This notice has been prepared under Law No. 6698 on the Protection of Personal Data (“KVKK”) to explain, in its capacity as data controller, Ekivera (“Ekivera,” “we”) how your personal data is processed through the web application at ekivera.com and the Ekivera mobile applications (together, the “Platform”).
1. Our two roles: data controller and data processor
Ekivera is a multi-tenant software platform that field service businesses use to manage their operations. Because of this structure, we process data in two different capacities:
- As data controller: we are the data controller for the account data (identity, contact, and usage data) of the business owners, managers, field staff, and portal users who register on the Platform.
- As data processor: for the data that businesses using the Platform enter about their own customers (customer name, contact and address details, job and invoice records), the business itself is the data controller; Ekivera processes this data only on the business's instructions and to the extent the service requires. We recommend directing any requests about this data to the business you received service from first.
2. Categories of personal data we process
- Identity and contact: full name, email address, phone number, company name, and job title.
- Account and activity: session records, membership and role information, subscription and usage data, in-app activity history (audit logs).
- Location: only when field staff have explicitly granted permission on their device; point-in-time location data accompanying job status updates and time logs (we do not track location continuously).
- Images and documents: before/after job photos, signatures, and uploaded files (as part of businesses' operational records).
- Financial transaction data: quote, invoice, and payment records. Ekivera does not storeyour credit card or bank details; in-app subscription payments are processed by the Apple App Store / Google Play.
3. Purposes of processing and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Account creation, authentication, and delivery of Platform services | Establishment and performance of a contract |
| Transactional notifications (quote, job status, and invoice updates) | Performance of a contract; legitimate interest |
| Billing, subscriptions, and legal obligations | Compliance with a legal obligation |
| Security, debugging, and abuse prevention | Legitimate interest |
| Sending commercial electronic messages (campaigns/marketing) | Explicit consent (managed via İYS; not sent by default) |
4. Parties data is shared with and cross-border transfers
Your data is shared with the following subprocessors only to the extent necessary for the technical delivery of the service. Because some of our servers are located abroad, by using the Platform and confirming this notice during registration, you give explicit consent to these transfers under KVKK Art. 9:
- Supabase / Amazon Web Services (Frankfurt, Germany): database, authentication, and file storage.
- Vercel (Frankfurt, Germany region): application hosting.
- Resend: transactional email delivery (email address and message content only).
- Meta Platforms (WhatsApp Business): transactional WhatsApp notifications where selected (phone number and message content only).
- Apple / Google: mobile app distribution and in-app subscription transactions.
Beyond these, your data is not sold, rented, or shared with any third party for advertising purposes. Lawful requests from authorized public authorities are reserved.
5. Retention periods
- Account data: for the duration of membership and up to 30 days after account deletion.
- Invoices and commercial records: up to 10 years under applicable law (the Tax Procedure Law and the Turkish Commercial Code); these records are retained with personal identifiers removed once the account is deleted.
- Audit logs: up to 2 years for security purposes.
- Account deletion request records: 3 years to meet KVKK's burden-of-proof requirement.
6. Cookies
The Platform uses only cookies that are strictly necessary for the service to function: session ID and active company preference. Advertising, tracking, or third-party analytics cookies are not used. For this reason, we do not show a separate cookie consent banner.
7. Your rights under KVKK (Art. 11)
You always have the following rights regarding your personal data:
- Learn whether your data is being processed and request information about it,
- Learn the purpose of processing and whether it is used in line with that purpose,
- Know the third parties your data is shared with, domestically or abroad,
- Request correction of incomplete or inaccurate data,
- Request deletion or destruction of data under KVKK Art. 7,
- Request that these actions be notified to the third parties your data was shared with,
- Object to a result that is unfavorable to you and produced solely through automated analysis,
- Request compensation for damages arising from unlawful processing.
8. How to exercise your rights (including data deletion requests)
- To delete your account and personal data: in the mobile app Profile → Delete Account or in the web panel My Profile → Delete Account step. This action cannot be undone; your personal data is permanently deleted, and only financial records subject to legal retention obligations are kept, with identifying information removed.
- For all other requests: kvkk@ekivera.com you can apply with information verifying your identity. Requests are resolved free of charge within 30 days at the latest.
9. Data security
Your data is encrypted with TLS in transit; database access is isolated per company using row-level security, and critical actions are recorded in audit logs. Access is restricted according to the principle of role-based authorization.
10. Changes and contact
This policy is published on this page whenever it is updated, and significant changes are announced through the Platform. For questions, you can reach us at kvkk@ekivera.com or destek@ekivera.com . You can also check out our Terms of Service page.