1. Data controller
The personal data of your organization account is processed by Cekci Lab Teknoloji Limited Şirketi (“WarmBreak”, the “Company”) as data controller, within the scope described below.
- Legal name
- Cekci Lab Teknoloji Limited Şirketi
- Address
- Kazımdirik Mah. 296/2 Sk. No: 33 Bornova / İzmir
- Tax office
- Hasan Tahsin
- Tax number
- 2040720788
- Requests
- support@warmbreak.com
- Support
- support@warmbreak.com
2. What an organization account is
An organization account is a separate account opened at your work email address on an organization’s invitation so that you can manage its events. It is independent of your personal account: the two accounts are not linked in our systems, and deleting or exporting one does not affect the other.
With an organization account you do not register for events as an attendee, share business cards, send meeting requests or receive person or event recommendations. For that reason the organization account is not asked for attendee list visibility, marketing or usage analytics consent.
You must be at least 16 years old to open the account. The organization account is personal to you and is not shared with another employee.
3. Personal data we process
| Category | Data | Source |
|---|---|---|
| Account information | Your work email address, your name, an optional profile photo, language, time zone and theme preference | You |
| Organization membership | The organizations you belong to, your role, the start and end date of each membership, the team invitations you received | The organization and you |
| Actions taken on behalf of the organization | A record of who did what and when, such as creating and publishing events, deciding applications, managing the team and checking people in at the door | Automatic |
| Security | Session records (device type, browser information, session times), a hashed digest of your IP address and a record of which version of this notice you read | Automatic |
No business card, interests, attendance history or meeting data is kept in an organization account.
4. Purposes of processing
- Opening your account and giving you the organization’s management screens
- Making the actions you take on behalf of the organization traceable for its team and for audits
- Keeping your account and the organization secure and preventing abuse
- Being able to prove that you read this notice
The data of your organization account is not sold or transferred to ad networks, data brokers or sponsors.
5. Legal grounds
| Processing | KVKK Art. 5 ground |
|---|---|
| Opening the account and providing the management screens | Establishing and performing a contract (Art. 5/2-c) |
| Recording actions taken on behalf of the organization | Legitimate interest of the controller (Art. 5/2-f) and legal obligation (Art. 5/2-ç) |
| Security and abuse prevention | Legitimate interest (Art. 5/2-f) |
| Keeping the notice record | Compliance with a legal obligation (Art. 5/2-ç) |
6. Your relationship with the organization
The records of actions you take on behalf of the organization belong to the organization. When you leave the organization or it removes you from the team, those records stay with the organization, your access to its data ends and your account remains as an empty organization account. An organization account does not turn into a personal account.
Your work mailbox is controlled by your employer. Your employer can sign in to your organization account by accessing that mailbox. Your personal network, business card and attendance history live in your personal account, not in the organization account, so they cannot be reached this way.
7. Transfers and transfers abroad
Your name, photo and role are visible to authorized members of the organization you belong to on its team screen and in its action records. The database and backups holding your account and its records are stored on Amazon Web Services servers in Istanbul. To keep the service running, the minimum data needed is transferred to the following service providers.
| Recipient | Country | Purpose | Data transferred |
|---|---|---|---|
| Amazon Web Services (hosting) | Türkiye (Istanbul) | Storing the account and its records (database and backups) | Account information, membership and action records |
| Amazon Web Services (file storage) | Türkiye (Istanbul) | Storing and displaying the profile photo | Your optional profile photo |
| Amazon Web Services (Amazon SES) | Germany (Frankfurt) | Sending sign-in codes, team invitations and transactional notices | Your email address and the message content. Addresses that bounce or complain are kept on the provider’s suppression list so that sending to them stops |
Some of these providers may process data on servers outside Türkiye. Transfers abroad are made under KVKK Art. 9, relying on one of the safeguards set out in the Law.
8. Retention periods
| Data | Period | Ground |
|---|---|---|
| Account information and memberships | As long as the account stays open | Performance of a contract |
| Record of actions taken on behalf of the organization | Kept even after the account is deleted, with an anonymous account shown instead of your identity | Legitimate interest, legal obligation |
| Record that you read this notice | Kept for the evidentiary period even after the account is deleted | KVKK burden of proof |
| Session records | Until the session ends or the account is deleted | Legitimate interest |
After requesting deletion you can withdraw the request within 14 days. When that period ends your account is anonymized. If you are the only owner of an organization, you must transfer ownership to someone on the team before deleting your account, otherwise the organization would be left without an owner.
9. Your rights (KVKK Art. 11)
- To learn whether your personal data is processed
- To request information about it if it is processed
- To learn the purpose of processing and whether it is used for that purpose
- To know the third parties in Türkiye or abroad to whom it is transferred
- To request correction if it is incomplete or inaccurate
- To request deletion or destruction under the conditions of the Law
- To request that corrections, deletions and destructions be notified to the third parties it was transferred to
- To object to an outcome against you arising solely from automated analysis
- To claim compensation for damage caused by unlawful processing
You can export the data of your organization account from within the app. The file contains your account information, your organization memberships, your consent records, your session and device records and the team invitations you received. Data about the organization’s attendees is not in this file, that data belongs to the organization.
10. How to apply
To exercise your rights you can submit a request in line with the Communiqué on the Procedures and Principles of Applications to the Data Controller. Your request is concluded within 30 days at the latest.
- Through the KVKK Request Form in the app.
- By emailing support@warmbreak.com from your organization account’s email address.
- By sending a wet-signed petition to the company address in person or through a notary.
If your request is not resolved or you find the answer insufficient, you can file a complaint with the Personal Data Protection Board.