending on configuration, Google (Gemini API) may be used instead. Both are located outside Türkiye, and the transfer is assessed under Article 9 of the KVKK.

Points to keep in mind:

• Free-text answers are written by participants themselves. If a participant types their own name or other personal details into that field, that text is also sent to the provider. We recommend warning participants in the question text not to include personal details.
• If your training material contains personal data or trade secrets, remove those parts before using the question-generation feature.
• These features are optional. Unless you use them, none of your data is sent to an AI provider — survey collection, reporting and export all work fully without them.

6. Purposes and Legal Grounds

7. Data Sharing

Your data is never sold or rented to third parties for marketing. Limited sharing takes place only to deliver the service:

8. Retention Periods

At the end of the period, data is deleted, destroyed or anonymised. You can export your data at any time.

9. Security

• All traffic is encrypted with TLS.
• Passwords are hashed with bcrypt; never stored in plain text.
• Phone de-duplication uses an irreversible HMAC.
• IP addresses are stored as hashes, not in clear text.
• Organisations are isolated from one another; authorisation is enforced per record.
• Survey links contain unguessable unique tokens.

10. Your Rights

You have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to know the third parties to whom it is transferred, to request correction of incomplete or inaccurate data, to request erasure where the conditions are met, to object to results arising from automated analysis, and to claim compensation for damages.

Send requests to [email protected]; we respond within 30 days at the latest.

If you are a survey participant: the organisation running the survey controls your data. The fastest route is to contact that organisation first, and to write to us if you do not get a response.

11. Cookies

See our Cookie Policy for the cookies we use and how to manage your preferences.

12. Changes

We update this policy when necessary; the current version is always published on this page. We notify you by e-mail of material changes.