Last updated: 25 August 2026
01Who we are
Nevalabs is a technology company established in Türkiye, developing AI-based recognition, verification and situational-awareness software (the Corvo product family and Uggla). For the processing described in this notice, Nevalabs acts as the data controller (veri sorumlusu) within the meaning of Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where the GDPR/KVKK applies to a visitor in the EU/EEA or the UK, as the controller under Article 4(7) GDPR/KVKK.
Nevalabs
YTÜ İkitelli Teknopark No. 1, D. 1B05-06, 34490 Başakşehir, İstanbul, Türkiye
info@nevalabs.com · +90 212 245 15 15
02Scope of this notice
This notice covers only this website and the direct contact channels published on it. It does not cover personal data processed inside a customer's own deployment of a Nevalabs product. When a customer runs Corvo or Uggla on its own systems, that customer is the data controller for the data processed there and is responsible for its own legal basis, notices and retention rules; Nevalabs acts as a data processor under a separate written agreement.
The website does not offer user registration, member accounts, profiles, partner portals or any live face recognition, liveness or biometric trial. No biometric data is collected through this website. If we add such features in future, this notice will be updated before they go live.
03What we collect and why
We only process what you actively send us, plus the minimum technical data needed to serve the site securely.
| Data | Purpose | Legal basis |
|---|---|---|
| Identity and contact data you type into a form (name, company, job title, e-mail, phone) | Answering demo requests, sales, technical support and general inquiries; maintaining a record of the correspondence | KVKK Art. 5(2)(c) — necessary for the conclusion or performance of a contract / Art. 5(2)(f) legitimate interest; GDPR/KVKK Art. 6(1)(b) and 6(1)(f) |
| Message content and any details you choose to include | Understanding and responding to your request | Same as above |
| Technical connection data (IP address, timestamp, user agent, requested URL) processed by our hosting and security infrastructure | Delivering the pages, keeping the site available, preventing abuse and attacks, and complying with legal record-keeping duties | KVKK Art. 5(2)(f) and 5(2)(a); GDPR/KVKK Art. 6(1)(f) and 6(1)(c) |
| Career or partnership information you send by e-mail | Evaluating your application or proposal | KVKK Art. 5(2)(c) / Art. 5(1) explicit consent where required; GDPR/KVKK Art. 6(1)(b) and 6(1)(a) |
We do not build marketing profiles, we do not run automated decision-making that produces legal effects on you, and we do not knowingly collect data from children.
04Cookies and similar technologies
This website currently uses no analytics, advertising, social-media or other third-party tracking cookies. Only strictly necessary technical storage is used to deliver and secure the pages you request, which under KVKK and Article 5(3) of the ePrivacy Directive does not require consent. For that reason there is no cookie consent banner on the site today.
If we later introduce analytics or marketing technologies, we will publish an updated cookie table here and collect your consent through a consent banner before any non-essential cookie is set.
05Who we share data with
We do not sell personal data. We share it only where necessary, and only with:
- hosting, e-mail and IT service providers acting on our instructions under a data processing agreement;
- professional advisers (legal, financial) bound by confidentiality;
- public authorities, courts or regulators where disclosure is required by Turkish law or a valid legal request.
06International transfers
Nevalabs is based in Türkiye and personal data collected through this website is primarily processed in Türkiye. Where a service provider is located abroad, the transfer is made in accordance with Article 9 of the KVKK — on the basis of an adequacy decision, a standard contract or undertaking notified to the Personal Data Protection Authority (KVKK), or your explicit consent — and, for data protected by the GDPR/KVKK, on the basis of Standard Contractual Clauses or another Chapter V safeguard.
07How long we keep data
Inquiry and correspondence records are kept for the duration of the relationship and for up to 10 years afterwards where needed to comply with Turkish commercial, tax and statute-of-limitation requirements. Technical connection and security logs are kept for a maximum of 2 years. Career applications are kept for up to 2 years unless you ask us to delete them earlier. When a retention period expires, data is deleted, destroyed or anonymised.
08How we protect data
We apply technical and organisational measures appropriate to the risk: encryption in transit, access control on a need-to-know basis, segregated environments, logging, secure development practices, staff confidentiality undertakings and periodic review of our processors.
09Your rights
Under Article 11 of the KVKK you have the right to:
- learn whether your personal data is processed and request information about it;
- learn the purpose of processing and whether it is used in line with that purpose;
- know the third parties, in Türkiye or abroad, to whom the data is transferred;
- request correction of incomplete or inaccurate data, and notification of the correction to recipients;
- request erasure or destruction of the data where the conditions in Article 7 of the KVKK are met, and notification of this to recipients;
- object to a result produced solely by automated analysis of the data;
- claim compensation for damage arising from unlawful processing.
If the GDPR/KVKK applies to you, you additionally have the rights of access, rectification, erasure, restriction, data portability, objection, withdrawal of consent at any time, and the right to lodge a complaint with your supervisory authority.
10How to exercise your rights
Write to info@nevalabs.com or to our registered address above. To help us identify you and act on the correct request, please include: your full name, your Turkish ID number if you are a Turkish citizen (or passport/ID number if not), your address or e-mail of record, the subject of your request, and any supporting information.
Requests must be submitted in Turkish or English in accordance with the Communiqué on the Procedures for Application to the Data Controller. We respond free of charge within 30 days at the latest; where the response requires a cost, the fee tariff set by the Personal Data Protection Board may apply. If you are not satisfied with our response, you may file a complaint with the Turkish Personal Data Protection Authority (KVKK).
11Changes to this notice
We update this notice whenever our processing changes — for example when we introduce accounts, analytics cookies or an online product trial. The date at the top of the page always shows the current version.