Data Protection Notice
Last updated: 26 July 2026 · Version: 2026-07-26-v1
This Notice is provided under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and informs data subjects about the personal data processed through the HR Radarplatform (the "Platform"), operated by OHD Danışmanlık.
1.Identity of the Data Controller
Your personal data is processed by OHD Danışmanlık as data controller, for the purposes and on the legal grounds set out below.
- Data controller: OHD Danışmanlık
- Platform: HR Radar
- E-mail: info@hrradar.app
- Website: hrradar.app
2.Categories of Personal Data Processed
The following categories of data are processed through the Platform. Data is primarily entered by the company's HR representative.
| Category | Data processed |
|---|---|
| Identity | Full name and job title of the representative. |
| Contact | E-mail address and mobile phone number of the representative. |
| Company and employment data | Company name, sector, city of operation, founding year, total headcount and blue-collar / white-collar breakdown, annual revenue band, exporter status, family-business status. |
| Financial | Invoice title, tax identification number (VKN) or national identification number (TCKN), invoice address and payment transaction records. |
| Assessment data | Answers given in the HR maturity assessment, the area and overall scores calculated from them, and the report content generated. |
| Transaction security | Account and session records, IP address, browser/device information, system logs, cookie records, and consent records (consent date, IP address, version of the notice accepted). |
3.Purposes of Processing
- Formation and performance of the service contract: creating the company record, generating the invitation link, opening accounts and authenticating users.
- Delivery of the HR maturity analysis: running the assessment, scoring answers and calculating the maturity level.
- Report production: generating area commentary, SWOT, priority matrix and executive summary; expert review and publication of the report.
- Benchmarking by sector, region and company size. Data is used in aggregated form that does not identify the company.
- Payment and invoicing, and compliance with obligations arising from tax legislation.
- Service communications: invitations, notifications and support correspondence.
- Information security: preventing unauthorized access and misuse, and keeping system logs.
- Fulfilling legal obligations and responding to requests from competent authorities.
4.Legal Grounds for Processing (Article 5)
| Legal ground | Relevant processing |
|---|---|
| Art. 5/2-c — Necessary for a contract | Account creation, invitation, authentication, running the assessment, producing and delivering the report, payment transactions. |
| Art. 5/2-ç — Legal obligation | Issuing invoices, keeping and retaining financial records, responding to requests from competent authorities. |
| Art. 5/2-f — Legitimate interest | Information security, system logging, service quality improvement and aggregated benchmarking studies. |
| Art. 5/1 — Explicit consent | Transfers abroad (see section 6) and any other processing not strictly necessary to deliver the service. Explicit consent is obtained separately and expressly when an account is created and when the assessment is started; the date, IP address and version of the notice accepted are recorded. |
5.Method of Collection
Personal data is collected electronically, by wholly or partly automated means, through the company registration form, the invitation and account creation screen, the assessment screen and the payment form on the Platform, as well as through e-mail and support channels.
6.Transfers of Personal Data (Articles 8 and 9)
The Platform relies on cloud service providers. Some of these providers host their servers outside Türkiye, and your personal data is therefore transferred abroad. The providers used, their locations and the scope of each transfer are set out below:
| Service provider | Country / region | Purpose and scope of transfer |
|---|---|---|
| Supabase | European Union — Frankfurt, Germany | Database, authentication and file storage. All account, company, survey and report data is stored here. |
| Vercel | United States (default function region) | Application hosting and server-side execution. Data is not stored persistently; it is processed for the duration of the request. Technical logs (IP, browser information) are retained. |
| Anthropic (Claude API) | United States | Generating report commentary. Only company-level data (company name, sector, employee count and breakdown, city, founding year, exporter/family-business status) together with survey answers and scores is sent; names, e-mail addresses, phone numbers, invoicing and payment data are NOT sent. |
Transfers abroad are carried out on the basis of your explicit consent under Article 9 of the KVKK. Agreements governing the scope of processing and security obligations are concluded with these providers, and the technical and organizational safeguards they offer are applied.
Beyond this, your personal data may be disclosed to competent public authorities where there is a legal request, limited to the scope of that request. Your personal data is never sold, rented or transferred to third parties for marketing purposes.
7.Retention Periods
| Data category | Retention period |
|---|---|
| Account, company, assessment and report data | For the duration of the service relationship and 10 years thereafter (general statute of limitations, Turkish Code of Obligations Art. 146). |
| Invoices and financial records | 10 years, under the Tax Procedure Law and the Turkish Commercial Code. |
| Consent records | For the period the consent is valid and 10 years thereafter (burden of proof). |
| System logs and security records | 2 years. |
| Unused invitation links | Expire after their 7-day validity period; the record is retained for 1 year. |
At the end of these periods, personal data is deleted, destroyed or anonymized in line with the Regulation on the Deletion, Destruction or Anonymization of Personal Data. Anonymized data may continue to be used in benchmarking studies.
8.Rights of the Data Subject (Article 11)
- To learn whether your personal data is being processed.
- To request information if your personal data has been processed.
- To learn the purpose of processing and whether the data is used in accordance with that purpose.
- To know the third parties, in Türkiye or abroad, to whom your personal data is transferred.
- To request rectification if your personal data is incomplete or inaccurate.
- To request erasure or destruction of your personal data under the conditions set out in Article 7.
- To request that rectification, erasure and destruction be notified to third parties to whom the data was transferred.
- To object to a result to your detriment arising from analysis of your data solely by automated systems.
- To claim compensation for damage arising from unlawful processing of your personal data.
9.How to Apply (Article 13)
You may submit requests concerning the rights above in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- By e-mail to info@hrradar.app, sent from the e-mail address registered in our system, or using a registered electronic mail (KEP) address, secure electronic signature or mobile signature.
- By a written, wet-signed application delivered in person or through a notary to OHD Danışmanlık, together with documents verifying your identity.
Your application must include your name and surname, signature (for written applications), Turkish identification number (for foreign nationals: nationality, passport number or identification number), your address for service, your e-mail address, telephone and fax number if any, and the subject of your request, with supporting documents attached.
Applications are concluded free of charge as soon as possible and within 30 days at the latest. Where the process incurs a cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, the response is insufficient, or no response is given within the period, you may file a complaint with the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of the application date.
10.Changes to This Notice
This Notice may be revised in line with legislative changes or updates to the Platform. The version in force and its date are shown at the top and bottom of this page. Where changes are material, consent is obtained again for consent-based processing. For details of our privacy practices, see the Privacy Policy.
Last updated: 26 July 2026 · Version: 2026-07-26-v1