Privacy Policy

01Who Controls Your Data

Cleo System operates through two legal entities. Which one controls your data is the entity you contract with or, failing a contract, the entity for your region:

• CLEO SYSTEM PTE. LTD. (UEN: 202610639M), 160 Robinson Road #14-04, Singapore Business Federation Center, 068914 Singapore, is the data controller for visitors and applicants in the APAC region.
• CLEO SYSTEM BİLİŞİM SİSTEMLERİ ANONİM ŞİRKETİ (Tax No: Üsküdar 2111478046), Acıbadem Mah. Derin Sk. A Blok No:25 A İç Kapı No:150, Üsküdar/İstanbul, Türkiye, is the data controller for visitors and applicants in the EMEA region.

If you're contacting us from the EU or EEA, GDPR applies to how your data is handled regardless of which entity technically operates the site.

02What We Collect

We only collect what's needed for the specific thing you're doing on the site:

The forms listed above are not yet live, and nothing entered in them is sent or stored today.

03Legal Basis for Processing

The three regimes that apply to us don't define "legal basis" identically, so we state ours per-regime rather than in one blended paragraph:

• Under GDPR: consent (for analytics, and for newsletter/marketing) or legitimate interest (for responding to your inquiry or application).
• Under PDPA (Singapore): consent, or the "reasonable purpose" exception where it applies to routine business communication.
• Under KVKK (Türkiye): explicit consent, or processing necessary for a contract or legitimate interest, as defined under Article 5.

04Retention

For analytics, Google Analytics is set to keep event data for 2 months and user-level data for 14 months. The cookies themselves last for the time given in our Cookie Policy. Everything else we keep only as long as the purpose it was collected for requires: an enquiry until it has been answered and any follow-up is finished, an application until the role is filled or the application is withdrawn, and a newsletter address until you unsubscribe. After that we delete it or make it anonymous, unless the law requires us to keep it longer.

05Third-Party Processors

We use a small number of processors to run the site. Vercel hosts it. Google Analytics measures how it is used, and only if you accept analytics. We do not use an email service provider yet; when we choose one, it will be named here before it is used.

06Cross-Border Transfer

Because we operate across Singapore and Türkiye, your data may be processed in a different country than the one you're in. Transfers of personal data between our two entities are governed by an intra-group data transfer agreement between them. Vercel and Google Analytics handle data under their own terms.

07How We Protect Your Data

We limit access to personal data to the people who need it for their work, and we keep it on systems that require a login. We choose providers that protect the data they hold for us. No way of storing or sending data is free of risk, so we do not promise that nothing can go wrong.

If personal data we hold is lost, or is accessed or disclosed without authority, we investigate and act to limit the harm. Where the law requires it, we notify the people affected and the regulator of the entity concerned: the Personal Data Protection Commission of Singapore, or the Personal Data Protection Board of Türkiye.

08Your Rights

You have rights over your own data — but exactly what those rights are depends on which regime applies to you:

• GDPR: access, correction, deletion, portability, and objection to processing.
• PDPA: access and correction, and the right to withdraw consent.
• KVKK: the right to learn whether your personal data is processed; to request information about the processing if it is; to learn the purpose of processing and whether your data is used in accordance with that purpose; to know the third parties in Türkiye or abroad to whom it has been transferred; to have incomplete or inaccurate data rectified; to have it deleted or destroyed where the conditions of Article 7 are met; to have third parties who received it notified of any rectification, deletion or destruction; to object to a result to your detriment arising solely from automated analysis; and to seek compensation where you suffer damage from unlawful processing.

If you accepted analytics, you can withdraw that at any time from Cookie Settings in the footer.

To exercise any of these, write to legal@cleosystem.com. The officers who read it are named under Contact & Data Protection Officer below.

09Careers Applications

If you apply for a role with us, your resume/CV and any information in your application is treated as a distinct, more sensitive category of data than a general site inquiry. It's used solely to evaluate you for the role applied for (or future roles, if you submit a general application), and is not shared with anyone outside our hiring process, other than the processors named above.

10Contact & Data Protection Officer

Each of our two entities has a Data Protection Officer:

• CLEO SYSTEM PTE. LTD. — Kerem Ersoy.
• CLEO SYSTEM BİLİŞİM SİSTEMLERİ ANONİM ŞİRKETİ — Murat Tipi.

Both can be reached at legal@cleosystem.com. Use that address for anything about your personal data: to ask what we hold about you, to have it corrected, to withdraw a consent, or to ask about this policy. It is the address for these requests; our general contact address is not.