Privacy Policy
Last updated: May 7, 2026
At Marsala Yazılım A.Ş. ("C-LCA", "we") we take the privacy of your personal data seriously. This Privacy Policy explains what personal data we collect when you use the C-LCA platform, how we process it, and your rights under the Turkish Personal Data Protection Law No. 6698 (KVKK) and applicable EU GDPR rules.
1. Data Controller
The data controller is Marsala Yazılım A.Ş. (Tax No: 6121748678). Address: Bilişim Vadisi İzmir, Gülbahçe Mh., İçmeler Cad. No: 14/1 B05, Urla, İzmir, Türkiye. For requests under KVKK Art. 11 contact: [email protected].
2. Personal Data We Process
On account creation: full name, email, phone, company name, role. During platform use: session information (IP address, browser, device type), usage logs, preference settings (language, timezone, theme). For LCA studies: project data and calculation results uploaded by the user (product name, supplier information, etc.). Messages submitted via contact forms.
3. Purposes and Legal Bases
Your data is processed to provide C-LCA services, authenticate users, support customers, invoice, comply with legal obligations, develop the product, and (only with explicit consent) for marketing. Legal bases: contract performance, legal obligation, and legitimate interest.
4. Data Sharing
We do not share your personal data with third parties except as required by law. Our service providers (e.g. cloud infrastructure, email service, payment processor) only access the minimum data necessary to deliver the service and are bound by confidentiality. International data transfers are performed only under the conditions of KVKK Art. 9 and applicable EU adequacy decisions.
5. Retention
Your personal data is kept for as long as your account is active. After an account-deletion request, identity data is deleted or anonymised within 30 days. LCA project data is deleted or retained based on the customer's preference. Records subject to legal retention obligations (e.g. invoices) are kept for 10 years.
6. Data Security
Your data is protected with industry-standard encryption (TLS 1.3 in transit, AES-256 at rest). Access is restricted by role-based authorisation and multi-tenant workspace isolation. All database operations are written to an audit log. Regular backups and disaster-recovery plans are in place.
7. Cookies
The C-LCA website uses cookies. Details are in our Cookie Policy. Your cookie preference is asked on first visit and you can change it at any time.
8. Your Rights (KVKK Art. 11 / GDPR)
You have the right to (a) learn whether your personal data is processed, (b) request information about processing, (c) learn the purposes, (d) know the third parties to whom data has been transferred domestically/internationally, (e) request correction of incomplete or inaccurate data, (f) request erasure or destruction, (g) request notification of these actions to third parties, (h) object to results obtained against you through automated systems, and (i) request compensation for damages.
9. Data Subject Requests
To exercise your rights under KVKK Art. 11 / GDPR Art. 15-22, send a written request to [email protected]. Requests are answered free of charge within 30 days. If your request is not answered or the answer is insufficient, you have the right to file a complaint with the Turkish Data Protection Authority (KVKK Kurumu) or your local supervisory authority.
10. Policy Updates
This policy may change due to regulatory updates or service changes. Material changes are notified by email; minor updates are published on this page. The effective date is shown at the top.