Legal
KVKK Privacy Notice
How and why SignFlow processes personal data, on which legal grounds, and how to exercise your rights under Article 11 of the Turkish data protection law.
Draft — awaiting legal review
This text becomes final once legal review is complete. Details in square brackets have not been added yet.
The Turkish text of this document is binding. Read the Turkish text
This is a convenience translation. The Turkish text (KVKK Aydınlatma Metni) is the binding version and prevails in case of any difference.
1. Purpose and scope
This notice is given under Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how personal data of people who use SignFlow (https://signflow.me and https://app.signflow.me) is processed.
SignFlow is multi-tenant business software sold by subscription to sign and signage manufacturers. The business that buys the service is the “Customer”, and the employees the Customer invites are “Users”.
2. Data controller
The data controller is Erelsis Yazılım Teknolojileri Limited Şirketi (the “Company”).
| Item | Value |
|---|---|
| Legal name | Erelsis Yazılım Teknolojileri Limited Şirketi |
| Address | Zafer Mah. 152 Cad. No: 35 Efeler / Aydın |
| MERSIS no. | 0352035535600001 |
| Phone | 0553 521 17 47 |
| destek@signflow.me |
VERBİS registration status: the Company is below the annual employee and annual balance-sheet thresholds set by the Personal Data Protection Board’s decisions on the obligation to register, and is therefore not currently required to register with the Data Controllers’ Registry (VERBİS). If it exceeds those thresholds, the Company will register with VERBİS within the prescribed period and update this notice.
3. The Company’s two roles
The Company acts in one of two roles depending on the data. This decides whom you should address when exercising your rights.
3.1 Data processed as data controller
The Company is the data controller for account, authentication, security, subscription, payment and billing data. It decides why and how this data is processed. Sections 4 to 9 of this notice cover this data.
3.2 Data processed as data processor
For the data a Customer enters into the service for its own business (its own customers, contact persons, orders, installation addresses and schedules, installation photos, design files and other uploads, stock, suppliers, purchase requests, notes, comments and notifications), the Customer is the data controller. The Company processes this data only on the Customer’s behalf and instructions, to provide the service.
The Customer is responsible for having a legal basis for this data and for informing the people concerned. The Company does not use it for its own purposes. Company staff have no screen for browsing Customers’ business data; it is accessed only when the Customer asks for support, or when security or a legal obligation requires it, and only as far as needed. The processor terms are set out in the Terms of Use.
4. Categories of personal data, purposes and legal grounds
The data below is processed on the legal grounds of KVKK Article 5(2). Explicit consent is not relied on for core service processing.
| Category | Examples | Purpose | Legal ground (Art. 5(2)) |
|---|---|---|---|
| Identity and contact | Full name, email, mobile phone, company name | Opening the account, verifying identity and contact details, providing the service | (c) formation and performance of a contract |
| Account | Password hash, language preference, sign-in times, failed sign-in counters | Managing and protecting the account | (c) performance of a contract, (f) legitimate interest |
| Transaction security | Session records (IP address, browser details, time), audit log entries, one-time code records (hashed) | Preventing unauthorised access and abuse, investigating incidents | (f) legitimate interest, (ç) legal obligation |
| Legal transaction | Consent records (document version, time, IP address, browser details) | Proving acceptance of documents | (e) establishing, exercising or protecting a right |
| Customer transaction and billing | Billing name, tax number and tax office or national ID number, address, billing email, phone, subscription, payment and invoice records | Subscription, collection and invoicing | (c) performance of a contract, (ç) legal obligation |
| Financial | PayTR card and user tokens (encrypted), last 4 digits, expiry month/year, bank, brand, card type | Paying with a stored card and auto-renewal | (c) performance of a contract |
| Communications | Support emails and their content | Answering requests | (c) performance of a contract, (f) legitimate interest |
Card numbers never reach the Company’s servers: card details are entered on a form that posts directly to PayTR. National ID numbers and PayTR tokens are stored encrypted with AES-GCM. Passwords are stored only as Argon2 hashes; one-time codes and email link tokens only as keyed hashes.
Commercial electronic messages may only be sent with separate consent; no such consent is collected today and no commercial messages are sent. Service emails (verification, password reset, invitations, notifications, trial reminders, payment and export notices) are not commercial messages.
5. How data is collected
Personal data is collected, wholly or partly by automated means:
- Through forms you or the Customer fill in on the website and in the app (signup, profile, billing details, support).
- Automatically while the service is used, through session and audit records and strictly necessary cookies.
- From the Customer’s authorised person who invites you (name, email).
- From PayTR, which reports the result of a payment.
- Through emails you send us for support.
See the Cookie Policy for cookie details.
6. Recipients
Personal data is transferred only as far as needed for the purposes above and in line with KVKK Article 8:
| Recipient | Data | Purpose |
|---|---|---|
| DigitalOcean, LLC (USA, processor) | All data held in the service (as infrastructure) | Server hosting |
| DigitalOcean, LLC (USA, processor) | Database and file backups | Disaster recovery |
| Google LLC (USA, processor) | Notification token; order number and stage name | Delivering push notifications to the mobile app |
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | Payment amount, billing details, card tokens | Payments, card storage, auto-renewal |
| Netgsm İletişim ve Bilgi Teknolojileri A.Ş. | Mobile number, one-time code | Phone verification by SMS |
| Alastyr (alastyr.com, Türkiye) | Name, email address, message content | Delivering service emails |
| Accounting and e-invoice system, Revenue Administration (GİB) | Invoice details (buyer identity, amount) | Issuing e-Arşiv or e-Fatura invoices under the Tax Procedure Law |
| Competent public authorities | Data requested | Meeting legal obligations |
Authorised Users of the Customer you belong to can see your name, email address and your actions in the app, within the limits of their roles and permissions.
Transfer abroad
[Draft — this section awaits legal review: the legal basis, the type of standard contract and the notification details are to be confirmed by counsel.]
The service’s database, files and job queues run on servers operated by the Company and provided by DigitalOcean, LLC in a data centre in the United States (New Jersey). All personal data listed in this notice is therefore transferred to DigitalOcean, LLC, acting as a data processor, and thereby abroad. Where the mobile app is used, the device's notification token and the order number and stage name a notification carries are transferred to Google LLC (USA), acting as a data processor, to deliver the notification.
As the Personal Data Protection Board has issued no adequacy decision for the United States, the transfer relies on one of the appropriate safeguards of KVKK Article 9(4): the standard contract published by the Board (controller to processor). The standard contract was signed on [Date the standard contract was signed] and notified to the Board within five business days of signature, on [Date of notification to the Board].
Data travels between your browser and the servers over encrypted connections; stored card tokens and national ID numbers are encrypted again at rest. Whether the other recipients are in Türkiye or abroad is stated in this section; before a new recipient abroad is added, this notice is updated.
7. Retention
| Data | Retention |
|---|---|
| Account and Customer data | While the account and subscription exist, including read-only periods |
| Session records | Until the session ends or is revoked (at most 7 days idle, 30 days in total), then deleted on schedule |
| Invoices and payment records | 5 years under the Tax Procedure Law, 10 years under the Commercial Code |
| Audit and consent records | Also after closure, for the applicable limitation periods |
| Export archives | 7 days after they are created |
| Backups | Removed from backups within 30 days of deletion from live systems |
| Application logs | Short-lived, size-limited rotating logs; no web access logs are kept |
When a Customer requests closure, its data stays available for 30 days and the request can be withdrawn in that time. Within a reasonable time after the 30 days end, authorised Company staff delete the Customer’s business data, memberships, sessions, billing profile and card tokens (also at PayTR). Invoices, payment records, audit and consent records, and the Customer name on them, are kept to meet legal obligations. User accounts that belong to no other Customer are anonymised.
Data whose retention period has ended is deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
8. Your rights (KVKK Article 11)
You may apply to the data controller to:
- learn whether your personal data is processed,
- request information about the processing,
- learn the purpose of processing and whether data is used for that purpose,
- know the third parties in Türkiye or abroad to whom data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of data under the conditions of KVKK Article 7,
- request that corrections, deletions or destructions be notified to the third parties who received the data,
- object to a result against you arising from analysis exclusively by automated systems,
- claim compensation for damage caused by unlawful processing.
9. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your request, with information that identifies you, by one of these routes:
- a signed letter delivered in person or through a notary to Zafer Mah. 152 Cad. No: 35 Efeler / Aydın,
- email from the address registered on your account to destek@signflow.me.
The request must include your full name, signature (for written requests), Turkish ID number (for foreigners, nationality and passport or ID number), an address or email for notification, and the subject of the request.
Requests are answered as soon as possible and within 30 days at the latest, free of charge. If the action involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is refused, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board.
If you are a customer, supplier or contact of a SignFlow Customer and that business entered your data into the service, that business is the data controller and you should apply to it directly. Requests of this kind that reach the Company are forwarded to the Customer concerned.
10. Changes
This notice is updated when the law or our processing changes. The current version is always published on this page. For a broader overview, see the Privacy Policy.
Questions? Email destek@signflow.me.