Privacy Policy

For website enquiries, business correspondence, customer administration and billing, the data controller is:

HUBBLE GROUP MÜMESSILLIK IHRACAT VE ITHALAT DIS TICARET LIMITED SIRKETI

Registered office: Ataköy 7-8-9-10. Kısım Mah. Çobançeşme E-5 Yan Yol Cad. A Blok No:22/1/30, Bakırköy/İstanbul, Türkiye.

Email: office@hubblegroup.tr.

The treatment of personal data within customer workloads and datasets is explained separately in Section 5.

We collect personal data directly from you through website forms, email, telephone, meetings and contractual documentation. We may also receive business contact details from the organisation you represent. Technical information is collected automatically through website and service systems. Records may be processed electronically or in organised paper files.

Depending on your interaction with us, the data includes:

• Contact and professional details: name, company, job title, email address and telephone number.
• Enquiry information: requested GPU model, number of servers, rental term, annotation requirements, project details, messages and attachments you provide.
• Customer and transaction records: contractual contacts, billing details, relevant tax information, invoices, payment records and service usage records.
• Support information: correspondence and diagnostic information provided or generated when handling a service issue.
• Technical information: IP address, browser and device information, access records, visit timestamps and information associated with cookies or similar technologies.

Providing information needed to answer an enquiry or fulfil an order is necessary for that interaction. Without it, we may be unable to prepare a quotation, provide a service or resolve a request. Do not send passwords, private keys or unnecessary sensitive personal data through enquiry forms or ordinary email.

We process personal data for the following purposes, using the relevant conditions under Article 5 of KVKK:

Processing that requires consent must be based on a separate, specific choice. Any consent you have given to us may be withdrawn by contacting us. Withdrawal does not affect the lawfulness of earlier processing. Sending an enquiry or reading this policy is not consent to marketing or tracking.

We use the following services:

Our Zoho account uses the United States region. The inclusion of these services does not mean that they receive customer GPU workloads or annotation datasets. Information submitted through forms, email or CRM is handled separately from data hosted on customer servers.

We share relevant information with providers supporting website hosting, email delivery, IT infrastructure, accounting, legal advice and auditing, only to the extent needed for the relevant service. We also disclose information to authorised public institutions and courts where required by law.

Access by staff and contractors is limited to their responsibilities and is subject to confidentiality requirements. Providers processing personal data on our behalf must follow the applicable instructions and data-protection obligations. A recipient acting independently, such as a bank or an authority, is responsible for its own processing.

You may contact office@hubblegroup.tr for information about the recipients of your personal data, including recipients outside Türkiye. Customer-specific arrangements for providers processing customer datasets are addressed in the applicable service and data-processing terms.

Customers retain their rights in the data, models, code and datasets they provide. Where we handle personal data on a customer's behalf, we act as a processor under the customer's documented instructions. Where the customer is itself a processor, our role is that of a subprocessor.

Customer data is processed to provide the agreed service. For annotation projects, this includes access to the supplied material by personnel assigned to the annotation and quality-control work. For infrastructure services, access depends on the agreed service scope and support requirements. Providing computing capacity does not grant us an independent right to use customer content for unrelated purposes.

The customer is responsible for having the necessary authority and legal basis to provide the data and instruct its processing. Before providing sensitive datasets, customers should contact us to agree the required handling arrangements.

For data-processing terms and requests concerning a Data Processing Agreement (DPA), contact office@hubblegroup.tr. Where your personal data is held within a customer's dataset, direct your request to that customer first; we assist with requests relating to processing performed on its behalf.

Our GPU capacity is hosted at Equinix IL3 in İstanbul, Türkiye. Equinix operates the facility, including its building infrastructure, power, cooling and physical security. HUBBLE GROUP provides the contracted customer services. Hosting within an Equinix facility does not mean that Equinix operates every component of our services or that its certifications certify HUBBLE GROUP.

The location of GPU hardware does not establish the location of every business record, email, website log or support interaction. The applicable order identifies the location and scope of the customer's infrastructure service. Information about the processing locations relevant to your personal data can be requested from office@hubblegroup.tr.

Our Zoho account uses its United States region. Accordingly, data handled through that account is processed outside Türkiye. Customer server data hosted at Equinix IL3 and data handled through our business service providers must be considered separately when assessing data location.

Where processing involves a transfer outside Türkiye, that transfer must satisfy the applicable requirements of KVKK Article 9. This policy does not itself constitute consent to an international transfer or replace the required transfer arrangements. Details of the safeguards applicable to a particular transfer can be requested from us.

Retention depends on the purpose and type of record:

• Enquiries and correspondence: retained while we handle the request and any resulting business relationship, and afterwards only where needed for a legal obligation or the establishment, exercise or protection of a right.
• Contracts, invoices and payment records: retained for the periods required by the applicable commercial, accounting and tax rules. The period depends on the document category.
• Support and technical records: retained for resolving issues, protecting the service and investigating relevant incidents, with longer retention only where a legal obligation or specific legal claim requires it.
• Customer data: under our Terms of Service, customer data is made available for retrieval for 14 days following termination and is then securely deleted, subject to any applicable separate agreement and mandatory legal retention requirements.

When the grounds for retaining personal data no longer apply, it is deleted, destroyed or anonymised. Records that must be retained for a legal purpose remain restricted to that purpose.

Customers are responsible for maintaining their own backups under our Terms of Service. This policy does not create an additional backup service or recovery commitment.

Our technical and administrative measures include access controls, encryption in transit, network isolation, logging, physical protection of data-centre facilities and confidentiality obligations for staff and contractors. The measures applicable to an individual service depend on its scope and configuration. Customers remain responsible for the systems, applications, credentials and data-management tasks assigned to them under their agreement.

When a security incident affects personal data, we assess its scope, take appropriate containment and remediation steps, and provide notifications required by applicable law and the relevant customer agreement.

Privacy concerns, suspected data exposure and vulnerability reports may be sent to office@hubblegroup.tr. Include enough information to identify the affected service, but do not send passwords, private keys or unnecessary customer data. Reporting a vulnerability does not authorise access to other customers' information or disruptive testing.

The website uses necessary cookies and local storage for its operation and preferences such as language selection. Google Analytics is used to measure website activity, and Meta Pixel is used for advertising measurement and marketing. These tools can use cookies or similar technologies to record website interactions and associated identifiers, depending on their configuration.

Non-essential analytics and advertising tracking require a separate consent choice where applicable. Reading this policy, continuing to browse or submitting an enquiry does not provide that consent.

Browser settings allow you to restrict or remove cookies and site storage, although this does not undo information already transmitted to a provider. Browser controls do not replace our responsibility to obtain consent where required. Disabling necessary storage may affect site functions. For privacy questions or to withdraw consent previously given to us, contact office@hubblegroup.tr.

Under KVKK, you may ask whether your data is processed, obtain information about its use and recipients, seek correction or lawful deletion, request notification of those changes to recipients, challenge adverse results produced solely by automated analysis, and seek compensation for unlawful processing.

Contact office@hubblegroup.tr for assistance or submit a written request to our registered office. Formal requests should follow the applicable Communiqué on applications to data controllers. We may request information needed to verify your identity or authority. We respond as soon as possible and within 30 days at the latest; requests are normally free, subject to any fee permitted by the applicable rules.

If you consider our response inadequate, or receive no response, you may complain to the Turkish Personal Data Protection Board through the applicable procedure and within the statutory deadlines. Information is available from the Turkish Personal Data Protection Authority.

We may update this policy to reflect changes in our services, processing activities or legal requirements. The current version is published on this page. Changes do not remove the need to obtain consent where it is required for a new activity.

For questions about this policy or the handling of personal data, contact office@hubblegroup.tr.