Privacy policy

1. Scope and operation

This policy covers heptapusgroup.com and subdomains operated by the same project. Heptapus Group is currently a project/brand without a separate corporate legal personality. External linked services have their own processing activities and policies.

2. Data collected and purposes

Data is collected electronically through forms, authorised administration and infrastructure/security operations. Do not submit passwords, payment details, health information or identity documents.

• Contact: name, email, subject and message, to assess and answer your enquiry.
• Newsletter: email, subscription status and, for new permissions, consent time and notice version; for separately requested newsletter messages.
• Recruitment: name, email, optional phone and covering message, for the vacancy applied for. The current application form does not upload a CV file.
• Administration: account, password hash, role, session validity and administrative audit events, for access security.
• Technical security: IP/connection, browser and error data may be processed by infrastructure providers. Rate-limit keys are hashed from IP/account information; hashing is not necessarily anonymisation.

3. Hosting and international processing

The application server is hosted by Hetzner in Finlandiya, Helsinki. Sending personal data from Türkiye to this infrastructure requires an international-transfer assessment. Database/backup locations stated by the operator: Almanya, Hamburg A Hetzner DPA or EU standard contractual clauses do not by themselves establish compliance with Turkish KVKK Article 9.

4. Other recipients

Cloudflare Turnstile loads when you start form security verification. YouTube loads only after external-media permission. These providers may receive IP, browser and interaction information and may process it outside Finland. Email providers, hosting/security contractors, authorised project personnel and, where required, public authorities or legal advisers may also receive data for the relevant purpose. No analytics/ad tracker or sale of personal data is implemented on this website.

5. Retention and deletion

Saklama süreleri bültene abone olunduktan sonra tekrar iptal başvurusu oluşturana kadardır, diğer başvurular için 1 senedir.

6. Choices and rights

Use the preferences button on each page to change cookie choices. Newsletter permission can be withdrawn at contact@heptapusgroup.com. The data protection notice describes processing grounds, international transfers and requests. This policy is not a substitute for collection-specific information or separate consent where required.

Published team profiles, images and CVs

Team profiles may publish a name, role, professional background, photo, social link and CV file. Website image/CV files are served through public URLs, not a confidential file-sharing channel. Published profiles/files can be indexed by search engines. The scope, processing/publication grounds and authority to share each person's information must be confirmed separately; this notice does not assume everyone has consented. Sending a CV for assessment is not permission for unrestricted web publication. Contact us for removal/correction; external search caches may require separate updates. Externally hosted images also connect the browser to their image provider, so that data flow is not necessarily limited to the application server in Finland.