KVKK Disclosure

Version v7 — effective 14 October 2026

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and describes how personal data is processed within the Yangın Takip (FireTrack) service offered at yangintakip.com.

1. Identity of the Data Controller

Legal name	DEVİCEYE YAZILIM MEDİKAL TEKNOLOJİLER ANONİM ŞİRKETİ
MERSIS No	6141747247 00001
Trade registry	İstanbul Ticaret Odası — Sicil No: 773212-0
Address	Çiftehavuzlar Mah. Eski Londra Asfaltı Cad. No: 151/1F, D2 Blok, 106, 34220 Esenler / İstanbul / Türkiye
Phone	0850 420 37 38 · 0545 423 79 31
Data protection contact	kvkk@deviceye.com

Which data this notice covers

The service is used by fire safety companies to track their own customers and equipment, so there are two distinct relationships:

Data for which we are the controller: identity, contact, session and billing data of account holders and users. This notice describes that data.
Data for which the subscribing company is the controller: the customer, site, contact person and field records that the company enters itself. For those records we act as a data processor; informing the individuals and obtaining any required consent is the subscribing company's obligation. We do not access that data other than on instruction.

2. Categories of Personal Data Processed

The categories below are derived from the application's data model; no personal data field outside this list is stored.

Category	Data included
Identity and contact	Full name, e-mail address, phone number, profile image; contact person name, phone and e-mail on customer and site records; name, title and certificate number of training participants.
Account and authorisation	User role and tenant membership, password hash, two-factor preference, last sign-in time, interface language, timestamp of terms acceptance.
Financial and transactional	Tax number and tax office (for sole traders this field may hold a national ID number), invoice number and ETTN, invoice lines and amounts, account ledger entries, cheque and promissory note records, quote and contract amounts.
Location	Site address and the latitude/longitude resolved from it; the coordinates recorded when a periodic inspection or site visit record is submitted; while the mobile app is open, the location of field staff (latitude, longitude, accuracy, heading, speed and time) so that company managers can see the team in the field.
Visual and audio	Equipment and site photographs taken in the field, signature images attached to inspection records, uploaded documents; audio recordings made with the mobile voice assistant and their transcribed text. These files are stored in object storage (MinIO).
Security	IP address and browser information (in the audit trail), session and refresh tokens, trusted device records, one-time verification codes, mobile push token with device name and platform.

No special categories of personal data (health, biometrics, religion, union membership and similar) are collected or processed. Please do not enter such data into free-text fields.

3. Purposes and Legal Grounds

Purpose	Legal ground (KVKK Art. 5)
Creating the account, authentication, authorisation and providing the service	Necessary for the performance of a contract — Art. 5/2-(c)
Invoicing the subscription and keeping accounting records	Compliance with a legal obligation — Art. 5/2-(ç)
Keeping and reporting equipment, maintenance and inspection records	Performance of a contract — Art. 5/2-(c); legitimate interest in evidentiary needs arising from regulation — Art. 5/2-(f)
Account security, prevention of misuse and keeping the audit trail	Legitimate interest — Art. 5/2-(f)
Handling support requests and service-related e-mails	Performance of a contract — Art. 5/2-(c)
Sending commercial electronic messages for marketing	Explicit consent — Art. 5/1. Withholding consent does not prevent you from using the service; see the Explicit Consent Notice.
Transfers to service providers abroad (section 5)	Explicit consent — Art. 9/1

4. Methods of Collection

Sign-up and invitation forms and the data entry screens inside the application (web and mobile).
QR scanning, photo capture and signature collection performed in the field through the mobile app.
Bulk uploads by the subscribing company via Excel/CSV import.
Technical records generated automatically during sign-in and use (audit trail, security tokens).
Contact and demo request forms on yangintakip.com.

Cookies and similar technologies are covered by the Cookie Policy.

5. Transfers

Within Türkiye

Data is hosted on servers located in Türkiye. Domestic transfer is limited to lawful requests from competent public authorities and to our hosting provider below. Your data is never sold or shared with third parties for advertising.

Provider	Location	Data processed	Purpose
Netgsm	Turkey (domestic)	The recipient’s phone number and the text of the short message sent (service company name, site name, date and a short status text)	Sending maintenance, appointment and document delivery notifications by SMS
Güzel Hosting	Turkey (domestic)	Recipient name and e-mail address, message body and attachments (invoice and report PDFs)	E-mail delivery and mailbox hosting

Abroad

Transfers are made to the providers below only, limited to the stated data and purposes, and based on your explicit consent (KVKK Art. 9):

Recipient	Country	Data transferred	Purpose
OpenStreetMap Foundation (OSMF)	United Kingdom / EU	For geocoding, the site address text (no person name is sent); for map display, the IP address and browser information of the person viewing the map and the map area being viewed	Resolving an address into map coordinates and displaying the map
Meta Platforms Ireland Ltd. (WhatsApp Business)	Ireland / United States	In two separate flows: (1) for notifications, the recipient’s phone number and template variables (service company name, site name, date and a short status text); (2) for visitors who click the WhatsApp contact button on the site, their IP address and browser information together with the message they write themselves. Reports and invoices, photographs, equipment/inventory lists and location data are not transferred.	Sending maintenance, appointment and document delivery notifications over WhatsApp, and enabling visitors to get in touch over WhatsApp
Expo	United States	Mobile push token, platform and device name	Delivering push notifications to the mobile app
Anthropic PBC (Claude)	United States	The transcribed text of a note recorded with the mobile voice assistant, together with the company record names needed to match the action (equipment, site, stock item). The audio recording itself is not transferred; transcription is done on Yangın Takip servers.	Extracting suggested actions from a voice note (suggestions are submitted for approval by an authorized person before being recorded)

This list was verified against the running code; no transfer is made to any provider outside it. If the list changes, this notice is updated and its version is incremented.

Notification messages (SMS and WhatsApp)

Maintenance, appointment and document delivery notifications are sent from a single YangınTakip account on behalf of the company providing the service; that company’s name appears in the message. No separate registration or application is required from the company you receive service from.

Only the message itself goes to the WhatsApp channel: the phone number and the template variables (company name, site name, date and a short status text). Reports and invoices, photographs, equipment and inventory lists and location data are never transferred to this channel.

6. Retention and Erasure

Record type	Retention period	Basis
Invoice and accounting records	10 years	Statutory retention under Turkish tax and commercial law
Customer and supplier account records	10 years after the relationship ends	Contractual limitation period
Equipment, maintenance and periodic inspection records	5 years	Evidentiary obligation under fire safety regulation
Photographs and signature images	5 years	Same period as the inspection record they belong to
Waiting period after a personal account deletion request	30 days	The request can be cancelled during this period; when it expires personal data is erased and person references are anonymised
Undo window after a workspace (tenant) deletion	7 days	Undo window against accidental deletion; data is erased when it expires
Audit trail	2 years	Accountability principle
Audit trail of permission and account events	5 years	Retrospective investigation of security events

See the Data Retention and Erasure Policy for details.

If a data breach occurs

If we learn that your data has been unlawfully obtained by others, we notify the Personal Data Protection Board as soon as possible and in any case within 72 hours (KVKK Art. 12(5) and the Board's decision). We also inform affected people as soon as possible once they are identified, by e-mail or, where that is not possible, by a notice on our website. The notice explains what happened, which data was affected, the likely consequences and the measures we have taken.

If a breach affects data a subscriber company has entered into the system, we inform that company without delay; as the data controller for that data, the subscriber notifies the Board and the people concerned, and we provide the information it needs to do so.

7. Your Rights under Article 11 of the KVKK

To learn whether your personal data is processed,
To request information if it has been processed,
To learn the purpose of processing and whether it is used accordingly,
To know the third parties to whom it is transferred, domestically or abroad,
To request correction of incomplete or inaccurate data and notification of that correction to third parties,
To request erasure or destruction within the conditions of the law,
To object to an adverse outcome arising from automated analysis,
To claim compensation for damage caused by unlawful processing.

8. How to Apply

Send your request by e-mail to kvkk@deviceye.com or in writing to the postal address above. Your application must contain information identifying you and state your request clearly. Applications are answered within 30 days at the latest; where the request requires additional cost, the fee set by the Board may apply.

For records entered by a subscribing company, the request should be directed to that company; if it reaches us, we forward it and inform you.

9. Updates

This notice is versioned. The current version is v7, effective 14 October 2026. On a material change the version is incremented and registered users are informed.