UR Work Yazılım Ticaret Limited Şirketi ("UR Work", "we", "us" or "our") takes the protection of your personal data and your privacy seriously. In this privacy notice we explain, clearly and transparently, which personal data we collect, for what purposes we use it, on which legal bases we do so, with whom we may share it, how long we keep it, and which rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure and unauthorised alteration.
Your right to object
You can object at any time to the use of your personal data for direct marketing, and we will then stop using it for that purpose. You can also object, on grounds relating to your particular situation, to processing that we base on our legitimate interests (section 5.3). See section 11.6 for details. To object, email info@ur-work.com.
1. Who is responsible for the processing?
1.1 UR Work as controller
UR Work Yazılım Ticaret Limited Şirketi is the controller when UR Work itself determines the purposes and means of the processing. This is the case, for example, when we process personal data of:
- visitors to our website;
- business contacts;
- prospective and existing customers;
- suppliers and business partners;
- job applicants;
- employees and former employees of UR Work;
- people who contact us or ask for support.
UR Work's contact details are: UR Work Yazılım Ticaret Limited Şirketi Address: Esentepe Mah., Keskin Kalem Sok. No: 17, Arya Plaza, 34394 Şişli, İstanbul, Turkey Email: info@ur-work.com
1.2 UR Work as processor
When a customer uses UR Work's services to process personal data of its employees or other individuals, that customer in principle decides why and how this data is used. In that case the customer, for example your employer, is the controller, and UR Work acts as a processor on the customer's behalf. UR Work processes this personal data only on the customer's documented instructions and under the data processing agreement concluded with the customer. Does your request concern personal data that your employer or another organisation processes through the UR Work platform? Then please send your request to that organisation first. If you send it to us, we will forward it to that organisation without undue delay and help them respond, as our agreement with them requires. We will let you know that we have done so.
2. Who does this privacy notice apply to?
This privacy notice may apply to:
- visitors to and users of our website and mobile application;
- customers and prospective customers;
- representatives and employees of business customers;
- suppliers, business partners and their contact persons;
- job applicants, employees and former employees of UR Work;
- people who communicate with us or use our support;
- other individuals whose personal data UR Work processes as controller.
Exactly which data we process depends on your relationship and interaction with UR Work.
3. Which personal data do we process?
Depending on the situation, we may process the following categories of personal data.
3.1 Identification data
This may include:
- first name and surname;
- date and place of birth, where necessary;
- job title or position within an organisation;
- customer, employee or user number;
- identity document details, only where necessary and permitted by law.
We do not collect national identification numbers, such as a citizen service number or social security number, unless there is a specific legal basis for doing so.
3.2 Contact data
This may include:
- home or business address;
- email address;
- telephone number;
- other contact details you provide.
3.3 Education and work experience data
This may include:
- diplomas and courses completed;
- certificates;
- professional qualifications;
- curriculum vitae;
- employment history;
- references;
- details of internal or external training.
3.4 Business and contractual data
This may include:
- company name;
- position and department;
- contract details;
- details of the services purchased;
- quotations and business correspondence;
- invoice and payment details;
- records relating to the business relationship.
3.5 Communication and support data
This may include:
- emails and other correspondence;
- contact and request forms;
- support requests;
- complaints and feedback;
- information you give us during conversations.
3.6 Technical and usage data
When you use our website, mobile application or services, we may process technical data such as:
- IP address;
- device type;
- operating system;
- browser type and version;
- language settings;
- date and time of access;
- log data;
- pages visited;
- interactions with our website or services;
- error messages and technical performance data.
You can find more information about our use of cookies and similar technologies in our Cookie Policy. You can change your cookie choice at any time via "Cookie Settings" at the bottom of every page.
3.7 Job application and personnel data
When you apply for a job at UR Work or work for UR Work, we may, where necessary, process additional data about:
- your application and suitability for a position;
- work experience and references;
- terms of employment;
- salary and payments;
- attendance and leave;
- performance and training;
- statutory employment and personnel records.
Additional, more specific privacy notices may apply to employees and job applicants.
3.8 Special categories of personal data
In principle we do not process special categories of personal data, such as data concerning health, religion, political opinions, sexual orientation or biometric data, unless this is necessary, permitted by law and the additional conditions of Article 9 GDPR are met.
4. How do we collect personal data?
We may obtain personal data:
- directly from you;
- through our website, mobile application or the UR Work platform;
- through contact forms, email, telephone or social media;
- during business meetings, demonstrations and events;
- through job applications and job sites;
- through your employer or the organisation you work for;
- through customers, suppliers, business partners and service providers;
- from public business sources, where their use is permitted by law;
- in connection with contracts, legal obligations or support services.
Where we do not receive your personal data directly from you, we will inform you of this to the extent and at the time required by the GDPR.
5. For what purposes and on what legal bases do we process personal data?
UR Work processes personal data only where there is a valid legal basis for doing so.
5.1 Performance of a contract or pre-contractual steps
We may process personal data where this is necessary to:
- prepare, conclude and perform a contract with you or your organisation;
- provide our products and services;
- create and manage customer and user accounts;
- provide support and maintenance;
- handle requests, quotations and orders;
- issue invoices and process payments;
- communicate with you about our services;
- assess job applications and take steps before entering into an employment contract.
The legal basis for this is Article 6(1)(b) GDPR.
5.2 Legal obligations
We may process personal data where this is necessary to comply with legal obligations, including obligations relating to:
- financial records and accounting;
- tax law;
- employment and social security law;
- statutory retention requirements;
- fraud prevention;
- the prevention of money laundering and terrorist financing, to the extent these rules apply to UR Work;
- requests or orders from competent public authorities and judicial authorities.
The legal basis for this is Article 6(1)(c) GDPR.
5.3 Legitimate interests
We may process personal data where this is necessary for our legitimate interests or those of a third party, provided that your interests, fundamental rights and freedoms do not override them. These interests may include:
- managing and improving our business operations;
- maintaining business relationships;
- improving and securing our website, applications and IT systems;
- preventing and investigating fraud, misuse and security incidents;
- internal administration, reporting and quality control;
- market research and the development of our products and services;
- contacting existing or prospective business contacts about our services, where permitted by law (marketing emails are only sent with your consent, see section 5.4);
- establishing, exercising or defending legal claims;
- business continuity and risk management;
- audits and internal oversight.
Before we process personal data on this basis, we assess whether our interests outweigh the possible impact on your privacy. The legal basis for this is Article 6(1)(f) GDPR.
5.4 Consent
Where the processing cannot be based on another legal basis, we may ask for your consent. This may apply, for example, to:
- marketing emails about new features, campaigns and announcements (users of our app can give this consent with the optional box at first sign-in and withdraw it at any time on their Profile page);
- non-essential cookies and tracking technologies on our website, including the recognition of companies visiting our website (see our Cookie Policy);
- keeping job application data for longer;
- other specific processing for which consent is required by law.
The legal basis for this is Article 6(1)(a) GDPR. You can withdraw your consent at any time. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.
6. Do you have to provide your personal data?
In some cases you are required by law or by contract to provide certain personal data. Without this data we may not be able to:
- enter into a contract with you or your organisation;
- provide certain services;
- create an account;
- handle a request or job application;
- comply with our legal obligations.
Where providing data is mandatory, we will tell you so.
7. Who may we share personal data with?
Where necessary and permitted by law, we may share personal data with:
- suppliers and business service providers;
- hosting, cloud and IT service providers;
- communication, CRM and support service providers;
- payment service providers, banks and financial institutions;
- accountants, auditors, tax advisers and other professional advisers;
- lawyers, legal advisers and insurers;
- business partners, only where this is necessary for the cooperation concerned;
- shareholders and group companies, where necessary and permitted by law;
- potential buyers, investors or advisers in connection with a possible merger, investment, reorganisation or acquisition;
- competent supervisory authorities, public authorities, police, prosecutors and judicial authorities;
- other parties, where you have given your consent.
Service providers that process personal data on behalf of UR Work may use this data only in accordance with our instructions and must take appropriate security measures. We do not sell your personal data.
8. Transfers of personal data outside the EEA
UR Work is established in Turkey. The data in the UR Work platform (our app and web panel) is hosted on servers of Amazon Web Services (AWS) in the European Economic Area (EEA). Our team accesses this data from Turkey to provide support and to operate the service. This access counts as a transfer of personal data outside the EEA. Turkey does not currently have a general adequacy decision from the European Commission. For personal data that we process on behalf of customers in the EEA, we sign the standard contractual clauses approved by the European Commission with the customer on request. Other service providers, for example for email or payments, may also process personal data outside the EEA, in countries that may not have an adequacy decision either. When personal data is transferred outside the EEA, we do so only where the requirements of Chapter V of the GDPR are met. Depending on the situation, we may rely on:
- an adequacy decision of the European Commission;
- standard contractual clauses approved by the European Commission;
- the EU–U.S. Data Privacy Framework, for participating organisations;
- additional technical and organisational safeguards;
- another transfer mechanism permitted by law.
You can contact us for more information about the safeguards that apply and, where available and permitted by law, request a copy of them.
9. How long do we keep personal data?
We do not keep personal data for longer than is necessary for the purpose for which it was collected. When setting retention periods, we take into account, among other things:
- the duration of our contract or business relationship;
- the period during which an account is active;
- statutory tax, accounting and administrative retention requirements;
- applicable limitation periods;
- the need to deal with disputes and legal claims;
- security and fraud prevention purposes;
- your consent, where the processing is based on it.
When personal data is no longer needed, it is deleted, anonymised or otherwise securely taken out of use, unless a legal obligation requires us to keep it longer. For data in the UR Work platform that we process on behalf of a customer (for example an employer), the customer decides when it is deleted:
- as long as the customer does not delete its company account, we keep the account data and its employees' data on the customer's behalf, even if the subscription has ended;
- when the customer deletes its company account, the account data and its employees' data are deleted or anonymised within 90 days;
- invoices and accounting records that we must keep by law are kept for the statutory retention period (under the Turkish Commercial Code, generally ten years).
10. How do we protect personal data?
UR Work takes appropriate technical and organisational measures that are suited to the nature of the data, the processing and the possible risks. These measures may include:
- access restrictions and authorisation management;
- encryption in storage and in transit;
- logging and security monitoring;
- backups and recovery procedures;
- secure software development;
- periodic checks and security testing;
- confidentiality obligations;
- procedures for reporting and handling security incidents.
No method of transmitting or storing data is completely free of risk. We therefore review and improve our security measures regularly.
11. What are your rights?
Where the legal conditions are met, you have the following rights under the GDPR.
11.1 Right of access
You have the right to know whether we process personal data about you, and you can request a copy of that data and further information about the processing.
11.2 Right to rectification
You can ask us to correct inaccurate personal data and to complete incomplete data.
11.3 Right to erasure
In certain situations you can ask us to delete your personal data, for example when the data is no longer necessary or has been processed unlawfully. This right is not absolute. We may keep certain data where this is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
11.4 Right to restriction of processing
In certain situations you can ask us to temporarily restrict the processing of your personal data.
11.5 Right to data portability
Where the processing is based on your consent or on a contract and is carried out by automated means, you can receive certain personal data in a structured, commonly used and machine-readable format. Where technically feasible, you can ask us to transfer this data directly to another organisation.
11.6 Right to object
You can object, on grounds relating to your particular situation, to processing based on a legitimate interest. Where your personal data is used for direct marketing, you can object to this at any time. Once you object, we will no longer use your personal data for direct marketing.
11.7 Right to withdraw consent
Where processing is based on your consent, you can withdraw that consent at any time.
11.8 Rights related to automated decision-making
You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, unless a legal exception applies. Where such an exception applies, you have, to the extent required by law, the right to obtain human intervention, to express your point of view and to contest the decision.
11.9 Right to lodge a complaint
You have the right to lodge a complaint with a competent supervisory authority, in particular in the EU or EEA country where you habitually reside, where you work or where the alleged infringement took place. In the Netherlands, this is: Autoriteit Persoonsgegevens (Dutch Data Protection Authority) Website: www.autoriteitpersoonsgegevens.nl The supervisory authorities of the other EU and EEA countries are listed on the website of the European Data Protection Board: www.edpb.europa.eu. UR Work is not established in the EU, so there is no single "lead" supervisory authority for UR Work: you can complain directly to the authority in your own country. We would appreciate it if you contacted us first, so that we have the chance to look into your question or complaint. This does not affect your right to complain to a supervisory authority directly.
11.10 Informing recipients
If we correct or delete your personal data or restrict its processing at your request, we will inform each recipient to whom we disclosed the data, unless this proves impossible or involves disproportionate effort. If you ask, we will tell you who these recipients are.
12. How can you make a request?
You can make a request about your privacy rights:
- by email to info@ur-work.com; or
- in writing to Esentepe Mah., Keskin Kalem Sok. No: 17, Arya Plaza, 34394 Şişli, İstanbul, Turkey.
You can make your request in English, Dutch or Turkish. You do not have to use a specific form, but you are welcome to use the privacy request form (PDF) on our privacy request page. Please include in your request:
- your name and contact details;
- which right your request relates to;
- a clear description of your request;
- relevant information that helps us find the data or processing concerned;
- where applicable, the organisation or employer through which you use the UR Work platform.
We do not disclose personal data of other individuals unless you are legally authorised to act on their behalf.
13. Verifying your identity
To make sure we give personal data only to the right person, we check that a request really comes from you, in proportion to the request. If you have an account with us or we know your email address, we will normally ask you to send or confirm your request from that email address. Only if that is not enough may we ask for additional information, and never more than is needed. We do not require a copy of your identity document. If you choose to send one, please cover any details that are not needed, such as your photo and national identification number.
14. How quickly do we respond?
We respond without undue delay and in principle within one month of receiving your request. For complex requests or a large number of simultaneous requests, this period may be extended by up to two further months. If we extend the period, we will tell you within the first month and explain why we need more time. In principle we handle requests free of charge. Only where a request is manifestly unfounded or excessive, in particular because of its repetitive character, may we charge a reasonable fee or refuse the request. We will explain the reasons for such a decision. If we do not act on your request, we will inform you within one month of the reasons and of your right to lodge a complaint with a supervisory authority or to seek a judicial remedy.
15. Changes to this privacy notice
We may update this privacy notice when our services, our processing of personal data or the applicable laws and regulations change. The date at the top of this page shows when the privacy notice was last updated. Where necessary, we will inform you of significant changes in an appropriate way.
16. Contact
Do you have questions about this privacy notice, the processing of your personal data or exercising your rights? Please contact us:
UR Work Yazılım Ticaret Limited Şirketi
Address: Esentepe Mah., Keskin Kalem Sok. No: 17, Arya Plaza, 34394 Şişli, İstanbul, Turkey
Email: info@ur-work.com