This notice explains, under Turkish Personal Data Protection Law No. 6698 (KVKK), why your personal data is processed when you use the DEPOSAY app and website, who it is shared with, how long it is kept, and what rights you have.
1. Data Controller and Contact
The controller of the personal data covered by this notice is Deposay Yazılım, which operates the DEPOSAY inventory management application. You can reach the controller at deposayinfo@gmail.com.
2. Personal Data Processed
We process only the data needed to provide the service:
- Identity and contact: e-mail address, full name and company name.
- Stock and transaction data: product names, barcodes, stock quantities, warehouse details and scan records.
- Device and usage data: device model, operating system version, app version, session and sign-in records.
- Consent records: a record of when, under which version and by which method you accepted this notice.
3. Purposes of Processing and Legal Basis
Your data is processed to create and secure your account, to provide the inventory management service, to resolve faults and to monitor service quality. The legal basis is that processing is necessary for the conclusion or performance of a contract under KVKK art. 5/2-c and legitimate interest under KVKK art. 5/2-f.
Consent records are processed under KVKK art. 5/2-e because they are necessary for establishing and protecting a legal right, and they are retained even if your account is closed.
4. Where Data Is Stored and Transfer Abroad
Data is stored encrypted on the Google Firebase and Google Cloud servers we use for infrastructure. These servers are located outside Türkiye, so your data is transferred abroad within the meaning of KVKK art. 9.
Apart from this, your data is not shared with, sold or rented to third parties, except for legal obligations and requests from competent public authorities.
5. Retention Periods
Your account and stock data are kept for as long as your account is active. Audit logs are deleted automatically after 90 days. If your account is deleted, your stock and transaction data are deleted with it; only consent records continue to be retained, because of the obligation to prove consent.
6. Data Security
Data is encrypted in transit and on the server. Each company's data is visible only to that company's authorised users; access rights are enforced by server-side security rules. Administrator actions are written to the audit log.
7. Cookies
Our website uses cookies to maintain your session and to measure site traffic. Non-essential cookies run only with your consent; you can disable cookies at any time in your browser settings.
8. Your Rights Under the KVKK
Under KVKK art. 11 you may apply to the data controller to exercise the following rights:
- To learn whether your personal data is processed and, if so, to request information about it,
- To learn the purpose of processing and whether the data is used in line with that purpose,
- To know the third parties to whom the data is transferred, at home or abroad,
- To request correction of data processed incompletely or inaccurately,
- To request deletion or destruction of the data,
- To claim compensation if you suffer damage because of unlawful processing.
You can send your requests to the address below; your request will be answered within thirty days at the latest.
deposayinfo@gmail.com9. Changes
We may update this notice from time to time. Its effective date appears at the top of the page; for significant changes we will inform you through the app or by e-mail.