This notice is written in plain English. Where Türkiye-specific terminology applies (KVKK, açık rıza, veri sorumlusu) we use the canonical wording so it remains usable for legal review.
1. Who we are
The data controller (veri sorumlusu) for personal data processed through Urety.co is URETYCO TEKNOLOJİ ANONİM ŞİRKETİ, a company registered in Türkiye.
- Registered office: Muallimköy Mah. Deniz Cad. Muallimköy T.G.B. 1. Etap Sitesi, 1.1.C1 Blok No: 143/8 İç Kapı No: Z01, 41400 Gebze / Kocaeli, Türkiye.
- Tax registration: 8930620246, Uluçınar Vergi Dairesi (041202).
- Primary contact: info@urety.co.
2. Scope and key terms
This notice covers personal data processed when you visit https://www.urety.co, create an account, request a quote, place an order, upload CAD files, contact our team, or otherwise interact with the platform. It does not cover separate websites or services that we link to but do not operate.
We use these terms in their KVKK and GDPR sense: personal data is any information relating to an identifiable individual; processing covers everything we do with that data; data subject is you.
3. Data we collect
We try to collect the minimum data necessary for each purpose. The categories we collect, and where they come from, are:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, phone, company name, role. | You, when you sign up or fill in a profile. |
| Project and CAD data | STEP/STL/3MF/DXF files, drawings, project notes, derived metrics. | You, when you upload designs. |
| Order and commercial data | Quotes, orders, invoices, billing address, VAT/tax ID. | You, when you order. Generated by us in response. |
| Payment data | Tokenized payment instrument, transaction reference, last four digits. | Your payment provider; full card data never reaches us. |
| Technical data | IP address, device type, browser, pages visited, performance metrics. | Automatically when you use the platform. |
| Communications | Emails, support tickets, AI assistant conversations. | You and our team, when we communicate. |
We do not knowingly collect special categories of personal data (health, biometric, religious affiliation, etc.). If a CAD project would involve such data, please redact or anonymize it before upload.
4. Lawful bases
Under KVKK Article 5 and GDPR Article 6, we process personal data on the following bases:
| Activity | Lawful basis |
|---|---|
| Creating and managing your account, processing orders, delivering parts. | Performance of a contract. |
| Tax invoicing, complying with manufacturing regulations, audit logs. | Legal obligation. |
| Securing the platform, fraud prevention, supplier vetting. | Legitimate interest (balanced against your rights). |
| Marketing emails, analytics beyond strictly necessary, AI training opt-in. | Your explicit consent (açık rıza), revocable at any time. |
5. How we use your data
- Operating the platform: account, quoting, ordering, supplier coordination, delivery, support.
- Engineering analysis: running topology and DFM checks on uploaded CAD models to produce quotes.
- Communicating with you: order updates, technical answers, transactional notifications.
- Securing the service: detecting abuse, applying rate limits, blocking unauthorized access.
- Compliance: keeping invoices, audit logs, KVKK records, AML/KYC where applicable.
- Improvement: aggregated analytics on platform performance and reliability (no individual profiling).
- Optional marketing: sending product updates and editorial content if you have opted in.
6. AI and automated processing
Some platform decisions involve automated processing — most visibly the AI co-pilot, the topology analysis engine, and the instant pricing engine. Two important commitments apply:
- You stay in control. Recommendations are surfaced for your review; the platform never finalises an order, alters your CAD, or signs a contract on your behalf without your action.
- Your CAD is not used to train shared models. Topology metrics may flow into our internal cost calibration. Geometry and IP are excluded from any third-party model training unless you opt in to a specific program.
Under GDPR Article 22 you have the right to a human review of any decision that produces a legal or similarly significant effect on you. For Uretyco that effectively applies only to supplier-side onboarding decisions; orders are always finalised by you.
7. Sharing and subprocessors
We share data only with parties that are necessary to operate the service, and only the data they need.
| Recipient | Role | Region |
|---|---|---|
| Manufacturing partners | Production of your parts, under back-to-back NDA. They receive only the scoped files for their job. | Türkiye, EU, selected APAC and Eastern Europe. |
| Cloud hosting | Application hosting, database, file storage. | EU and US (where transfers are covered by SCCs). |
| Payment processors | Processing card and bank payments. | Türkiye and EU. |
| Logistics carriers | Pickup, transport, customs clearance, delivery. | Origin, transit, and destination countries. |
| Email and communications | Transactional and (if opted in) marketing emails. | EU. |
| Analytics | Aggregated platform analytics where you have consented. | EU and US. |
We never sell personal data. We never share data for advertising profiling outside the platform. We disclose data to public authorities only on a valid legal request, and review every request for proportionality before responding.
8. International transfers
Some of our subprocessors are based outside Türkiye, including the EU and the United States. Where we transfer personal data outside Türkiye, we do so under a transfer mechanism recognised by KVKK Article 9 and, where the EU is involved, the GDPR Standard Contractual Clauses or an equivalent safeguard.
9. Retention
We keep personal data for as long as it is needed for the purposes set out above, or as required by law. Indicative periods:
| Data | Retention |
|---|---|
| Account data | Lifetime of the account, then 12 months after deletion. |
| Order, quote, invoice records | 10 years (Türkiye Tax Procedure Law). |
| CAD files and drawings | 5 years from last activity, or sooner on request. |
| Marketing consent records | 3 years from last interaction or until withdrawal. |
| Security and audit logs | 12 months by default; longer for incident-related logs. |
10. Security
We follow a defence-in-depth approach: TLS 1.3 in transit, encryption at rest for stored CAD and account data, role-based access control with least privilege, mandatory MFA for staff accounts, vulnerability scanning, and a documented incident response procedure. Our progress toward formal certifications (ISO 27001 alignment in particular) is summarised on the Compliance and Security page.
11. Your rights
You have the following rights under KVKK Article 11 and GDPR Articles 15 to 22:
- Find out whether we process your personal data, and if so, request a copy.
- Request correction of inaccurate data.
- Request deletion of data we no longer have a lawful reason to keep (the right to be forgotten).
- Request restriction of processing while a complaint is reviewed.
- Receive your data in a portable format.
- Object to processing based on legitimate interest.
- Withdraw consent at any time.
- Lodge a complaint with the Türkiye Personal Data Protection Authority (KVKK Kurumu) or your local supervisory authority.
12. How to exercise your rights
Use the data subject request portal or email info@urety.co. We aim to respond within 30 days; KVKK requires a written response within 30 calendar days. We may need to verify your identity before acting on a request that involves disclosing personal data.
13. Cookies
Our use of cookies is described in the Cookie Policy. You can change your preferences any time from the cookie banner or your browser.
14. Children
The platform is intended for B2B and professional users. We do not knowingly collect data from anyone under 16. If you believe a child has provided personal data, please contact us so we can remove it.
15. Changes to this notice
We update this notice when our processing activities change or when laws and best practices evolve. The version and last updated date at the top reflect the most recent change. Material changes are announced by email to active users and a banner on the platform.
16. Contact
For privacy questions, complaints, or to exercise your rights: info@urety.co. Postal mail can be sent to Muallimköy Mah. Deniz Cad. Muallimköy T.G.B. 1. Etap Sitesi, 1.1.C1 Blok No: 143/8 İç Kapı No: Z01, 41400 Gebze / Kocaeli, Türkiye.