Personal Data Protection and Processing Policy

According to Article 20 of the Constitution of the Republic of Turkey, everyone has the right to request the protection of their personal data. This right includes being informed, accessing data, requesting correction or deletion, and learning whether data is used for its intended purpose.

The Personal Data Protection Law No. 6698 (“KVKK”) was enacted on 07.04.2016 to protect individuals’ fundamental rights and freedoms and to regulate the obligations of persons and institutions that process personal data. Where applicable, we also observe the EU General Data Protection Regulation (GDPR).

Lavoisier Labs (“Company”) collects, processes, stores, and protects personal data in accordance with KVKK and other applicable legal regulations. This policy ensures transparency in fulfilling our personal-data obligations.

• Explicit Consent — a freely given, informed, and specific declaration of approval regarding a particular subject.
• Personal Data — any information relating to an identified or identifiable natural person.
• Sensitive Personal Data — data relating to race, ethnic origin, political opinions, religious beliefs, sect, health, sexual life, and similar categories defined by law.
• Data Subject — a natural person whose personal data is processed.
• Data Controller — the person who determines the purposes and means of processing and manages the data recording system (Lavoisier Labs).
• Data Processor — a person who processes personal data on behalf of the controller.
• Processing — collection, recording, storage, alteration, disclosure, transfer, classification, or prevention of use, whether automated or not.

• Compliance with the law and principles of honesty
• Accuracy and keeping data up to date where necessary
• Processing for specified, explicit, and legitimate purposes
• Processing in a manner that is relevant, limited, and proportionate
• Retention for the period required by law or necessary for the processing purpose

As per Article 5 of KVKK, personal data cannot be processed without the explicit consent of the data subject, except where:

• Explicitly required by law
• Necessary to protect life or physical integrity where consent cannot be obtained
• Directly related to the establishment or performance of a contract
• Necessary to fulfil a legal obligation
• Made public by the data subject
• Necessary for the establishment, exercise, or protection of a legal right
• Necessary for the legitimate interests of the data controller, provided fundamental rights are not violated

Sensitive personal data may only be processed under the conditions specified by law and with necessary administrative and technical measures. We do not currently process sensitive personal data such as health information via this website. If such processing becomes necessary, additional security measures will be implemented and data subjects will be informed.

Name, surname

Identification and communication

Work email, company, role

Demo / contact fulfilment

Industry, message, tools

Qualify and respond to requests

Newsletter email

Product updates (with consent)

IP address, user agent

Security, abuse prevention, logs

Cookie / consent preferences

Remember choices; optional analytics

The Company takes appropriate technical and administrative measures to prevent unauthorized access, disclosure, loss, or damage, including:

• Access controls and least-privilege roles
• Encryption in transit (TLS) and at rest where applicable
• Logging systems
• Network and application firewalls / edge protections
• Limiting access to authorized personnel only

See also our Security & Data Handling page.

Personal data is deleted, destroyed, or anonymized when the processing purpose no longer applies or when the legal retention period expires. Newsletter addresses are retained until you unsubscribe or request deletion. Contact submissions are kept for the duration of an active conversation and a reasonable follow-up period.

Personal data may be transferred to processors (for example hosting, email, or analytics providers) within or outside the country in compliance with KVKK Articles 8 and 9 and GDPR Chapter V, with appropriate safeguards. Where tools are hosted outside Türkiye / the EEA, we apply contractual and technical safeguards. Details of subprocessors are available on request.

According to Article 11 of KVKK (and analogous GDPR rights), you may:

• Learn whether your personal data is being processed
• Request information if it has been processed
• Learn the purpose and whether use matches that purpose
• Know third parties to whom data is transferred
• Request correction of incomplete or incorrect data
• Request deletion or destruction
• Request notification of rectification or deletion to recipients
• Object to adverse outcomes from solely automated processing
• Demand compensation for unlawful processing damage

Submit requests to privacy@lavoisierlabs.com. We respond within the periods required by applicable law.

This Policy is effective from the date of publication and is made publicly available on this website. The Company may update it as needed; the updated version will be published here with a revised “Last updated” date.

• Company: Lavoisier Labs
• Privacy email: privacy@lavoisierlabs.com
• General: hello@lavoisierlabs.com