Privacy Policy

This Privacy Policy explains how personal data is handled when you visit the Pactinel website or use the Pactinel service. The company named in the Imprint is referred to as "Pactinel", "we" or "us". Because the company is established in Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK) applies alongside the GDPR, and this policy also serves as our information notice under KVKK Article 10.

1. Two roles

Controller. For data about our own customers and website visitors (accounts, billing relationship, support, security of our service, website use) Pactinel decides why and how the data is processed, so Pactinel is the controller. This policy describes that processing.

Processor. For the contract documents and data that customers put into their workspace ("Customer Data"), the customer is the controller and Pactinel is its processor. Pactinel processes Customer Data only on the customer's documented instructions, under the Data Processing Agreement. If you are a person named in a contract that a customer uploaded, please contact that customer first; we will help the customer respond to your request.

2. Data we process as controller

If you do not provide the data needed for an account, we cannot create it. We do not use your data for automated decisions that have legal or similarly significant effects on you. Where we rely on legitimate interests, they are running a secure, reliable and improving service, and you may object (section 9).

Free task owners, approvers and viewers invited to a workspace are known to us by their email address and name as entered by the customer who invited them.

3. Marketing

We send no newsletter and no onboarding email series. Account and security emails, task notifications and a daily digest are part of the service. Waitlist emails use double opt-in and every one contains a way to unsubscribe. We do not sell personal data.

4. Cookies and similar technologies

The marketing website is designed to work without cookies and uses cookieless, self-hosted analytics. The workspace uses cookies that are strictly necessary for sign-in and security. See the Cookie Policy.

5. Recipients

We share personal data only as needed:

• Paddle is our merchant of record and reseller. It collects and processes payment and billing data as an independent controller under its own privacy policy.
• Subprocessors and service providers that host or deliver the service for us, listed with their countries on the Subprocessors page. As of October 2026 the list covers our hosting in Germany, DNS and network protection, email delivery and, for customer documents processed with AI, a US-hosted AI inference provider. Where a provider has not been finalized, the Subprocessors page says so.
• Authorities and advisers where the law requires or to establish, exercise or defend legal claims.
• A successor in a merger or sale of our business, with the same protection for your data.

Within a workspace, other members can see your name, role and actions as the workspace's settings allow.

6. International transfers

Production data and backups are stored in the EU, in Germany. Some providers or support access may involve processing outside the EU or the UK; in particular, customer documents processed with AI are handled by a provider in the United States. For such transfers we use an adequacy decision where one exists, or the European Commission's Standard Contractual Clauses (and the UK addendum where needed), with additional safeguards such as data minimization, masking, encryption and zero-retention terms with the provider. You can request a copy of the safeguards through the contact page.

7. Retention

Specific periods for support messages and security logs are set in line with legal requirements and our needs, and are not longer than necessary.

8. Security

We protect personal data with the measures described on the Security page, including encryption in transit and at rest, tenant isolation, access control, audit logging and backups.

9. Your rights

Under the GDPR and the UK GDPR you have the rights to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time without affecting earlier processing. Under KVKK Article 11 you may also ask whether your data is processed and for information about it, its purposes and the recipients in Türkiye or abroad, and ask for correction, deletion or destruction, notification of those recipients, and compensation for damage caused by unlawful processing; we answer KVKK requests within thirty days at the latest (Article 13), and you may complain to the Personal Data Protection Board. Other laws, including California law (see the CCPA notice), give comparable rights. To use a right, use the contact page and choose the privacy category. We may ask you to verify your identity. We answer within one month, which can be extended where the law allows. You can also lodge a complaint with a data protection authority in your country of residence, place of work or the place of the alleged infringement.

10. Children

The service is for businesses and is not directed at children. We do not knowingly collect data from children.

11. Representatives and contact

The controller's identity and contact details, and the EU and UK representatives under Art. 27 GDPR and any data protection officer, are stated in the Imprint. You can also reach us through the contact page.

12. Changes

We will update this policy when our processing changes and show the date of the latest review. For material changes affecting customers, we notify workspace owners by email.