KVKK Privacy Notice
Last updated: · Effective:
This is the privacy notice required by article 10 of Turkish Personal Data Protection Law No. 6698 (“KVKK”). The Turkish version is the authoritative text. For more detail see the Privacy Policy.
1. Data controller
The data controller is Bigeransoft Yazılım (“BigeranSoft”), the developer of the Halım Geldi app. Contact: bigeransoft.info@gmail.com.
The customer, staff and courier data that a carpet-cleaning business enters into its own account is processed by us on behalf of that business, as a data processor; for that data the business itself is the data controller. You may send requests about such data to the business; if you send them to us, we forward them to the business and help it to conclude them.
2. Personal data processed
- Identity and contact: full name, mobile number; for a business, its name, phone, address and tax details.
- Customer transaction: orders, carpet details, status history, delivery code, reviews.
- Address and location: collection and delivery addresses with their map coordinates; for couriers, location while the shift is open.
- Visual records: carpet photos and the signature image taken at delivery.
- Financial: payment method, amount and status, provider transaction reference, balance and credit records, subscription and purchase records (card numbers are not processed).
- Transaction security: password and code hashes, session records, IP address, device and browser information, sign-in attempts.
- Marketing: the SMS permission for campaign and reminder messages that a business sends to its customers.
- Requests and complaints: support correspondence and account / data deletion requests.
No special categories of personal data are processed.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5/2) |
|---|---|
| Creating and managing accounts; providing the Service; taking, collecting, tracking and delivering orders; courier tasks; payments, subscriptions and SMS credits; notifications | (c) Necessary for entering into or performing a contract |
| Invoices, financial and accounting records; responding to authorised public bodies; keeping access logs | (a) Expressly provided for by law; (ç) compliance with a legal obligation |
| Information security, preventing abuse and fraud, fixing errors, improving the Service with aggregated statistics | (f) Legitimate interest, without harming your fundamental rights |
| Proving that a carpet was collected and delivered and in what condition; handling disputes | (e) Establishment, exercise or protection of a right |
| Courier location while the shift is open | (c) Performance of the employment / service relationship; (f) legitimate interest |
We do not process your personal data for any purpose that requires your explicit consent. Should that become necessary, we will ask for it separately and you can withdraw it at any time.
4. How data is collected
Data is collected electronically: from what you enter in the mobile app, the macOS app, the web panel and the forms on this website; from what a business enters about its customers and team; automatically from the courier’s device while the shift is open; through SMS verification; from payment and app-store providers’ notifications; and through server records.
5. To whom data is transferred
- Businesses: the business you order from or work for sees the data needed for the order or the task (KVKK art. 8, on the same legal bases).
- Service providers (processors): Hostinger International Ltd. (hosting, servers in the United Kingdom); Netgsm İletişim ve Bilgi Teknolojileri A.Ş. (SMS); PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (card payments); Google LLC (Firebase Cloud Messaging push notifications, United States); Apple Inc. and Google LLC (in-app purchases, United States).
- Authorities: courts and authorised public bodies, only when legally required.
Transfers abroad (United Kingdom, United States) are made in accordance with article 9 of KVKK, relying on appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board; standard contracts are notified to the Personal Data Protection Authority within five business days of signing. Personal data is not sold or shared for advertising.
6. Retention
Personal data is kept for as long as the purpose requires and the law prescribes, then deleted, destroyed or anonymised. Account details: as long as the account is open (deleted within 30 days of a deletion request); a business’s records: deleted within 90 days after the business account is closed; financial records: 10 years; courier location: 30 days at most; verification codes and sign-in attempts: 2 days at most; server access logs: 1 year; backups: 30 days. The full table is in the Privacy Policy.
7. Your rights (KVKK art. 11)
You have the right to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used for that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- request rectification if it is incomplete or inaccurate, and that this be notified to the third parties to whom it was transferred;
- request its deletion or destruction under the conditions in article 7 of KVKK, and that this be notified to the third parties to whom it was transferred;
- object to a result against you arising exclusively from analysis of your data by automated systems;
- claim compensation if you suffer damage because of unlawful processing.
8. How to apply
You can send your application:
- through the form on the Account & Data Deletion page (we verify your identity with an SMS code sent to your registered number), or
- by email to bigeransoft.info@gmail.com, stating your full name and registered mobile number and describing your request; to verify that the request comes from you, we send a code to your registered number.
We conclude your application free of charge as soon as possible and within 30 days at the latest (KVKK art. 13). If the action requires an additional cost, the fee set in the Board’s tariff may be charged. If your application is rejected, you find the reply insufficient or we do not reply in time, you may complain to the Personal Data Protection Board within 30 days of learning the reply and in any case within 60 days of your application (KVKK art. 14).