Privacy and security
Employee data protected, KVKK processes on record
Leave data can include identity, pay and health information. İzin360 protects it with encryption and access control, and lets you run privacy notices, data subject requests and retention inside the app.
- 30-day deadline tracking for data subject requests
- Two-factor authentication required for health documents
- Encrypted, virus-scanned documents
Privacy notice and employee rights
For employee data, your company is the data controller and İzin360 is the data processor. You prepare your employee privacy notice from a template and publish it; employees record that they have read it.
- The notice cannot be published while template fields in square brackets are still empty
- Each new version asks employees to confirm “I have read this”; this is not explicit consent
- Employees download a copy of their own data as a ZIP file
Data subject requests
Employees exercise their rights under KVKK art. 11 by submitting a request in the app. The request goes to your company and the response deadline is tracked.
- Information, access, rectification, erasure and other request types
- The response due date and days remaining for every request
- Responses are given and recorded in writing; a rejection needs a reason
Retention, anonymisation and legal hold
Personal data of former employees is anonymised automatically once the retention period you set has passed. Leave statistics are kept without identities.
- Choose a retention period between 5 and 30 years
- Place a legal hold on a record for a lawsuit, audit or official inquiry; it is not anonymised even after the period ends
- Every deletion and anonymisation is written to a destruction log
- Data breach notices from İzin360 appear in the app and are acknowledged there
Account and data security
Sensitive fields and documents are stored encrypted. Each company's data is kept strictly separate from every other company's; users of one company cannot reach another company's data.
- Two-factor authentication with an authenticator app, required to open another person's health documents
- National ID number, salary and birth date fields are encrypted
- Uploaded files are virus-scanned and stored encrypted
- A strong password policy, and passwords found in known data breaches are rejected
Roles and audit log
Owner, HR manager, HR specialist, line manager, employee and billing admin roles can reach only the data their work requires. The audit log keeps a record of actions in your company whose integrity can be verified.
- Entries are append-only; each one is linked to the previous entry by a hash chain
- Chain integrity can be verified from within the app
- Filter by date and category, and download as CSV
How it works
- 1
Publish your privacy notice
Load the template, complete it for your company and publish it; employees are asked to confirm they have read it.
- 2
Set the retention period
Decide on the retention period for former employees' data with your legal adviser and save it.
- 3
Answer requests on time
Take incoming data subject requests into progress and answer them in writing within 30 days at the latest.
Frequently asked questions
What is İzin360's role under KVKK?
For employee data, your company is the data controller and İzin360 is the data processor that handles the data on your company's behalf. The content of the privacy notice and answering requests are your company's obligations as data controller.
Do we need explicit consent from employees?
Processing such as calculating and requesting leave relies on the employment contract and legal obligations; the Personal Data Protection Board does not consider it appropriate to base such processing on explicit consent. That is why İzin360 asks employees to confirm they have read the privacy notice, not to give consent.
Who can see health documents?
Only authorised HR users and the employee's manager. Opening another employee's health document requires two-factor authentication to be switched on for the account. On the team calendar, health-related leave appears only as “On leave”.
When is a former employee's data deleted?
Once the retention period your company has set (5 to 30 years) has passed from the end of employment, their personal data is anonymised automatically. Records under legal hold are excluded until the hold is lifted.
How can I be sure audit log entries haven't been changed?
Entries are append-only and each one is linked to the previous entry by a hash chain. If an entry is deleted or altered, the integrity check shows where the chain breaks.
Try it with your own data
Try it free for 30 days; no card needed. Request a demo if you have questions.