1. Data controller
Your personal data is processed by Cekci Lab Teknoloji Limited Şirketi (“WarmBreak”, “the Company”) acting as data controller, within the scope set out below.
- Legal name
- Cekci Lab Teknoloji Limited Şirketi
- Address
- Kazımdirik Mah. 296/2 Sk. No: 33 Bornova / İzmir
- Tax office
- Hasan Tahsin
- Tax number
- 2040720788
- Requests
- support@warmbreak.com
- Support
- support@warmbreak.com
2. Personal data we process
We collect only the data the product needs in order to work. The table below is derived from the application’s database schema; a category that is not listed here is not processed.
| Category | Data | Source |
|---|---|---|
| Identity and contact | Full name, e-mail address, profile photo, language and time zone preference | From you |
| Business card details | Phone number, job title, company, industry, seniority, bio, website, LinkedIn / X / GitHub address, education details (school, field, graduation year) | From you (optional) |
| Event data | Events you register for and QR based check-in records | Product usage |
| Networking data | Encounter records (who, at which event, when), private notes you write about people, meeting request messages | From you |
| Recommendation records | The event and people recommendations shown to you and what became of them (seen, opened, turned into a registration). Totals with no identity in them are collected from everyone, a record tied to your account is kept only if you have given usage analytics consent | Product usage |
| Transaction security | Session records, browser and device information, a hashed digest of your IP address, your consent records | Automatic |
| Notifications | Device push token and platform | With your permission |
3. Purposes of processing
- Creating your account, verifying your identity and keeping your session secure
- Letting you register for, apply to and be invited to events
- Letting you send and receive meeting requests before an event starts
- Letting you check in with a QR code and record the people you meet
- Running business card exchange with mutual approval and keeping your card wallet
- Recommending events and people based on your attendance history and interest tags
- Measuring and improving how accurate recommendations are (a record tied to your account only where you have given explicit consent)
- Measuring product usage analytics (only where you have given explicit consent)
- Meeting our legal obligations and keeping consent records auditable
Your data is never sold to ad networks, data brokers or sponsors. A sponsor only ever receives what you deliberately shared at that event, and only as much as you shared.
4. Legal grounds
| Processing | Ground under Article 5 |
|---|---|
| Account creation, sessions, event registration and appearing on the attendee list of the events you register for (the list is open only to people registered for that event and carries no contact details) | Necessary for the conclusion and performance of a contract |
| Security logs, abuse prevention | Legitimate interest |
| Recommending events and people to you from the events you attend and your interest tags | Legitimate interest |
| Measuring recommendation accuracy with totals that contain no identity | Legitimate interest |
| Diagnosing faults from error logs | Legitimate interest |
| Retention of consent and accounting records | Compliance with a legal obligation |
| Social and web addresses you add to your card | Data made public by the data subject themselves |
| Marketing e-mail, analytics and recommendation records tied to your account | Explicit consent |
5. Sharing and international transfers
The database, cache and backups holding your account, event and networking data are stored on Amazon Web Services servers in Istanbul. Beyond that, your data is shared with a small number of service providers needed to keep the service running; the country of each provider is shown in the table below. Each provider receives the minimum data required to do its job.
| Recipient | Country | Purpose | Data shared |
|---|---|---|---|
| Amazon Web Services (hosting) | Türkiye (Istanbul) | Application database (PostgreSQL), cache (Redis) and backups | All account, event and networking data |
| Other people registered for the same event | Wherever the attendee is | Attendee list (meeting people and meeting requests before the event) | Name, title, organisation, seniority, sector, short bio, profile photo and interest tags. No contact details are shared |
| Amazon Web Services (file storage) | Türkiye (Istanbul) | Storage of the images you upload | Profile photo, card logo, event artwork and the IP address of the device requesting the image |
| Amazon Web Services (Amazon SES) | Germany (Frankfurt) | Sign-in codes and transactional e-mail | Your e-mail address, your name and message content. Addresses that bounce or complain are kept on the provider’s suppression list so that sending to them stops |
| Google (Firebase Cloud Messaging) | USA and EU | Delivering mobile notifications to your device (Android and iOS) | Device push token and notification text |
| Apple (Apple Push Notification service) | USA | Final delivery of the notification to iOS devices | Device push token and notification text |
| OpenStreetMap Foundation | United Kingdom | Loading the map on the event page onto your device | The IP address and browser/app details sent directly from your device when the map image is requested. Your location is not collected. |
6. Retention periods
| Data | Period | Basis |
|---|---|---|
| Account and business card data | For as long as your account is open | Performance of the contract |
| Waiting window after a deletion request | 14 days | Protection against accidental deletion |
| Unconfirmed sign-up (e-mail not verified) | 7 days | Not accumulating dangling data |
| Encounter and attendance records | Anonymised when your account is deleted | Legitimate interest (statistics) |
| Recommendation records, totals with no identity | 730 days | Legitimate interest (season over season comparison) |
| Recommendation records tied to your account | 180 days | Explicit consent (no new record after withdrawal) |
| Consent records | Kept even after the account is deleted | Burden of proof under the Law |
| Traffic and transaction security logs | 2 years | Law No. 5651 |
| Invoicing and accounting records, if any | 5 years | Tax Procedure Law art. 253 |
Records whose period has expired are deleted or anonymised automatically by maintenance jobs; no manual request is needed. Recommendation records tied to your account are deleted as soon as your account is deleted, without waiting for the period to expire.
7. Automated analysis (the recommendation engine)
WarmBreak recommends events and people to you based on the events you have attended and your interest tags. This is automated processing within the meaning of Article 11(g), and we explain its logic here.
To measure how accurate recommendations are, we record which recommendation was shown to you and what became of it (seen, opened, turned into a registration). The record has two layers. The first layer is totals with no identity in them (“this event was shown to 100 people and 12 opened it”) and is collected from everyone. The second layer keeps the same information tied to your account and exists only if you have given usage analytics consent. From the moment you withdraw that consent, no new record tied to your account is created. The identity of the person recommended to you is kept in neither layer. These records are not shared with sponsors or any other third party. The ones tied to your account are included when you export your data and are deleted immediately when your account is deleted.
There is no separate switch that turns recommendations off. They are part of how the product works. What you do control is the data the engine is fed. You can remove your interest tags from your profile and leave an event’s attendee list by cancelling your registration. Your right to object to the outcome of automated analysis under Article 11(g) is reserved, and you can raise that objection through the data subject request form.
Invite-only events never enter the recommendation engine; their existence is not disclosed through recommendations, search or discovery.
8. Your rights (Article 11)
- To learn whether your personal data is processed
- To request information if it has been processed
- To learn the purpose of processing and whether the data is used accordingly
- To know the third parties, in Türkiye or abroad, to whom the data is transferred
- To request rectification of incomplete or inaccurate data
- To request erasure or destruction within the conditions of the Law
- To request that rectification, erasure or destruction be notified to the third parties concerned
- To object to an adverse outcome arising from analysis carried out solely by automated systems
- To claim compensation for damage suffered because of unlawful processing
9. How to reach us
You may exercise your rights in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request is concluded within 30 days at the latest; if it entails an additional cost, the fee set in the Board’s tariff is notified to you in advance.
- Through the in-app data subject request form. Your identity is verified from your session, and this is the fastest route.
- By e-mailing support@warmbreak.com from the address registered to your account.
- By sending a wet-signed petition to the company address in person or through a notary.
If your request is not resolved or you find the answer insufficient, you may lodge a complaint with the Turkish Personal Data Protection Board.