Legal

Privacy Policy

Last updated: 27 September 2026

This Privacy Policy explains how RealWorks Teknoloji A.Ş. ("Pactwell", "we", "us" or "our") collects, uses, shares and protects personal data when you visit pactwell.co (the "Website") or contact us about Pactwell. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR, the Turkish Law on the Protection of Personal Data No. 6698 (KVKK) and other applicable data protection laws.

1. Who we are

The data controller for the Website is:

2. Scope — the Website, not your Pactwell deployment

Pactwell is on-premise legal AI software for in-house legal teams. It is installed and runs on our customers' own infrastructure. Contracts, documents, prompts and other content that customers process with Pactwell stay within the customer's environment and are not sent to us. Any processing of personal data in connection with a Pactwell deployment, support or professional services is governed by the written agreement (including any data processing agreement) between us and the customer, not by this Privacy Policy.

This Privacy Policy covers only the Website and business communications with us. It applies to website visitors and to people who contact us on behalf of their organisation.

3. Personal data we collect

We keep the personal data we collect to a minimum. The Website has no user accounts, no payments and no login.

3.1 Demo requests and other enquiries

The demo request form on the Website does not send data to our servers. When you submit it, it opens your own email client with a pre-filled message addressed to us, which you can review, change or discard before sending. If you send it (or email us directly), we receive:

• your name and work email address;
• your company, job title, the jurisdictions you are interested in and your legal team size, if you provide them;
• whether you would like our security and architecture brief;
• any other information you choose to include in your message, and the usual email metadata (such as date and time).

Please do not send us confidential contract content or sensitive personal data through the Website or by email.

3.2 Analytics — only with your consent

If you accept analytics cookies, we use Google Analytics 4 to understand how the Website is used in aggregate: pages viewed, time on page, referring site, approximate location (country/city, derived from a truncated IP address), device, browser and operating system. Google Analytics 4 does not log or store full IP addresses. We do not use advertising, remarketing or social media tracking, and we do not combine analytics data with the information you send us by email.

Until you consent, analytics cookies are not set. We use Google Consent Mode: while analytics consent is denied, Google may receive limited, cookieless signals (for example, that a page was loaded and that consent was denied) that do not contain an identifier for you or your device. You can change your choice at any time on the Cookie Settings page.

3.3 Technical data

Our hosting provider (Google Firebase Hosting) automatically processes technical data needed to deliver the Website securely, such as IP address, browser user agent, requested URL and time of request. Fonts, images and scripts for the Website are served from our own domain.

4. How we use personal data and our legal bases

• Responding to demo requests and enquiries, and preparing and discussing a possible business relationship — steps taken at your request prior to entering into a contract and our legitimate interest in running our business (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).
• Measuring and improving the Website with analytics — your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)), which you can withdraw at any time.
• Operating, securing and troubleshooting the Website — our legitimate interest in providing a secure website (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Complying with legal obligations and establishing, exercising or defending legal claims — legal obligation and legitimate interest (GDPR Art. 6(1)(c) and (f); KVKK Art. 5(2)(ç) and (e)).

We do not sell personal data, do not use it for automated decision-making that produces legal effects, and do not use it to train AI models.

5. Who we share personal data with

We share personal data only with service providers that process it on our behalf and under our instructions:

• Google (Firebase Hosting) — hosting and delivery of the Website;
• Google (Google Analytics) — website analytics, only if you consent;
• our email and productivity provider — receiving and storing the emails you send us.

We may also share personal data with companies in the RealWorks Global group where needed to respond to your enquiry, with professional advisers, or with authorities where required by law.

6. International data transfers

Our service providers may process personal data outside Turkiye, the European Economic Area or the United Kingdom, including in the United States. Where required, such transfers are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the EU–U.S. Data Privacy Framework where the recipient is certified, and the transfer mechanisms set out in Article 9 of the KVKK.

7. How long we keep personal data

• Enquiries and demo requests: up to 2 years after our last contact, unless a business relationship follows, in which case the retention terms of our agreement apply.
• Analytics data: up to 14 months, after which Google Analytics deletes user-level data.
• Your cookie choice: stored in your browser for 6 months, after which we ask again.
• Hosting logs: for the limited period set by our hosting provider for security and operational purposes.

When personal data is no longer needed, we delete or anonymise it.

8. Security

We protect personal data with appropriate technical and organisational measures, including encryption in transit (HTTPS with HSTS), access controls limited to people who need the data, and security headers on the Website.

9. Your rights

Depending on where you are, you have the right to:

• access your personal data and receive a copy of it;
• correct inaccurate or incomplete personal data;
• have your personal data deleted;
• restrict or object to processing, including processing based on our legitimate interests;
• data portability;
• withdraw your consent at any time (for analytics, on the Cookie Settings page), without affecting the lawfulness of processing before withdrawal;
• the other rights set out in Article 11 of the KVKK, including learning whether your data is processed, the purpose of processing and the third parties to whom it is transferred, and claiming compensation for damage arising from unlawful processing.

To exercise your rights, email apps@realworksglobal.com. We will respond within 30 days and may ask you to verify your identity first. If you are not satisfied with our response, you can complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), the data protection authority in your EU/EEA country of residence, or the UK Information Commissioner's Office.

10. Children

The Website and Pactwell are intended for businesses and legal professionals. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, display a prominent notice on the Website.

12. Contact

For questions about this Privacy Policy or our handling of personal data, contact RealWorks Teknoloji A.Ş. at apps@realworksglobal.com or at the postal address in section 1.