Privacy Policy
Privacy and Personal Data Protection Policy
Last updated: 3 August 2026
1. Purpose and Scope
This Privacy and Personal Data Protection Policy explains how msCRO – Medical Statistic CRO processes personal data relating to individuals who visit mscro.com, use its contact or preliminary assessment forms, request information or services, or communicate with msCRO through digital channels.
This Policy applies to website visitors, investigators, authors, healthcare professionals, academic and corporate clients, sponsor and CRO representatives, business partners, suppliers and other individuals who interact with msCRO.
Clinical research data, study documentation and sensitive personal data processed within individual projects may also be governed by project agreements, data-processing arrangements, confidentiality commitments and project-specific privacy notices.
2. Data Controller
For the purposes of applicable personal data protection legislation, personal data may be processed by:
msCRO – Medical Statistic CRO
Website: mscro.com
Email: info@mscro.com
as the data controller within the scope described in this Policy.
Requests concerning personal data may be submitted through the contact details stated below.
3. Data Protection Principles
Personal data are processed in accordance with the principles of:
- lawfulness and fairness,
- accuracy and, where necessary, keeping data up to date,
- processing for specified, explicit and legitimate purposes,
- relevance, proportionality and data minimization,
- retention only for as long as required by applicable law or the purpose of processing.
Privacy, confidentiality, access control, secure storage and data minimization form the basis of msCRO’s personal data processing approach.
4. Categories of Personal Data
Depending on the nature of your relationship with msCRO, the following categories of personal data may be processed.
4.1. Identity and contact information
- name and surname,
- professional title and occupation,
- institution or organization,
- email address,
- telephone number,
- communication preferences.
4.2. Request and project information
- research or project subject,
- study type and objectives,
- requested services,
- project scope,
- intended deliverables,
- communication and meeting records,
- quotation, agreement and project correspondence.
4.3. Uploaded documents and files
- research protocols,
- datasets,
- analysis plans,
- manuscripts and scientific documents,
- ethics committee documentation,
- CRF/eCRF and data collection forms,
- other documents voluntarily submitted for project purposes.
Users should not upload directly identifiable health data or unnecessary personal information through general website forms. Project data should, wherever possible, be anonymized, pseudonymized or coded before being shared.
4.4. Technical and security data
- IP address,
- access date and time,
- browser and device information,
- operating system,
- pages visited,
- error and security logs,
- session and traffic information,
- cookie preferences.
4.5. Legal and commercial information
- quotations and contracts,
- billing and payment-related records,
- requests, complaints and applications,
- information required for legal and regulatory compliance.
5. Sensitive Personal Data
Health information and other sensitive personal data are processed only where necessary for a service or project and where a valid legal basis is available.
Additional safeguards may include:
- data minimization,
- anonymization, pseudonymization or coding,
- restricted access,
- secure transfer,
- access and activity logging,
- limited retention periods.
Directly identifiable patient or participant information should not be submitted through general contact or preliminary assessment forms.
6. Purposes of Processing
Personal data may be processed for the following purposes:
- responding to contact and information requests,
- conducting preliminary assessments,
- determining the scope of requested services,
- preparing and communicating quotations,
- establishing and performing agreements,
- managing client, investigator, sponsor and business-partner relationships,
- providing clinical research, biostatistics, data management, medical writing, publication development and related services,
- coordinating meetings, projects and deliverables,
- managing project files, documents and versions,
- conducting quality-control and service-development activities,
- maintaining information and transaction security,
- preventing unauthorized access, misuse and security incidents,
- performing accounting, billing and financial operations,
- complying with legal obligations,
- establishing, exercising or defending legal claims,
- maintaining legally required records and archives,
- conducting optional analytics based on user preferences.
Personal data are not used for purposes incompatible with those stated above.
7. Methods of Collection
Personal data may be collected through:
- website contact and preliminary assessment forms,
- file-upload fields,
- email,
- telephone and online meetings,
- quotation and contracting processes,
- project communication channels,
- documents provided by users,
- server, security and access logs,
- cookies and similar technologies.
Data may be collected through automated or partly automated means or, where part of a structured filing system, through non-automated means.
8. Legal Bases
Depending on the processing activity, personal data may be processed on one or more of the following legal bases:
- processing required by applicable law,
- processing necessary to enter into or perform a contract,
- processing required for compliance with a legal obligation,
- information made public by the data subject,
- processing necessary for the establishment, exercise or defence of legal claims,
- processing necessary for legitimate interests, provided that the fundamental rights and freedoms of the individual are not overridden,
- specific statutory grounds applicable to sensitive personal data,
- explicit consent where consent is legally required.
Consent is not required where another valid legal basis applies. Where processing relies on consent, consent may be withdrawn prospectively at any time.
9. Disclosure of Personal Data
Personal data may be disclosed, only where necessary and proportionate, to:
- authorized public institutions and authorities,
- courts and other competent bodies,
- accountants, legal advisers and independent auditors,
- hosting, server, email, file-storage, backup and IT service providers,
- cybersecurity and system-management providers,
- payment, accounting and financial-service providers,
- project experts subject to confidentiality obligations,
- sponsors, research organizations or business partners where disclosure is required for the relevant contract or project.
Before disclosure, the purpose, scope, recipient and required safeguards are assessed. Appropriate confidentiality and data-protection provisions are applied to service-provider relationships.
Personal data are not sold or made available to third parties for unlawful commercial use.
10. International Data Transfers
Where website hosting, corporate email, cloud storage, backup, cybersecurity, online meeting or analytics services are provided through entities located abroad or systems operating outside Türkiye, personal data may be transferred internationally.
International transfers are performed in accordance with applicable transfer provisions, valid transfer mechanisms and appropriate technical and organizational safeguards.
Where separate consent or additional notice is required, relevant information is provided before the transfer takes place.
11. Cookies and Similar Technologies
Strictly necessary cookies may be used to maintain website security and essential functions, including session management, language preferences and basic site operation.
Where optional analytics, performance, functionality or marketing cookies are used, they are activated according to the user’s cookie preferences.
Users may manage cookie preferences through the cookie-management interface or browser settings. Disabling certain cookies may affect the functionality of the website.
Further information concerning cookie categories, providers, purposes and retention periods is provided in the separate Cookie Policy.
12. Data Security
msCRO applies technical and organizational measures appropriate to the nature and risk of processing in order to:
- prevent unlawful processing,
- prevent unauthorized access,
- maintain secure storage and availability.
Depending on the circumstances, these measures may include:
- access restrictions and authorization controls,
- strong passwords and authentication measures,
- secure data transmission,
- current software and cybersecurity safeguards,
- backup and recovery procedures,
- confidentiality obligations,
- access and activity logging,
- staff and expert awareness,
- security incident assessment,
- data minimization and coding.
Although no electronic transmission or storage method can guarantee absolute security, reasonable and appropriate safeguards are regularly reviewed.
13. Retention and Disposal
Personal data are retained by considering:
- the duration required for the processing purpose,
- the term of the contractual relationship,
- statutory retention obligations,
- limitation periods and potential legal claims,
- tax and accounting requirements,
- project, quality and audit requirements.
When the processing purpose and applicable legal retention grounds cease to exist, data are deleted, destroyed or anonymized in accordance with applicable requirements and internal procedures.
Data stored in backup systems are restricted from operational use and deleted within applicable technical retention and backup cycles.
14. Data Subject Rights
Under applicable Turkish data protection legislation, individuals may have the right to:
- learn whether their personal data are being processed,
- request information about processing,
- learn the purposes of processing and whether data are used accordingly,
- learn the recipients to whom data have been disclosed,
- request correction of incomplete or inaccurate data,
- request deletion or destruction where legal conditions are met,
- request notification of correction, deletion or destruction to recipients,
- object to adverse results arising exclusively from automated processing,
- request compensation for damage caused by unlawful processing.
Where the GDPR applies, individuals may also have rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent.
15. How to Submit a Request
Requests concerning personal data may be submitted with sufficient information to verify identity and understand the request:
Email: info@mscro.com
Subject: Personal Data Request
The following information may assist in processing the request:
- name and surname,
- the nature of the request,
- information sufficient to identify the relevant transaction or relationship,
- preferred response method,
- supporting information or documents, where applicable.
Requests are evaluated within the procedures and time limits required by applicable law. Additional information may be requested to verify identity or authority.
16. Children’s Data
The website is generally intended for adults and professional users. Where children’s personal data must be processed within a research project, parental or legal-representative requirements, ethics committee requirements and applicable legislation are considered.
Directly identifiable data relating to children should not be submitted through general website forms.
17. Third-Party Links
The website may include links to third-party websites. The privacy practices of those websites are outside msCRO’s control and are governed by the relevant third parties’ own policies and terms.
Users should review the relevant privacy information before providing personal data to a third-party website.
18. Changes to this Policy
This Policy may be updated in response to changes in legislation, services, technology or processing activities.
The current version is published on this page together with its most recent update date. Where required by applicable law, additional notification methods may be used for material changes.
19. Contact
For questions concerning this Policy or the processing of personal data:
msCRO – Medical Statistic CRO
Website: mscro.com
Email: info@mscro.com