Workgini Privacy Policy

This Privacy Policy explains how SİGMATOP BİLGİ TEKNOLOJİLERİ TİCARET LİMİTED ŞİRKETİ(“we”, “our”, “us”) processes personal data when providing Workgini, including its web and mobile applications, public websites, application programming interfaces (APIs), and related professional services (collectively, the “Services”).

The policy covers data collected directly from customers, users, website visitors, job applicants, and support contacts across the Services.

It does not apply to third-party products that integrate with Workgini; those parties provide their own privacy commitments.

Bu KVKK bölümü, sayfanın üst kısmındaki “Effective date” ile aynı tarihten itibaren geçerlidir.

Non-public information processed through Workgini is treated as confidential. We limit access to personnel with a documented need to perform their role, enforce least-privilege controls, and use Workspace content solely to provide or support the Services.

We disclose customer data only with your documented instructions, to comply with applicable law, or in response to valid legal requests. Where permitted, we provide advance notice and opportunity to challenge or narrow the request.

All employees and contractors are bound by written confidentiality agreements and complete security & privacy training.

Payment card transactions are processed by , a PCI DSS compliant payment gateway. We never store complete payment card numbers, CVV codes, or magnetic stripe data on Workgini systems.

Limited payment metadata is retained to reconcile billing, detect fraud, and satisfy accounting obligations. Fraud prevention activities are based on legitimate interest in protecting Workgini and its customers.

For Workspace content entered by customers and their users, we act as a data processor (service provider) under GDPR, UK GDPR, and CPRA/CCPA. Customers remain data controllers responsible for determining lawful purposes and configuring sharing permissions.

For our public websites, security logs, billing records, marketing insights, and internal business operations, we act as an independent data controller.

We do not sell or share personal information as defined by the California Consumer Privacy Act (as amended by the CPRA). We do not use or disclose Sensitive Personal Information for purposes other than those permitted by CPRA. We honor Global Privacy Control (GPC) signals where applicable. California residents can exercise the following rights by contacting contact@workgini.com:

• Right to know, access, and receive a copy of specific pieces of personal information.
• Right to deletion (subject to statutory exceptions).
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information (we do not sell or share personal information as defined by CPRA/CCPA).
• Right to non-discrimination for exercising privacy rights.

Requests are verified using existing account credentials or reasonable additional information.

Workgini operates globally. Where personal data is transferred outside the EU, UK, or Türkiye, we rely on the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), and documented transfer impact assessments to evaluate destination laws and implement supplementary safeguards.

Additional safeguards include encryption in transit and at rest, strict access controls, and routine reviews of subprocessor compliance.

Türkiye’deki veri sorumlusu olarak, yurt dışına aktarımlarda KVKK m.9 kapsamındaki mekanizmaları (yeterlilik kararı, Kurul’un yayımladığı standart sözleşmeler veya istisnalar) uygular ve teknik/idari ek önlemler alırız. EEA/UK’den erişim veya aktarımlar için, Avrupa Komisyonu’nun Standart Sözleşme Maddeleri (SCC) ve/veya UK IDTA/Addendum ile destekleyici güvenlik önlemlerini uygular, aktarım etki değerlendirmelerini (TIA) muhafaza ederiz.

We encrypt data in transit (TLS 1.2+) and at rest. Authentication credentials are hashed using bcrypt via Supabase. Role-based access controls, row-level security policies, audit logging, secure software development practices, and regular penetration testing help protect the platform.

Detailed security controls and reports are available on our Security Page.

Workspace content is retained for the life of the customer agreement unless deletion is requested or required by contract. Diagnostic logs are retained for 30 days for security and reliability, unless law or active investigations mandate a longer retention window.

Business records such as invoices or tax documentation may be stored for statutory periods. When a deletion request is validated, we complete purge operations within 30 days (unless retention is required by law or to resolve disputes). Backups are purged on a rolling schedule (typically within 30–90 days).

We use essential cookies to maintain sessions, secure access, and remember preferences. In Türkiye (KVKK) and where required elsewhere, we obtain explicit consent before setting analytics or marketing cookies. You can change your preferences any time via the cookie manager.

You may request access to, or export of, your personal data in CSV or JSON format, ask us to correct inaccuracies, request deletion (completed within 30 days unless law requires longer retention), or object to certain processing (including marketing communications).

To exercise these rights, contact contact@workgini.com. We will respond within the timelines required by applicable law and may ask for additional verification information.

Workgini is not directed to children under 16. For users in the United States, our Services are not directed to children under 13 (COPPA). We do not knowingly collect personal data from children without verifiable parental or guardian consent. If you believe a child has provided personal data, contact contact@workgini.com to request deletion.

We maintain an incident response plan aligned with industry best practices. Suspected vulnerabilities can be reported in good faith to contact@workgini.com. We investigate all credible reports promptly.

If a breach affects personal data, we notify impacted customers and regulators without undue delay, consistent with applicable law and contractual obligations.

We review this policy periodically and update it as practices evolve. Significant changes are communicated via in-app notifications, email to administrators, or prominent notices on our website before they take effect.

Continued use of Workgini after an update signifies acceptance of the revised policy.