Your Data Rights (GDPR / KVKK)
Last updated: March 2026 · Platform operated by ORYGENT LAB · Barcelona, Spain
Who is responsible for your data?
ORYGENT LAB, S.L. (“OryGent”) acts as the Data Controller for personal data collected through the platform. For any data-related enquiry, contact our privacy team at privacy@orygent.com.
Your company may also act as a separate Data Controller for data processed within your workspace. In that case, your company's DPA with OryGent governs the relationship.
1. Right of Access (Art. 15 GDPR / KVKK Art. 11)
You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data along with information about how it is used, shared, and retained.
How to exercise: Submit a Data Subject Access Request selecting “Access — get a copy of my data”. We will respond within 30 days (72 hours for urgent requests).
2. Right to Rectification (Art. 16 GDPR / KVKK Art. 11)
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay.
How to exercise: Update your profile directly from the platform settings, or submit a DSAR selecting “Rectification — correct my data”.
3. Right to Erasure — “Right to be Forgotten” (Art. 17 GDPR / KVKK Art. 11)
You may request the deletion of your personal data when it is no longer necessary for the purpose it was collected, when you withdraw consent (where processing is based on consent), or when you object to processing and there are no overriding legitimate grounds.
Note: Some data may be retained to comply with legal obligations (e.g., financial records required by tax law) or to defend legal claims. We will inform you of any such retention.
How to exercise: Submit a DSAR selecting “Erasure — delete my data”. Account closure requests also trigger data erasure within 30 days.
4. Right to Restriction of Processing (Art. 18 GDPR)
You can request that we restrict the processing of your data in certain circumstances — for example, while we verify the accuracy of data you have contested, or while an objection is being assessed.
During restriction, we will only store your data and will not use it for any other purpose without your consent (except for legal claims or to protect the rights of another person).
How to exercise: Submit a DSAR selecting “Restriction — limit processing”.
5. Right to Data Portability (Art. 20 GDPR)
Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV), and to transmit it to another controller.
How to exercise: Submit a DSAR selecting “Portability — export my data”. You will receive a download link within 72 hours.
6. Right to Object (Art. 21 GDPR / KVKK Art. 11)
You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.
You also have an absolute right to object to your data being used for direct marketing at any time.
How to exercise: Submit a DSAR selecting “Objection — stop processing”, or contact privacy@orygent.com.
7. Rights Related to Automated Decision-Making (Art. 22 GDPR)
OryGent's digital coworkers produce recommendations and draft actions, but all restricted actions require human approval through our human approval governance chain. No binding decisions that significantly affect you are made solely by automated means.
If you believe an automated output has negatively affected you, you may request human review by submitting a DSAR selecting “Opt-out of automated decisions”.
8. KVKK — Turkish Data Protection Law
Turkish residents are protected by the Kişisel Verilerin Korunması Kanunu (KVKK, Law No. 6698). Your rights under KVKK largely mirror GDPR rights (Art. 11) and include: learning whether your data is processed, requesting information about the purposes and third-party transfers, requesting correction or deletion, and objecting to automated processing.
KVKK requests are processed through the same DSAR system. For KVKK Aydınlatma Metni, see our KVKK Disclosure Text.
9. Withdrawing Consent
Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal. Withdraw consent from the User Consents section of your settings.
Note: Withdrawing certain consents (e.g., required cookies or DPA consent) may limit your ability to use the platform.
10. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for OryGent (based in Barcelona, Spain) is:
Turkish residents may also contact the Kişisel Verileri Koruma Kurumu (KVKK Board) at www.kvkk.gov.tr.
Response timelines
- Standard DSAR: Response within 30 calendar days (extendable by 2 months for complex requests with notice).
- Platform DSAR (urgent): Acknowledged within 72 hours via the Data Subject Requests portal.
- Direct email: privacy@orygent.com — acknowledged within 2 business days.