1. Scope
Convenience translation: this English version is provided for information only. The Turkish version is the binding text and prevails in case of any discrepancy.
This Privacy Policy explains how personal data is protected on the İzin360 website and the İzin360 platform (the "Platform") operated by [LEGAL_TRADE_NAME] ("İzin360"). It should be read together with:
- KVKK Privacy Notice — the data we process as data controller, purposes, legal grounds, recipients and your rights,
- Cookie Policy — the cookies and browser storage we use,
- Data Processing Agreement — the terms for employee data we process on behalf of customer companies, and the sub-processors.
2. Our principles
We process personal data in line with the principles in Article 4 of the KVKK: lawfulness and fairness; accuracy and, where necessary, being kept up to date; specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purpose; and being kept only as long as necessary. In practice:
- We do not sell or rent personal data or use it to build advertising profiles.
- We process the employee data that customer companies enter into the platform only to provide the service to that customer and on its instructions; we do not use it for our own purposes.
- One customer's data is never shown to another customer; statistics across customers are produced only from anonymous or aggregate data.
- We do not use advertising, retargeting or profiling tools. Only if you allow it in the cookie panel, we use Google Analytics for visit statistics on the public marketing pages; the app and the sign-in, sign-up and payment pages are not measured (see the Cookie Policy). All site resources, including fonts, are served from our own servers.
3. Data controller and data processor roles
İzin360 is the data controller for data relating to its own customer relationships, such as account representatives and users, billing contacts, website visitors and contact and support requests. For the leave and personnel data of customer companies' employees, the customer company (the employer) is the data controller and İzin360 is the data processor.
Employees can send their KVKK requests to their employer in the app on the User menu › Privacy & KVKK page and download a copy of their own data. Such requests that reach İzin360 are forwarded to the employer concerned without delay.
4. Security measures
Under Article 12 of the KVKK, we apply the following technical and organisational measures to prevent unlawful processing of and access to personal data and to safeguard it:
Access and authentication
- Isolation between customers: each customer company's data is separated in the database by enforced row-level security (PostgreSQL RLS) and additionally at application level.
- Role-based access: users can access only the data their role requires.
- Passwords: stored irreversibly (PBKDF2-SHA512, 600,000 iterations); they must be at least 12 characters and are checked against known data breaches using a k-anonymity method (neither the password nor its full hash leaves our systems).
- Brute-force protection: after 5 consecutive failed attempts the account is locked for 15 minutes; rate limiting applies to authentication endpoints.
- Two-factor authentication: every user can enable two-factor authentication with time-based one-time codes. It is mandatory by default for users who can access health data (human resources roles, the account owner and managers): they cannot use the platform until they set it up (Personal Data Protection Board Decision 2018/10). Only the customer's account owner can lift the requirement, with a reason and an acknowledgement of the legal risk; the decision is written to the customer's audit log. Opening another person's health document always requires two-factor authentication.
- Sessions: session tokens are kept in cookies that browser scripts cannot read (httpOnly); the access token is valid for 30 minutes, the refresh token changes on every use and the session is ended if reuse is detected. Users can see and close their open sessions.
Encryption
- In transit: the platform is accessible only over encrypted connections (HTTPS/TLS); browsers are instructed via HSTS to use secure connections only.
- Sensitive fields: Turkish ID numbers, dates of birth, salaries, tax identification numbers in billing details and invoices, and two-factor secrets are encrypted in the database with AES-256-GCM using a key derived per customer.
- Documents: each uploaded document is encrypted with AES-256-GCM using its own random key, which is protected with the customer-specific key. Documents are virus-scanned on our own infrastructure and cannot be downloaded until the scan is clean.
- Backups: the database is backed up daily and encrypted with AES-256; backups are deleted after 14 days.
Leave that may involve health data
- Documents of health-related leave types such as sick or maternity leave are available only to the requester, human resources and the direct manager; every document download and every view of the details of another person's health-related leave record (who, which record, when, from which IP address and browser) is written to the audit log.
- In the team calendar, calendar subscriptions (iCal) and webhook notifications such leave is shown only as "On leave", without the leave type.
- No diagnosis is requested for sick-leave records; health-related leave forms warn that no diagnosis or medical details should be entered in the description field. The content of description fields is not scanned automatically.
Logging and infrastructure
- Audit log: important actions as well as successful and failed sign-ins, two-factor authentication and password change events are written, with IP address, browser information and request trace ID, to an audit log linked by a hash chain that the application cannot modify or delete; customer administrators can verify the chain. When the personal data of a person whose retention period has expired is erased, the chain stays intact: each row's hash is computed with a random value specific to the row, which is destroyed together with the data, and the erasure itself is recorded in the chain.
- Infrastructure: applications run in containers as unprivileged users; only the reverse proxy terminating HTTPS is exposed to the internet (HTTP requests are redirected to HTTPS). The administration console uses a separate identity pool and two-factor authentication is mandatory.
- Organisational measures: access to personal data is limited to what each role requires; our staff and service providers are bound by written confidentiality obligations.
Health data is a special category of personal data. The legal ground for processing it and compliance with the adequate measures set by the Personal Data Protection Board in Decision No. 2018/10 are the responsibility of the customer company as data controller; İzin360 supports this obligation with the technical measures above.
No system can guarantee absolute security. If you discover a vulnerability, please report it to us at [LEGAL_EMAIL].
5. Access for support purposes
Where necessary for support, troubleshooting or a security review, authorised İzin360 staff can open a read-only support session to a customer account from the administration console:
- The session views data with the account owner's permissions; no data can be created, changed or deleted,
- The session is valid for at most 4 hours,
- Health documents and other documents, archives and exports cannot be downloaded in a support session,
- Turkish ID numbers, salaries and amounts derived from them, dates of birth, event dates and free-text fields such as reasons and comments are hidden in a support session,
- Starting the session and every request made in it are recorded, with the identity of the support staff member, in the customer's audit log (shown to the account owner as a "support session") and the platform administration log, and the account owner is notified by e-mail.
6. Personal data breach notification
If we detect that personal data has been obtained by unauthorised persons, as data processor we notify the affected customer companies without delay (our target is within 24 hours) through in-app notifications and e-mail. The notice contains the information the customer needs for its own notification to the Personal Data Protection Board within 72 hours, such as the time of the incident, the categories of data affected, likely consequences, measures taken and contact details.
For data for which we are the data controller, we notify the Board within 72 hours of becoming aware of the breach and the affected persons as soon as reasonably possible (Board Decision No. 2019/10).
7. Retention periods
We keep personal data for the periods below. Data whose period has expired is deleted, destroyed or anonymised by automated destruction processes running daily and monthly — in any case at intervals not exceeding six months — and every destruction is recorded.
| Data | Retention period | Basis / explanation |
|---|---|---|
| Invoice, payment and refund records, buyer details on invoices, copies of official invoices | 10 years from the end of the calendar year in which they were created; deleted automatically when the period ends if the account has been deleted | Turkish Commercial Code Art. 82; Tax Procedure Law Art. 253 |
| Order records, acceptance of sales documents (document, version, text digest, time, IP) and records of order confirmation / price change e-mails | Together with the related invoice: 10 years from the end of the calendar year in which they were created | Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce; evidence |
| Billing profile (buyer type, legal name or full name, tax ID / national ID number — encrypted —, tax office, address, invoice e-mail) | While the account is open; deleted with the account 90 days after closure (buyer details on issued invoices are kept with the invoices) | Performance of the contract |
| Records of acceptance of the Terms of Service and the Data Processing Agreement | 10 years from the end of the calendar year in which the contract ended | General limitation period (Code of Obligations Art. 146); evidence |
| Account and user details, records of having read the privacy notice, optional cancellation survey answers | While the account is open; deleted 90 days after the account is closed | Performance of the contract |
| Company record of a deleted account (legal name) | Until the retention periods of the billing and contract records above end; then anonymised | Showing to whom the retained records belong |
| Records of consent to and refusal of commercial electronic messages | 3 years from the end of the consent (withdrawal or deletion of the account); when the account is deleted they are moved to a separate evidence archive with only the e-mail address, consent type, text version, time and IP address | Regulation on Commercial Communication and Commercial Electronic Messages Art. 13 |
| Session records (IP address, browser/device information) | 180 days after the session ends or is revoked | Account security |
| Authentication and security events (sign-in, failed sign-in, two-factor authentication, password change — IP address, browser information) | In the customer account's audit log for as long as the account exists; the IP address and browser information are erased when the employee record is anonymised; deleted 90 days after the account is closed | Data security (KVKK Art. 12); Board Decision 2018/10 (logging of access to health data) |
| E-mail verification, password reset and similar security codes | 30 days after use or expiry | Account security |
| Invitations not accepted | 90 days after the invitation expires | Operation of the service |
| Server access logs (traffic data: IP address, time, requested address, amount of data transferred; secret keys in links are not written) and application output logs | 1 year; expired log files are deleted automatically (at the latest after 13 months). 90 days in the central application log store, 14 days in tracing records | Security; Law No. 5651 and the Regulation on Hosting Providers Art. 5 (as a precaution) |
| Google Analytics visit data (only with consent in the cookie panel, marketing pages) | Event-level data 2 months in Google Analytics; analytics cookies in the browser at most 24 months, deleted when consent is withdrawn; cookie choice 180 days | Explicit consent; visit statistics |
| Contact, demo and sales form requests (including IP address) | 1 year after being handled; if never handled, 2 years after creation (deleted automatically) | Responding to the request; preventing abuse |
| Support correspondence | 2 years from closure of the request | Performance of the service; evidence |
| KVKK requests made to us and our responses | 3 years from conclusion of the request | Evidence in complaints to the Board and disputes |
| Destruction records (contain no personal data) | At least 3 years | Regulation on the Erasure, Destruction or Anonymisation of Personal Data Art. 7(3) |
| Backups | 14 days (rolling) | Deleted data also disappears from backups within at most 14 days |
| Data | Retention period | Explanation |
|---|---|---|
| Records of employees who have left (identity, personnel data, documents, descriptions, event dates, KVKK requests, personal data in the audit log) | For the period chosen by the customer after employment ends (5–30 years, default 10); then irreversibly anonymised, leave type/period/number of days remain as statistics | Customer's retention policy; records under a legal hold are suspended |
| Notifications | Read ones 1 year, others 2 years | Operation of the service |
| Webhook delivery records | 90 days | Integration troubleshooting |
| System event queue records | 30 days | Operation of the service |
| All data in the customer account (employees, leave, documents, audit log) | Permanently deleted 90 days after the account is closed. An account suspended at the end of the trial or for an unpaid renewal is closed if no package is chosen or no payment is made within 60 days of the suspension (notices are sent 30 and 7 days before closure) | Data Processing Agreement; the account can be reopened until the deletion date; billing records are kept according to the table above |
Customer companies are responsible for setting their own retention periods for employee data, taking into account retention obligations under labour and social security legislation (for example ten-year document retention under Article 86 of Law No. 5510).
8. Hosting and service providers
The platform and our website are hosted on servers provided by Contabo GmbH located in Germany. The database, document storage, virus scanning, queue, cache and monitoring components run on these servers under our own management; your data is not sent to any other third party for these components.
Apart from this, we work with service providers for e-mail delivery, corporate e-mail, backups, payments and e-invoicing. These providers access only the data required for the service, under confidentiality and security obligations. The current list is set out in the annex to the Data Processing Agreement, and the status of transfers abroad in the KVKK Privacy Notice.
İzin360 never sees or stores your card details; payments are taken through the payment page of PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., which is subject to its own privacy policy.
9. Commercial electronic messages
We send commercial electronic messages (e-mail) about product news, offers and events only if you have expressly opted in. Consent is optional, is not a condition for using the service and is never collected through pre-ticked boxes. We record your consent and its withdrawal history with version, time and IP address.
As of the date of this policy, no commercial electronic messages are being sent. Before we start, we will register with the Message Management System (İYS) and record consents there; we will not send messages on the basis of a consent that is not registered in İYS. Every message we send will contain a free opt-out link, our trade name and our contact details.
You can withdraw your consent at any time in the app on the User menu › Privacy & KVKK page or by writing to [LEGAL_PRIVACY_EMAIL]; your opt-out is applied within three business days at the latest.
Messages relating to the operation of the service — such as account verification, password reset, leave request and approval notifications, invoices, renewal and payment reminders — are not commercial messages; they contain no promotional content and do not depend on your consent.
10. Children
İzin360 is a service for businesses; our website and platform are not directed at persons under 18 and we do not knowingly collect personal data from them. Data relating to employees under 18 employed by customer companies is processed under the responsibility of the employer as data controller.
11. Your rights and contact
Your rights under Article 11 of the KVKK and how to exercise them are set out in the data subject requests section. For privacy questions, contact us at [LEGAL_PRIVACY_EMAIL].
12. Changes
We may update this policy to reflect changes in our service or in legislation. The current version is published on this page with its version and last-updated date; we also announce significant changes to account owners by e-mail.