Privacy and personal data

1. Data controller

For the landing page and the sign-in record: Şafak Birol · İzmir, Türkiye · safak@messea.app. For the production and staff data your company enters into MESSEA, your company is the data controller; your company's privacy notice applies to that data.

2. Data processed, purpose and legal basis

Landing page visit: only daily totals are kept: the number of visits per day, city, region, country and name of the organisation providing the connection (internet provider or company network). So that the same person is not counted twice in a day, a one-way code is derived from your IP address and browser information with a random value renewed every day; the code and the random value are deleted when the day ends. Your IP address and browser information are not stored. If “Do Not Track” or “Global Privacy Control” is on in your browser, the visit is not counted. Purpose: to see whom the page reaches. Legal basis: legitimate interest (KVKK Art. 5/2-f).

Sign-in record: on every successful sign-in and on a sign-in locked after repeated failed attempts, the account (email address or badge number), company, time, IP address, city, region, country and the name of the organisation providing the connection. Purpose: account security and detecting unauthorised access. Legal basis: legitimate interest (KVKK Art. 5/2-f).

3. Transfers

Records are kept on servers in Germany and shared only with hosting and network service providers, solely to provide those services. They are not sold or used for advertising.

4. Retention period

In the sign-in record the IP address is kept for 30 days and the other data for 90 days. Visit counts are kept for 90 days; the visit code and the random value behind it are deleted when the day ends. Records are deleted automatically when the period ends.

5. Your rights and requests

Under KVKK Art. 11 you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether the data is used accordingly, to know the third parties in Türkiye or abroad to whom it is transferred, to request its correction if it is incomplete or inaccurate, its erasure or destruction, and the notification of these actions to the third parties to whom it was transferred, to object to a result of automated analysis and to claim compensation. You can send requests to safak@messea.app; they are answered free of charge within 30 days at the latest (KVKK Art. 13). You may complain to the Turkish Personal Data Protection Board (KVKK Art. 14).

6. Visitors from the European Union

The information required by GDPR Art. 13 is given above; the legal basis is GDPR Art. 6(1)(f) (legitimate interest). The visit record is not mandatory; the sign-in record is part of signing in, for account security. Your rights of access, rectification, erasure, restriction, objection and data portability, and your right to lodge a complaint with the supervisory authority in your country, are reserved.