Privacy Policy

1. Who we are

SubGeoMap operates the SubGeoMap service ("SubGeoMap", "we", "us"). SubGeoMap is an AI-powered Ground Penetrating Radar (GPR) analysis service that processes survey data to detect, classify, and map buried utilities.

Our primary operations are based in Turkey. We are subject to the Turkish Law on the Protection of Personal Data (KVKK, Law No. 6698) and, where applicable to international clients, the EU General Data Protection Regulation (GDPR).

Data controller contact: info@subgeomap.com

2. What data we collect

2.1 Information you provide directly

• Name and job title
• Company or organisation name
• Email address
• Project description, site location, and scope details you include in your inquiry
• GPR survey files you upload or transfer to us (DZT, RD3, SGY, DT1, IDS, or other formats)
• RTK / GPS positioning data associated with your survey, if present
• Any supporting documents or notes you attach to a project submission

2.2 Information generated during processing

• AI detection results, confidence scores, and depth estimates produced from your survey files
• Annotated output files and georeferenced maps we create for your project
• Internal project notes and quality-review records

2.3 Information collected automatically

• Basic access logs (IP address, browser type, pages visited, timestamps) for security and performance monitoring
• No behavioural tracking, advertising pixels, or fingerprinting is used on this site

3. How we use your data

• Project delivery — to process your GPR files, produce annotated outputs, and deliver results to you
• Communication — to respond to your inquiry, provide project updates, and answer questions
• Service improvement — to review detection accuracy and, where data has been anonymised or aggregated, to improve our AI model and processing pipeline
• Legal and contractual obligations — to maintain records required by applicable law
• Security — to detect, investigate, and prevent unauthorised access or misuse

We do not use your data for advertising, profiling, or automated decision-making that produces legal effects on you.

4. Legal basis for processing

Under KVKK and GDPR, we rely on the following legal bases:

• Contract performance — processing your project data and delivering outputs is necessary to fulfil our service agreement with you
• Legitimate interests — maintaining security logs, improving service quality, and communicating about your project
• Legal obligation — retaining records as required by Turkish commercial and tax law
• Consent — where we separately ask for it (e.g. for optional communications); you may withdraw consent at any time by contacting us

5. How long we keep data

• Project files and results — retained for a reasonable period after project completion, determined by the nature of the project and our operational and legal requirements
• Contact and inquiry records — retained for as long as necessary for correspondence, dispute resolution, and business continuity purposes
• Access logs — retained for security and operational purposes at our discretion
• Legal and commercial records — retained for the period required or permitted by applicable Turkish law

You may contact us at info@subgeomap.com to request deletion of data that is not subject to a legal or operational retention requirement. We will consider such requests and respond where we are able to do so.

6. Security measures

We take the security of survey data seriously. Measures include:

• All file transfers use encrypted channels (TLS 1.2 or higher) — files are never sent or received over unencrypted email
• Project data is accessible only to the specific team members working on your project
• Storage systems use encryption at rest
• Access is controlled by role-based permissions and multi-factor authentication
• We do not store survey files on personal devices

No security system is infallible and we cannot guarantee absolute security. In the event of a confirmed breach materially affecting your data, we will endeavour to notify you in accordance with our obligations under applicable law. SubGeoMap accepts no liability for security incidents resulting from vulnerabilities in third-party infrastructure, client-side mishandling of credentials, or circumstances outside our reasonable control.

7. Who we share data with

We do not sell your data. We do not share your data with third parties for their own marketing or commercial purposes.

We may share data only in the following limited circumstances:

• Sub-processors — cloud infrastructure and file storage providers bound by data processing agreements with equivalent protections. A current list is available on request.
• Professional advisors — lawyers or accountants, under strict confidentiality obligations, where necessary for legal or financial matters
• Law enforcement or regulators — only when required by valid legal process and only to the extent required

If you are a survey firm submitting data on behalf of an end client, it is your responsibility to ensure your client is aware that their project data will be processed by SubGeoMap. Our Data Processing Agreement addresses the controller/processor relationship in this context.

8. International data transfers

Our primary processing infrastructure is located in Turkey. Where data is transferred to or accessed from outside Turkey, we rely on appropriate safeguards including standard contractual clauses or adequacy decisions where applicable.

EU/EEA clients: Turkey is not currently recognised as adequate by the European Commission. Where your data originates in the EU/EEA, we apply standard contractual clauses as required by GDPR Article 46. Contact us for a copy of the applicable transfer mechanism.

9. Your rights

You have the following rights regarding your personal data. To exercise any of them, contact info@subgeomap.com.

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Deletion — ask us to delete your data, subject to legal retention obligations
• Restriction — ask us to restrict processing while a dispute is resolved
• Portability — receive your data in a structured, machine-readable format (where technically feasible)
• Objection — object to processing based on legitimate interests
• Withdrawal of consent — where processing is based on consent, withdraw it at any time without affecting prior processing

We will endeavour to respond to requests within the timeframe required by applicable law. Some requests may require identity verification before we can act. We reserve the right to decline requests that are manifestly unfounded, repetitive, or would require disproportionate effort, in accordance with applicable law.

Turkish residents may apply to the Personal Data Protection Authority (KVKK) at kvkk.gov.tr. EU/EEA residents may also contact their local supervisory authority.

10. Cookies

This site uses only essential technical cookies necessary for the site to function (session state, security). We do not use advertising cookies, tracking pixels, or third-party analytics that collect personal data.

You can disable cookies in your browser settings. This may affect site functionality but will not affect your ability to submit an inquiry by email.

11. Changes to this policy

We may update this policy at any time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the service after a policy update constitutes acceptance of the revised terms. Where we consider a change to be material, we will endeavour to provide notice via the website or email, but we do not guarantee advance notice of any specific duration.

12. Contact

For any questions, requests, or concerns about how we handle your data:

SubGeoMap — SubGeoMap
Email: info@subgeomap.com
Primary operations: Turkey

We will respond to privacy-related enquiries as promptly as reasonably practicable.