MEMBER PRIVACY NOTICE
Member Privacy Notice
Last updated: 21.07.2026
1. Identity of the Data Controller
Pursuant to Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller in respect of the personal data obtained when you register with the app.apilex.ai Platform (the “Platform”) and receive Services through the Platform is Fitty Teknoloji Anonim Şirketi (“Apilex” or the “Company”), whose registered office is at Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. A1 Blok No: 151/1C İç Kapı No: B34 Esenler/İstanbul and whose tax identification number is 3881624490. This Privacy Notice has been prepared pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
2. Scope of this Privacy Notice
This Privacy Notice covers Users and Customers who register with the Apilex Platform (app.apilex.ai) and receive Services through the Platform (the “Member”).
The processing of personal data of persons who merely visit the Website (www.apilex.ai) and of persons who contact Apilex through channels such as the contact form or demo request, or by way of a career application, falls outside the scope of this notice and is governed by separate privacy notices specific to those processes. Support requests that you create within the Platform (app.apilex.ai) fall within the scope of this notice.
Apilex’s role in respect of documents you upload to the Platform and data relating to third parties contained in those documents (“Content and Legal Data”) is different; this matter is explained separately in Section 4 below.
3. Categories of Personal Data Processed
In connection with your membership of the Platform and your use of the Platform, your personal data may be processed in the following categories:
| Data Category | Description / Examples |
|---|---|
| Identity Information | Name, surname; where billing is required, Turkish ID (T.C.) number or tax identification number |
| Contact Information | E-mail address, mobile telephone number |
| Customer Transaction Information | Subscription and package information, billing information, request information, free usage code, call centre records, demo information |
| Request/Complaint Information | The content of the support request and the date and time of the request |
| User Account Information | Your language preference and account settings |
| Content and Legal Data | Documents you upload to the Platform and personal data contained in those documents; summaries, tables and drafts you create; prompts you enter to the Assistant; your search history; your projects; personal data contained in templates obtained from these fields if you use the UYAP integration (case tracking information, hearing dates and times, file power-of-attorney information, etc.) |
| Usage and Technical Data | Device identifier, IP address, browser and operating system information, browsing history, MAC address, password and passcode information, log records, approximate location information that may be associated with the IP address |
| Professional Experience | Information on the bar association with which you are registered, TBB registration number, bar registration number; if you are not a legal professional, company/organisation information and your professional unit, if any |
Not all of the data categories above apply to every Member; which data are processed varies according to the nature of the Member’s interaction with the Platform and the Services chosen.
4. Roles of the Parties: Data Controller and Data Processor
Apilex is the data controller in respect of the Identity, Contact, Customer Transaction, Request/Complaint, User Account and Usage/Technical Data categories.
Content and Legal Data are different. These are case files, contracts and personal data relating to third parties (your client, the opposing party, witnesses, etc.) contained in those documents that you upload to the Platform. In respect of these data, you are the data controller; Apilex is the data processor acting solely on your instructions. You are responsible for ensuring that data relating to third parties in the documents you upload have been obtained lawfully, that those persons are informed where required, and that the processing is based on an appropriate legal ground.
Legal documents that you upload to the Platform may exceptionally contain special categories of personal data such as health data, data relating to criminal convictions and security measures, and trade union membership. In respect of these data as well, you are the data controller; Apilex processes these data solely in accordance with your instructions, in its capacity as data processor. Ensuring that these data are processed lawfully is your responsibility.
The Platform is operated on a zero data retention principle; prompts sent to the artificial intelligence model and the responses generated by the model are not stored on the server once the processing call has ended and are not used to train the model.
5. Purposes of Processing Personal Data and Legal Bases
Your personal data in the Identity, Contact, Customer Transaction, Request/Complaint, User Account and Usage/Technical Data categories are processed for the following purposes and on the legal bases indicated opposite each purpose:
| Purposes for Which Your Personal Data Will Be Processed | Legal Basis |
|---|---|
| Creation of your account, establishment and performance of our contractual relationship, and contacting you | Being directly related to the establishment or performance of a contract |
| Conducting sales, after-sales support, production and operations, and customer relationship management processes | Being directly related to the establishment or performance of a contract |
| Provision, development and personalisation of our Services | Being directly related to the establishment or performance of a contract |
| Responding to your support request and follow-up of requests and complaints | Being directly related to the performance of a contract |
| Processing of your contact information in order to remain in communication with you regarding our products and services and to conduct marketing analysis studies | Our legitimate interest, provided that it does not harm your fundamental rights and freedoms (your explicit consent is additionally obtained pursuant to Law No. 6563 and the Message Management System (İYS) in order for us to send commercial electronic communications) |
| Ensuring the security of our Services, detecting misuse and developing our Services | Our legitimate interest |
| Fulfilment of our legal obligations and providing information to competent authorities | Explicitly provided for by law |
Where we rely on our legitimate interest, we apply a two-stage balancing test assessing first that such interest genuinely exists and then that it does not prejudice your fundamental rights and freedoms.
6. Method of Collection of Personal Data
Your personal data are collected, wholly or partly by automated means or by non-automated means provided that they form part of a data recording system, when you create an account at app.apilex.ai/register, use the Platform and benefit from our Services.
7. Transfer of Personal Data
Your personal data may be transferred to the following groups of recipients:
Within Turkey
| Third Party Established in Turkey | Purpose of Transfer |
|---|---|
| Our payment institution | Carrying out payment and collection transactions |
| Our web analytics and advertising service provider | Analysing the use of our website and our Services and conducting marketing activities |
| Our affiliates and subsidiaries | Conducting Goods / Services Procurement, Sales and After-Sales Support Processes, Customer Relationship Management, Follow-up of Requests / Complaints, Conducting Information Security Processes |
| Authorised public institutions and organisations | Fulfilment of our legal obligations and providing information to competent authorities |
Abroad
| Third Party Established Abroad | Purpose of Transfer |
|---|---|
| Our hosting service provider | Hosting of our Services and secure storage of your data |
| Our artificial intelligence-supported analysis and content generation service providers | Provision of the artificial intelligence-supported research, analysis and document generation functions you request through the Platform |
| Our payment institution | Carrying out payment and collection transactions |
| Our web analytics and advertising service provider | Analysing the use of our website and our Services and conducting marketing activities |
| Our affiliates and subsidiaries | Conducting Goods / Services Procurement, Sales and After-Sales Support Processes, Customer Relationship Management, Follow-up of Requests / Complaints, Conducting Information Security Processes |
| Authorised public institutions and organisations | Fulfilment of our legal obligations |
Transfers we make to countries for which no adequacy decision exists are carried out within the framework of the appropriate safeguards provided for under Article 9 of the KVKK.
8. Retention Period of Personal Data
Your personal data are retained for the period prescribed by applicable legislation or for as long as necessary for the purposes for which they are processed, as specified below:
| Data Category | Retention Period |
|---|---|
| Your records relating to membership, sales and order processes | 10 years following the termination of the contractual relationship |
| Your data processed within the scope of marketing activities | 5 years from the end of the relevant activity |
| Your transaction records within the scope of a support request | 1 year from the conclusion of your request |
| Your Content and Legal Data (documents you upload, your prompts, your search history, your projects) | Deleted immediately and permanently when you delete your account; if you do not delete them, logs relating to these data are retained for 1 year |
| Your Usage and Technical Data | 1 year |
| Your log records kept for information security purposes | 5 years |
At the end of the retention period, your personal data shall be deleted, destroyed or anonymised, of our own motion or upon your request, in accordance with the procedures set out in our Personal Data Retention and Destruction Policy.
9. Measures Taken in Relation to Data Security
In order to prevent the unlawful processing of your personal data and unauthorised access to such data, we take the necessary technical and administrative measures, including in particular the following:
- Access authorisation matrix and control, regular maintenance and review of log records,
- Encryption, firewalls, regular penetration tests and vulnerability scans,
- Data loss prevention and data masking practices, backups and intrusion detection and prevention systems,
- Keeping the personal data processing inventory up to date, employee confidentiality undertakings,
- Regular awareness training and audits of suppliers/data processors.
Our information security processes are conducted in a manner consistent with international standards (ISO 27001). In the event of a data breach, we notify the Personal Data Protection Board and the affected data subjects without delay and in any event within 72 hours.
10. Processing of Special Categories of Personal Data
Legal documents that you upload to the Platform (case files, contracts, etc.) may exceptionally contain special categories of personal data such as health data, data relating to criminal convictions and security measures, and trade union membership. In respect of these data, you are the data controller; Apilex processes these data solely in accordance with your instructions, in its capacity as data processor, and ensuring that these data are processed lawfully is your responsibility.
11. Cookies
Cookies and similar technologies may be used on the Platform in order to ensure functionality, to analyse usage and to improve your experience. Detailed information on the types of cookies, the purposes for which they are used and how you may manage your preferences is available in the Cookie Policy.
12. Your Rights as a Data Subject
Pursuant to Article 11 of the KVKK, you may apply to Apilex to exercise the following rights:
- To learn whether your personal data are being processed,
- To request information if your personal data have been processed,
- To learn the purpose of processing of your personal data and whether they are used in accordance with that purpose,
- To know the third parties to whom your personal data are transferred in Turkey or abroad,
- To request the rectification of your personal data if they have been processed incompletely or inaccurately,
- To request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK,
- To request that the operations carried out pursuant to your requests for rectification, deletion and destruction be notified to third parties to whom your personal data have been transferred,
- To object to the occurrence of a result against you by means of the analysis of your processed data exclusively through automated systems,
- To request compensation for damage if you suffer damage due to the unlawful processing of your personal data.
In respect of the Content and Legal Data referred to above, where Apilex acts in its capacity as data processor, data subject requests should in the first instance be addressed to the relevant Member who is the data controller of those data; Apilex shall fulfil the obligations incumbent upon it in its capacity as data processor.
13. Method of Application and Contact
You may submit your requests relating to the rights listed above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, together with documents verifying your identity, by e-mail to privacy@apilex.ai, by secure electronic signature or mobile signature to the registered electronic mail (KEP) address fittyteknoloji@hs03.kep.tr, or in writing to the Company’s address at Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. A1 Blok No: 151/1C İç Kapı No: B34 Esenler/İstanbul. Your application will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request; however, if the transaction requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.
14. Changes and Updates
Apilex reserves the right to amend this Privacy Notice in line with legislative changes or updates to business processes. The current text is published on the Platform and enters into force as of the date of publication.