Privacy & Data Protection Notice

Data controller

This notice explains how personal data of individuals who visit and use the Kolekto platform ("Platform") is processed under Law No. 6698 on the Protection of Personal Data ("KVKK"). Data controller: KOLEKTO TEKNOLOJİ ANONİM ŞİRKETİ (MERSİS: 0575108963000001, Tax ID: 5751089630), Gülbahçe Mah. Gülbahçe Cad. Kuluçka Merkezi Binası No: 1/45 İç Kapı No: 21 Urla / İzmir, Türkiye. Contact: info@kolekto.com.tr. The Platform serves two distinct roles. For website visitors, contact-form submissions and account holders, the data controller is Kolekto. For employee, customer and business data that organizations enter into the Platform, the data controller is the relevant organization; Kolekto processes this data as a data processor, on the organization's instructions and under its agreement with the organization. Employees of an organization should first direct any request about their own data to their organization; Kolekto supports the organization in fulfilling such requests.

Data we process

Via the contact form: full name, email address, phone number and optional company name. Within the platform: account details, session records (IP address, browser info) and employee records entered by the employer. Depending on the modules your organization uses, we also process: the time, IP address and browser information recorded when you acknowledge an announcement; the work phone, extension, company mobile, work email, photo and location taken from your employer's HR record for the company directory; tasks and notes in your personal calendar, visible only to you; shared space booking records; and the discount code assigned to you. No data is kept about who used a discount. The Platform uses only the cookie required to keep a session running; no advertising, tracking or third-party analytics cookies are used.

Purposes and legal basis

Contact-form data is processed to respond to your request (KVKK Art. 5/2-c and f); account and session data is processed to establish and perform the service agreement and to ensure security (KVKK Art. 5/2-c, ç and f). Data is processed solely to respond to meeting requests, provide and secure the service, meet legal obligations and improve service quality. Organisational health indicators shown to organisation administrators are calculated in aggregate on the basis of legitimate interest (KVKK Art. 5/2-f); person-level information is shown only for tracking legal obligations and access security (for example, an account left open after an employee departs), and no individual scores are produced. Internal messaging content can be viewed by persons authorised by the organisation only after entering a reason, for a limited time, with every access logged; this processing relies on legitimate interest and compliance with legal obligations (KVKK Art. 5/2-ç and f) and follows the principle of proportionality. In Customer Management, sales activity data is processed for target tracking; only counts are shown per salesperson and salespeople are not ranked. A system administrator may review an organization for support purposes using "view as user"; this access starts with a stated reason, lasts at most 60 minutes, excludes messaging and digital vault content, and every step is logged.

Where data is kept and transferred

The Platform, its database, documents and backups are kept in Turkey, in Amazon Web Services data centers in the Istanbul region. Organization data is not transferred outside Turkey.

Notification, invitation and password-reset emails are also sent from our own mail server in Istanbul, Turkey. The recipient's name, email address and message content are processed in Turkey for this purpose.

Personal data is not transferred abroad and is not shared with third parties; it is shared only upon a duly made request from a legally authorized public authority. No third-party tracking or analytics tool is used on the website or the platform.

Retention periods

Data is retained for the periods below; records with a fixed period are automatically deleted or anonymized when it ends.

Records subject to a longer statutory retention period (for example, personnel files or occupational health and safety records) are kept for the legal period set by the organization as data controller.

Data Security

Personal data is transmitted over encrypted connections; passwords are stored irreversibly and session tokens as hashes. Documents are served via expiring signed links and each organization's data is kept isolated. The personal calendar feed is served through a link given only to its owner and renewable on request; daily notes load no content from external sources. Server disks and backups are kept encrypted; the cross-organization isolation rule is checked automatically on every release and enforced at runtime. Organizations can require two-factor authentication for all of their users; critical actions and access to special-category data are logged together with the stated reason.

Your Rights

Under Article 11 of KVKK you may access your data, request correction or deletion, object to processing and claim compensation for damages. You may submit your request to info@kolekto.com.tr or in writing to Gülbahçe Mah. Gülbahçe Cad. Kuluçka Merkezi Binası No: 1/45 İç Kapı No: 21 Urla / İzmir, Türkiye. Requests are answered free of charge within 30 days at the latest. If your data is processed as an employee or customer of an organization, your request will be forwarded to the organization acting as data controller.

Contact

For requests regarding the data controller: info@kolekto.com.tr