Your employer (the Customer) is the Data Controller for the processing of your data under KVKK. OculaWork (Cimedya Bilgi Sistemleri Reklam ve Tic. A.Ş.) is the software provider acting as Data Processor on your employer's behalf, solely per their instructions.

• Protecting employee eye health and OSH risk assessment — under KVKK Art. 6/3, the legal ground determined by your employer (the data controller) for the specific purpose (explicit consent, or employment and OHS obligations, Art. 6/3-f). Art. 15 of OSH Law No. 6331 places a health-surveillance obligation on the employer; it does not by itself make camera-based measurement mandatory.
• Providing decision-support reports to your occupational physician
• Providing your management with anonymous, department-level aggregate statistics only (minimum 5-person groups)
• Developing a sector-wide statistical model ("OwO") using signals that contain no identity information or direct identifiers and have passed through privacy-enhancing techniques

The data above is transferred, for technical hosting/processing purposes, to the sub-processors OculaWork uses in its capacity as Data Processor (Google Firebase/Google Cloud infrastructure — data storage, authentication, hosting, backend processing; Resend — sending credential/notification emails). Transfer abroad: the Platform database is located in the United States (Google multi-region nam5) and backend processing runs in Belgium (europe-west1); email delivery (Resend) is processed in the USA. Your data is therefore transferred abroad within the scope of KVKK Art. 9. If your organisation has chosen the Enterprise deployment, the data stays on your organisation's own server. For the detailed sub-processor list and data location see the Terms, §6.3. Apart from these, your data is not shared with third parties unless your employer gives written approval or a competent court/administrative authority makes a duly issued request.

Scan data is retained during the active subscription and for 2 years thereafter (under our internal retention policy; statutory retention periods arising from applicable legislation are reserved). Closing your employee account does not by itself delete your scan data; to have it deleted, you submit a deletion request through your employer (see §06). Upon a deletion request, data is permanently destroyed within 30 days of the request date — except physician clinical notes: health-surveillance records created by the authorised occupational physician are kept within the retention periods prescribed by applicable OSH legislation; their integrity is preserved, they cannot be altered retroactively, and deletion requests are assessed subject to statutory retention obligations (see §02). OwO training samples (anonymous numeric vectors only) are deleted automatically once they are older than 180 days. For the detailed retention table see terms.html §7.2.

• Learn whether your data is processed, and request information if so
• Request correction of inaccurate data
• Request deletion where conditions are met — you submit your deletion request through your employer, as stated below. The "Delete Local Records" option in the app only removes records on your device; it does not delete your data in the system. Exception: clinical notes written by your occupational physician are exempt from this right to preserve the integrity of health-surveillance records (see §02, §04) — these notes are not altered or deleted upon any request.
• Object to a decision made solely by automated systems

You exercise these rights through your employer; requests are fulfilled within 30 days.