Privacy policy

Controller

KLEOS Bilişim Danışmanlık Ltd. Şti., Dijitalpark Teknokent Ataşehir Yerleşkesi, Barbaros Mah. Şebboy Sok. No:4M, 34758 Ataşehir / İstanbul, Türkiye

Data protection contact

support@dxmap.ai

Supervisory authority

Kişisel Verileri Koruma Kurumu (KVKK) — Turkish Data Protection Authority

EU representative (Art. 27 GDPR)

Utku Erol, Darser Str. 12B, 14167 Berlin, Deutschland — utku@dxmap.ai

Our representative in the European Union can be contacted by data subjects and supervisory authorities in the Union on all questions of data protection, in addition to or instead of us.

We are the controller for user accounts, including the accounts of invited colleagues; for billing, payments and invoices; for this website, its contact form and its cookies; for security and audit logs; and for benchmarking, that is, anonymised, aggregated statistics derived from assessments.

For the content of an assessment (the answers, the company notes, the closing answer on your organisation's goals, the answers on automation systems, the record of which member submitted each answer, and the generated report) the customer organisation that runs the assessment is the controller. We process that content on its behalf as a processor, under the data processing addendum.

If you have a question about how we handle your data, write to the address above. You will get an answer from a person.

We process the minimum needed to run an account, deliver a report and take payment. We do not sell data, we do not run advertising profiles, and we do not train models on your assessment answers.

Most of what you give us is business information about your organisation rather than personal data. The personal data involved is largely the contact details of the people who use the service.

• Account data: name, work email address, organisation, role in the workspace and area of responsibility (department) where assigned, interface language, password hash.
• Company details: company name, website, city, country, sector and size.
• Assessment content: the answers, company notes and goals your organisation enters, plus a record of which member submitted each answer. This is mostly business information about your organisation, and we process it as a processor for your organisation.
• Order data: tier, amount, VAT status, payment method, invoice references. Card details are handled by Stripe and never reach us.
• Communication: messages you send through the contact form.
• Technical data: IP address, user agent and timestamps in server logs, kept short-term for security and troubleshooting, and an audit log of privileged operations.

If a colleague invites you, your business email address, your role and your area of responsibility (department) come from that colleague, not from you. An invitation expires after 48 hours, after which the inviting organisation renews or deletes it. When you first sign in, you accept the terms of service and acknowledge this policy.

• To create and operate your account and organisation workspace, including invitations to colleagues.
• To run the assessment and produce your report, on behalf of your organisation.
• To verify the sector you chose and to research public information about your company for the report.
• To take payment, issue invoices and meet tax obligations.
• To answer your enquiries.
• To keep the service secure and diagnose faults.
• To compile anonymised, aggregated benchmarks.
• With your consent, to measure how the website is used (Google Analytics) and whether our advertising works (Google Ads).

• Art. 6 (1) (b) GDPR, performance of a contract: the accounts of the customer's users who have accepted the terms, including invited colleagues once they have accepted them; delivery of the service; payment and invoicing.
• Art. 6 (1) (c) GDPR, legal obligation: invoices and the retention of tax records.
• Art. 6 (1) (f) GDPR, legitimate interests: the account of an invited colleague before they accept the terms, so that the customer's contract with us can be performed; service security and security logs; fraud prevention; answering enquiries sent through the website; and benchmarking, which works only on anonymised, aggregated data.
• Art. 6 (1) (a) GDPR, consent: analytics and marketing cookies, which are off until you switch them on.

For assessment content we act as a processor; the legal basis for that processing is determined by your organisation as controller.

We use a small number of processors, each bound by a data processing agreement. They may process data only on our instructions.

Your assessment conversation is read only by language models operated by OpenAI, so that answers can be understood, scored and written up into the report. OpenAI acts as a processor, does not use the content to train its models, and keeps API inputs for up to 30 days for abuse monitoring before deleting them. The questions are about your organisation, so please do not enter the names of individuals: they are not needed.

On the report page, the report assistant answers questions about your report. For each question, the question, the last turns of the conversation and the content of your report are sent to OpenAI's language model, which may also search our knowledge base of published studies and case studies; the same terms apply. The conversation itself is kept only in your browser, for 24 hours (see the cookie table). We keep no copy, and the automation engine records only failed runs, for 14 days.

To verify the sector you chose and to research the report, the company name, website, city, country and chosen sector are sent to OpenAI's language model with web search, which looks up public information about the company such as financial results, market and regulation. This is information about the company; it is personal data only where a company name identifies a person, for example a sole trader.

The automation engine that calls the models (n8n) runs on our own server in Frankfurt. It keeps a record of each run, which contains the answer text, for 14 days.

Only if you switch on analytics or marketing in the cookie settings, we load Google Tag Manager, which runs Google Analytics (how the website is used) and Google Ads conversion measurement (whether an ad brought you here). The provider is Google Ireland Limited; data may reach Google LLC in the United States, which is certified under the EU–US Data Privacy Framework. Without that consent no request is made to Google, and a browser privacy signal (Global Privacy Control or Do Not Track) counts as a refusal. You can withdraw consent at any time in the cookie settings.

The table below names every processor we engage, what it does and where it runs.

Our servers and databases are in the European Union: the database with Supabase in Stockholm, the application with Fly.io in Amsterdam, and the automation engine on our own server in Frankfurt.

The language models that analyse the assessment are operated by OpenAI in the United States. That transfer, and any processing by another processor outside the European Economic Area, is covered by the European Commission's Standard Contractual Clauses together with supplementary measures where required.

• Account data: for as long as your account exists, then deleted.
• Invitations: until accepted. An invitation that is not accepted expires after 48 hours, after which the inviting organisation renews or deletes it.
• Assessment content and reports: for the duration of the engagement plus 24 months, so you can come back to your own report.
• Execution records of the automation engine, which contain answer text: 14 days.
• API inputs at OpenAI: up to 30 days, then deleted by OpenAI.
• The chat conversation stored in your browser: up to 24 hours.
• Invoices and tax records: for the statutory retention period, currently 10 years, and 10 years (Turkish Commercial Code art. 82) for records kept under Turkish law.
• Server logs: 30 days.

When the account owner deletes the account, the whole organisation workspace is deleted: every colleague's account and the assessment with its answers and reports, from both our application database and the assessment database. When an invited colleague deletes their account, only their own account and personal data are deleted, and the organisation's assessment stays.

Payment and invoice records that tax law requires us to keep are retained for the statutory period, detached from the deleted accounts.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.

You can delete your account yourself from Settings. For anything else, write to support@dxmap.ai and we will respond within one month. Where your request concerns assessment content, we pass it to the customer organisation that controls that content and help it to respond; requests about your account or billing data we answer ourselves.

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement.

Your report is generated automatically from your organisation's answers: language models write the text, and the maturity stage is derived by a scoring engine. This is not a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR: it is an assessment of your organisation, which your organisation reviews before acting on it.

No automated decision is made about individuals, not about employment, creditworthiness or access.

Access to customer data is scoped to the owning organisation at the database level with row-level security. A report is served only after the server has checked that your organisation holds the assessment, and internal pipeline data is removed before it reaches your browser.

We use transport encryption throughout and keep audit trails of privileged operations.

By default we set only strictly necessary cookies and browser storage. Analytics and marketing cookies require your consent and are off until you give it.

The assessment chat keeps the signed-in user's conversation in this browser's local storage for up to 24 hours, so that reloading the page does not lose it. It is not sent anywhere else, and you can clear it with the chat's "Start New Assessment" button or with your browser's site data controls. The full inventory and the controls are on the cookie policy page.

We update this policy when the service changes. The date at the top always reflects the current version. Material changes are announced by email to account holders.