KVKK Disclosure (Personal Data Protection)

This disclosure is made in the capacity of data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK") with respect to personal data processed in connection with the FireTrack ("Yangın Takip") service provided at yangintakip.com. The Turkish version of this text prevails in case of any discrepancy.

1. Data Controller

Data controller: FireTrack (Yangın Takip)
Contact: info@yangintakip.com — Istanbul, Turkey

2. Categories of Personal Data Processed

• Identity and contact data: name, e-mail, phone, company and title information (account holders and invited users).
• Account and authorization data: user role, tenant membership, password hash.
• Customer, site and asset records: personal data contained in the organization, site, location, equipment, maintenance, survey and quote records entered by service companies using the platform (e.g. contact person names and details).
• Transaction security data: IP address, sign-in records, activity logs, device/browser information.
• Cookie data: session and preference cookies (see the Cookie Policy).

3. Purposes of Processing

• Providing the service and performing the contract
• Authentication, account and authorization management
• Sending maintenance reminders, notification and report e-mails
• Ensuring information security, detecting errors and preventing abuse
• Complying with legal obligations and responding to legal requests

4. Legal Grounds

Personal data is processed under Article 5 of the KVKK based on:

• processing being directly related to the establishment or performance of a contract (Art. 5/2-c),
• compliance with a legal obligation (Art. 5/2-ç),
• our legitimate interests, provided your fundamental rights are not harmed (Art. 5/2-f) — e.g. security logs,
• your explicit consent where required (Art. 5/1).

5. Transfers

• Domestic: service data is hosted on servers (VPS, PostgreSQL) located in Turkey; the hosting provider acts as a data processor.
• Abroad: transactional e-mails are sent via Resend, a processor with servers located outside Turkey; only the data necessary to deliver the e-mail (recipient name, e-mail address, message content) is transferred, in accordance with Article 9 of the KVKK.
• Authorities: data may be transferred to competent public authorities where legally required.

6. Retention Periods

• Account and business records: for the duration of the contractual relationship and thereafter for the limitation/retention periods under applicable law (as a general rule up to 10 years).
• Transaction security (log/IP) records: for the periods required by applicable law (including obligations under Law No. 5651).
• Expired data is deleted, destroyed or anonymized.

7. Your Rights under Article 11 of the KVKK

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether data is used in line with that purpose
• To know the third parties to whom data is transferred, in Turkey or abroad
• To request correction of incomplete or inaccurate data
• To request deletion or destruction of data under Article 7 of the KVKK
• To request that corrections, deletions and destructions be notified to third-party recipients
• To object to a result arising against you from analysis performed exclusively by automated systems
• To claim compensation for damages caused by unlawful processing

8. How to Apply

You may submit requests regarding your rights to info@yangintakip.com in accordance with the Communiqué on Application Procedures to the Data Controller. Applications are concluded free of charge within 30 days at the latest; if the process requires an additional cost, the tariff set by the Personal Data Protection Board may apply.