DRAFT – will be finalised once the company details are completed and a final check is made. Fields in square brackets will be filled in after the company is registered. This is an English translation of the Turkish policy; in case of any difference, the Turkish text prevails.

Last updated: 17 October 2026

This notice explains how your personal data is processed when you use the NTB SpecPro website (ntbspecpro.com) and the NTB SpecPro Android application (the “App”), under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”).

1. Controller

NTB SpecPro Mühendislik Yazılım Sanayi ve Ticaret Limited Şirketi Address: Ankara, Türkiye (the full address will be added once company registration is complete) Tax office / number: Etimesgut V.D. / 6321606171 MERSİS number: will be added once company registration is complete E-mail: info@ntbspecpro.com Representative in the EU (GDPR Art. 27): [will be appointed before sales in the EU start]

2. Our basic principle: your data stays on your device

The inspection, measurement, photo, document check, report and archive functions of the App work entirely on your device, offline. Your weld photos, inspection records, reports and documents are not sent to us or to third parties; they are stored only on your device. We cannot see this data unless you share it.

There are five exceptions, and each of them happens only through your own action or with your consent:

• Quality management modules (AS9100, NADCAP, ISO 3834, EYDEP): The text of the documents you upload is extracted on your device and sent, together with the document name and your company profile selections, to our server (Google Cloud, European Union – Belgium region) for evaluation. Once the evaluation is complete this data is not kept on the server; document images are not sent.
• Export to ERP: If you export an inspection record or a PDF report to ERP, the record and the PDF are stored in your company’s ERP area (Google Firebase). Only your company’s authorised users can see them; we access them only at your support request or where required by law.
• ERP AI assistant (optional, off by default): If your company’s ERP administrator switches it on by ticking the consent box, then when a question is asked, a summary of the relevant ERP records and the scanned customer order PDF are sent to Anthropic PBC (USA) to generate the answer. Anthropic processes this data solely to generate answers on our behalf and does not use it to train its own models; this content is not stored on our servers. Corrections that users make to drafts are kept only in your company’s own ERP area and are not shared with other companies. Before switching on the assistant, it is the company’s responsibility to check that the documents to be sent do not contain information that cannot leave the country for export-control, confidentiality or customer-contract reasons. On NTB-ERP-Server, which runs on the company’s own server, this transfer happens only with the “difficult question support” switched on by the administrator and with the user’s separate approval for each transfer; while support is off, no data leaves the company network. In the NTB-ERP standard package the ERP records stay on the company’s own computer; with a one-time approval by the administrator, each AI request (a document or a question plus a short ERP summary, with personal names replaced by role names) is sent to our central AI. The central AI currently runs on Anthropic (USA) infrastructure; if it is later moved to our own server in Türkiye or in the EU, you will be notified. In the on-premises package no data leaves the company. The assistant can be switched off at any time.
• App and web AI helper (optional, off by default): If you give separate consent to switch on the AI features, report text, document text in the Quality management modules (AS9100, ISO 3834, EYDEP) and, in photo-based reviews (welding, microstructure, paint, coating, bonding, quality control, etc.), the photo for which you request a “Second opinion” are sent to Anthropic PBC (USA) to generate the answer. A photo is sent only when you press the “Second opinion” button each time, and only that photo is sent; no other photo is sent. Please make sure the photo contains no person’s face, part number or customer information; send images received from a laboratory or your customer only if you have the right to share them. Anthropic processes this data solely to generate answers on our behalf and does not use it to train its own models; the content is not stored on our servers. You can withdraw your consent at any time from the Profile screen on the phone or from About › Settings in the web app. Do not send information that is subject to export control, classified, or prohibited from leaving the country under a customer contract through these features.
• Technical question and Expert evaluation: The photos and documents you attach to your request are uploaded to our server and used only to answer your request.

Customer photos, documents and request attachments are not used to train AI models. The only exception is the “Improve the weld model” permission (off by default) that your company may give separately and optionally in ERP Settings. With this permission, only the weld photo corrected by your engineer (cropped to the seam area where possible) and the defect marks are sent to us. Part numbers, names, drawings, work orders and the company name are not sent. This data is used only to train our own weld model; it is not shared with third parties or external AI services. If a person is visible in a photo, it is excluded from training. Unused samples are deleted when the permission is withdrawn, and used samples at the latest after 3 years. Models already trained are not affected.

Apart from these, our servers process only the limited data listed below, which is needed for your account and membership to work.

3. Personal data processed, purposes and legal bases

We do not collect special categories of personal data (health, biometric, etc.).

Important: When sending a technical question or support request, do not send confidential, export-controlled or trade-secret information and images belonging to your employer or your customer. Obtaining the permissions needed to share such content is the user’s responsibility.

4. Recipients of the data

Your data is not sold. It is shared only to the extent needed to provide the service, with the following parties:

• Google Firebase (Google LLC / Google Ireland Ltd.) – account and licence infrastructure. Servers may be located abroad.
• Payment providers – iyzico, PayTR (Türkiye); Paddle or Lemon Squeezy (international sales); Google Play (in-app payment for Technical questions).
• E-mail and hosting services – Turhost (website hosting and the info@ntbspecpro.com e-mail service; servers in Türkiye).
• Google Analytics (Google LLC, USA / Google Ireland Ltd.) – only if you consent to analytics cookies; for measuring site usage, as a processor. Ad personalisation and Google signals are switched off; the data is not used for advertising.
• WhatsApp (Meta) – only if you choose WhatsApp for support.
• Anthropic PBC (USA) – only if you consent to the AI features or your company consents to the ERP AI assistant; as a processor.
• Accountant and competent public authorities – as required by legal obligations.

5. International transfers

Services such as Firebase, Google Analytics (only if you consent), Paddle, Google Play and (only if switched on) Anthropic may process your data on servers abroad. Under KVKK Art. 9 these transfers are made by signing the standard contract published by the Turkish Personal Data Protection Board with the service providers and notifying the Board within 5 working days of signature. For users in the EU, transfers rely on GDPR-compliant safeguards (the EU-US Data Privacy Framework and the European Commission’s Standard Contractual Clauses).

6. Retention periods

7. Security

Data is transmitted over encrypted connections (HTTPS/TLS). Passwords are not stored in plain text. Access is limited to authorised persons only.

8. Your rights (KVKK Art. 11, GDPR Art. 15-22)

You have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to know the recipients, to request correction, deletion or destruction of incomplete or incorrect data, to request that these actions be notified to recipients, to object to a result against you arising from automated analysis, and to claim compensation if you suffer damage. Users in the EU also have the rights to data portability and to object to processing, the right to restriction of processing, and the right to lodge a complaint with the supervisory authority in their country. Where processing is based on consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

How to apply: Send an e-mail with the subject “Data protection request” from your registered e-mail address to info@ntbspecpro.com, or apply via Registered Electronic Mail (KEP) or with a secure electronic signature. The postal address for written applications will be added once company registration is complete. Your request is answered free of charge within 30 days at the latest. If your request is rejected or you find the answer insufficient, you may lodge a complaint with the Turkish Personal Data Protection Board (or, in the EU, with your local supervisory authority).

To delete your account: see the Account deletion page (in Turkish).

9. Cookies

Our site uses strictly necessary cookies to operate. The visit count is kept only as a daily total, without identifying data or cookies. Analytics or marketing cookies are used only if you consent in the cookie banner, and you can withdraw your consent at any time. Cookies and records used: the browser record that stores your cookie choice (ntb_cerez), the browser record that prevents you being counted twice on the same day for the daily visit count (ntb_ziyaret; contains no identifying data; deleted when the tab closes if you have not consented to cookies), WordPress administrator session cookies (only when the site administrator signs in), and the Firebase authentication record that keeps your session on the Account page. If you consent, Google Analytics cookies (_ga, _ga_<id>; at most 14 months) are used. They are for measurement only; ad personalisation is switched off. You can withdraw your consent at any time via the “Cookie settings” link at the bottom of the page. No third-party advertising or marketing cookies are used.

10. Children

Our services are intended for professional users; persons under 18 are not allowed to open an account.

11. Changes

This notice may be updated. Significant changes are announced on the site and in the app. The current text is always available on this page.