Privacy Policy

1. Our roles

Autodidactic Technologies, which provides Visentry, may act as the controller for account, contact, and website data. For camera footage, person lists, and face templates submitted by an enterprise customer, the Customer generally acts as controller and Visentry as processor.

2. Categories of data

• Account and identity data: name, username, email, organization, role, and identity-provider identifiers.
• Security and usage data: session, IP address, browser/device information, access, activity, and audit logs.
• Customer Content: camera footage, event videos/photos, location, alert, and event data.
• Biometric processing data: numerical face templates derived from authorized reference images, together with match scores.
• Integration data: Ring account/device identifiers, authorization scope, event metadata, and recordings the user has permitted.
• Communication data: information submitted through demo, support, and commercial inquiries.

3. Purposes and legal bases

We process data to provide the service, authenticate users, enforce permissions, operate camera and alert workflows, secure and troubleshoot the platform, provide support, and meet legal obligations.

Depending on the data and relationship, the legal basis may be performance of a contract, legal obligation, legitimate interests, or consent where required. Biometric data must be processed only where applicable law provides a valid exception or valid explicit consent has been obtained.

4. Disclosure and transfers

Data may be shared only as necessary with authorized subprocessors that provide hosting, identity management, communications, monitoring, or support. User-connected services such as Ring are also governed by their own privacy terms.

We may disclose data where legally required, to protect rights, or to respond to a security incident. Appropriate safeguards are used for cross-border transfers where required by law.

5. Retention and security

Data is retained for the period required by its purpose, Customer configuration or contract, and legal obligations. The default retention period for administrative audit logs is 90 days and may be configured by an authorized administrator.

Safeguards include access controls, role-based authorization, encryption in transit, protected media access, encrypted integration tokens, and audit logging. No system can guarantee absolute security.

6. Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict, or object to processing and, where relevant, data portability. If camera or employee data belongs to a Customer organization, contact that organization first; we will assist it where required.

Send requests or privacy questions to info@autodidactic.com.tr. We may request additional information to verify your identity and the scope of the request.

7. International scope and representatives

Autodidactic Technologies is established in Türkiye. Where Article 3(2) GDPR or the extraterritorial scope of the UK GDPR applies and no relevant exemption is available, an EU/EEA representative and/or UK representative will be designated in writing before the regulated activity begins. The representative's identity, postal address, and electronic contact details will be published in this policy and the relevant Customer documentation.

This version does not list contact details for an appointed EU or UK representative and must not be treated as confirmation that an appointment has been completed. The territorial-scope assessment and any required appointment must be completed before targeted services or behavioral monitoring begin in the EU/EEA or United Kingdom.

8. Global framework and cross-border transfers

Direct processing in Türkiye is separately assessed under the KVKK; processing within EU/EEA scope under the GDPR; and processing within United Kingdom scope under the UK GDPR and Data Protection Act 2018. The language in which a notice is displayed does not itself determine the applicable law.

Where an EU/EEA transfer is made to a country without an adequacy decision, the parties use the applicable module of the EU Standard Contractual Clauses under Commission Implementing Decision 2021/914 together with the required transfer impact assessment and supplementary measures. Transfers from Türkiye use the applicable adequacy, appropriate-safeguard, or exceptional-transfer mechanism under Article 9 KVKK. Restricted UK transfers are assessed for use of the UK Addendum or IDTA.