Privacy Policy

This policy explains who processes your personal data when you use Bildir365 (the website bildir365.com, the web dashboard and the iOS app; together, the “Service”), for which purposes and on which legal bases, how long the data is kept and who receives it. It fulfills our information obligations under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). Use of the Service is also governed by our Terms of Use.

In brief:

• We use no advertising, analytics or tracking tools and load no third-party content; only strictly necessary cookies are used.
• We do not sell your data, do not share it for marketing purposes, do not profile you and do not make automated decisions about you.
• For feedback submitted through a business's form, that business is the controller; we process the data on its behalf.
• Our servers and email delivery are located in Turkey; push notifications are delivered via Google (Firebase) and Apple.

1. Controller and contact

The controller of your personal data (known as the “veri sorumlusu” under the KVKK) is:

Bekir UĞUR (trade name: Konsol Dev)
Hürriyet Mahallesi, Numan Durak Aksoy Bulvarı No: 158/B, Kat: 2, No: 11, 27900 Oğuzeli / Gaziantep, Turkey
Email: info@bildir365.com
Phone: +90 540 365 27 27

If you have any questions about your personal data or your rights, you can use the email address above or the Contact page.

Our roles

• As controller, we are responsible for: visits to the website; contact via the contact form and email; registration, login, subscription and support for business accounts and user accounts (managers and staff); and the security of the Service and the prevention of abuse.
• As processor (Art. 28 GDPR; Art. 12 KVKK), we process the following data on behalf of businesses: the data received through a business's feedback forms (the sender's name, phone number and email address, free text, rating, selections, files, IP address and browser information) and the staff details that a business enters to manage its team. The controller for this data is the respective business; we act only on its instructions. The details are set out in our Data Processing Agreement (DPA).

Source of the data and method of collection

We collect most data directly from you; only the details of staff accounts are provided to us by the business's manager. Data is collected electronically — through the website and forms, the web dashboard, the mobile app and email — by automated or partly automated means.

2. Overview: what data we process, why, on what basis and for how long

The table below summarizes our processing activities; details are in the sections that follow.

Legal bases: Art. 6(1)(b) GDPR (Art. 5(2)(c) KVKK) — conclusion or performance of a contract; Art. 6(1)(f) GDPR (Art. 5(2)(f) KVKK) — legitimate interests; Art. 6(1)(a) GDPR (Art. 5(1) KVKK) — consent.

3. Visiting our website

Server logs

When you visit our website, the servers of our hosting provider (TurkTicaret.net, Turkey) record your IP address, the date and time of access, the requested address, the status code and your browser information in server logs. The purpose is the technical delivery and security of the website; the legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR). How long these logs are kept is governed by the hosting provider's own policy and is not under our control.

Cookies

We use only two technically necessary cookies. Both are set as HttpOnly and SameSite=Lax; when the site is accessed over HTTPS they are also marked Secure.

Why is there no cookie banner? We only use cookies that are strictly necessary to provide the service you have requested, so no consent is needed (under § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG), and we therefore do not show a cookie banner. We use no analytics, advertising or tracking cookies. To the extent that the information in these cookies is personal data (e.g., the session ID), its processing is based on Art. 6(1)(b) or (f) GDPR (Art. 5(2)(c) or (f) KVKK).

No third-party content

• We do not use analytics, advertising, social media plug-ins or embedded content. Our social media profiles are linked as plain links only; no data is transferred to those platforms unless you click the link.
• The typeface (Inter) is loaded from our own server; we use no external font service and no content delivery network (CDN).
• Bot protection for forms, login and registration is provided by a proof-of-work check that runs on our own server (your browser performs a small calculation). Google reCAPTCHA is not used; this check requires no cookies and no third party.

4. Contact form and email

When you use the contact form, we process your name and message and, optionally, your email address, phone number and business name, as well as, for technical reasons, your IP address and the date of submission. The purpose is to answer your request. If your request relates to the conclusion or performance of a contract, the legal basis is the contract (Art. 6(1)(b) GDPR); otherwise it is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Form messages are deleted after 12 months. When a new message arrives, a push notification containing your name and the first 80 characters of your message is sent to the provider's administrator device (Section 6). We protect the form against bots and abuse (see Sections 3 and 8).

If you email us, your email address, your name (if you provide it) and the content of your message are processed on the same bases in order to reply. Correspondence is kept for as long as needed to resolve your request; statutory retention obligations remain unaffected.

5. Registration, account and use (web dashboard and app)

Account data

When you create a business account, we process the business name, the manager's name, email address, phone number (optional), your password, your language preference, your role and your subscription and license dates (a 14-day trial, followed by a license); your email address is verified. Your password is stored only as a bcrypt hash, never in plain text. The legal basis is the conclusion and performance of the contract needed to provide the account and the Service (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK).

Staff accounts

The manager can add staff accounts for the team; the staff member's name, email address, role and the forms they can access are processed. This information is provided to us by the business's manager and is processed on the business's behalf (Sections 1 and 7). Staff members can delete their own account record. For staff members' login, session and support requests, however, we are the controller.

Subscription and license

New accounts start with a 14-day trial; after that the Service continues under a license. License fees are communicated separately on request. No card, bank or other payment-instrument details are kept within the Service. When the provider grants a license, a license history is recorded (duration, amount (TL) and a description note); when you cancel a subscription, you may optionally enter a cancellation reason. These records are kept until the account is deleted; statutory retention obligations remain unaffected.

Service emails

To operate the Service, we send you the following emails: email verification, password reset, two-step verification code, support replies, an account-deleted notice and — only if you have switched this notification on — a summary of new feedback with a link to the dashboard. The new-feedback email contains a short summary such as the form name, feedback type, rating and (if provided) the sender's name; it does not contain the full response. In addition, service-related announcements from the provider (administrator notices) may be delivered as in-app notifications, push notifications or email; in-app announcements are kept for 12 months. We do not send advertising or marketing emails. Legal basis: performance of the contract (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK).

Support requests

When you submit a support request, the subject, your message, any attachment and our replies are processed (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK). Attachments are not public; they are served only to authorized users. Notifications about support requests may also be delivered by push (Section 6).

Activity log

Events in your business account (creation, registration, subscription, status, update) and the related user number are logged for support and subscription history. The legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK). Logs are kept for 24 months.

Two-step verification

You can optionally turn on two-step verification by email; a verification code is then sent to your email address when you sign in. The code is valid for only a few minutes; expired codes are deleted in the daily cleanup.

6. Mobile app

Data on your device and on our server

When you sign in to the iOS app, the following data is processed: a session token (stored on your device in the iOS Keychain; only its SHA-256 hash is kept on the server), the device name (the generic name provided by iOS, e.g., “iPhone”) and platform, the FCM registration token for push notifications, the time the session was last used, and your selected language. The record that you have accepted the Terms of Use (EULA) is kept only on your device. Legal basis: performance of the contract (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK). The app contains no analytics or advertising SDK; only Firebase Cloud Messaging is used, for push notifications.

Push notifications

When new feedback arrives, a push notification may be sent to your device. Its title reads “New feedback · {form name}” and its body shows the feedback type (e.g., “Complaint”) or “You have received new feedback.”; the message text and the identity of the sender are never included in feedback notifications. Other push notifications are: service announcements that our administrators send to businesses (up to 140 characters of the announcement text); the support-reply notification sent when your request is answered (the first 80 characters of the request subject); and internal notifications to the provider's administrator device — for a new contact message, the sender's name and the first 80 characters of the message; for a new support request, license request, registration or content report, the business name and a short subject or reason (for a support request, the first 80 characters of the subject). Notifications are delivered via Google (Firebase Cloud Messaging) and Apple (APNs) (Sections 9 and 10).

Permission and withdrawal

For push notifications we rely on the notification permission that iOS asks you for (consent; Art. 6(1)(a) GDPR; Art. 5(1) KVKK). You can switch it off at any time in your iOS settings (Settings › Notifications); this does not affect the lawfulness of processing carried out before you switched it off.

App Store

When you download the app from the App Store, Apple processes data independently under its own privacy policy; we do not receive your App Store purchase or download data.

7. Feedback forms: the business is the controller, we are the processor

Businesses use feedback forms that are opened via a QR code or link. When you fill in a form, your data is passed to the business the form belongs to; that business is the controller for this data. We process the data on the business's behalf and on its instructions (Art. 28 GDPR; Art. 12 KVKK). This processing is subject to our Data Processing Agreement (DPA).

Data that may be processed in a form: the fields defined by the business (free text, rating, choices; optionally name, phone number, email address and a photo, video or PDF file — up to 25 MB) and, automatically, your IP address, your browser information (User-Agent) and the time of submission. The business decides which fields are mandatory. Inappropriate words are masked automatically (e.g., “s*****”). Feedback is shown only to the business's authorized users and to staff within their permissions; attachments are not public.

This data is kept until the business deletes it or the business's account is deleted; feedback deleted in the dashboard or the app is permanently erased, together with its attachments, after 30 days (Section 11). For information, purposes, retention and the legal basis, your first point of contact is the business concerned.

To exercise your rights over this data (access, rectification, erasure, etc.), please contact the business first; we will forward your request to the business and help to fulfill it. You are also welcome to write to us directly (Section 12).

8. Preventing abuse and moderation

To protect the Service and businesses from abuse such as insults, harassment and spam, we apply the measures below. The legal basis is our legitimate interest in keeping the Service secure, preventing abuse and removing objectionable content (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK); for this purpose we, alongside the businesses, are also regarded as a controller.

• Filter: Inappropriate words in form texts are masked automatically.
• Reporting: In the app, you can report content using “Report Objectionable Content” in the details of a feedback item. A report record contains the reporting user's number, the reason, a summary of the content and the date. We review reported content within 24 hours at the latest. Records are deleted 12 months after the report date.
• Blocking: Managers can block abusive senders with “Block Sender”. In that case the following details about the sender are recorded: a SHA-256 hash of the IP address and browser information (a fingerprint), the last 10 digits of the phone number, the email address and a label. The purpose is that no new submissions are accepted from the blocked sender. The record is kept until the block is lifted or the account is deleted.
• Rate limiting and bot verification: To prevent brute-force and bot attacks on actions such as login, registration and password reset, your IP address and an action key (e.g., the email address used in a login attempt) are recorded; these records are deleted after 24 hours. For bot verification, see Section 3.

9. Recipients and processors

We pass your personal data only to the following recipients and only for the purposes stated:

• Within the business: the business's authorized users and staff, only within their own permissions.
• Public authorities: where we are legally required to disclose data.
• No sale, no marketing: We do not sell your data and do not share it with third parties for marketing purposes. Distribution through the App Store is Apple's own responsibility (Section 6).

10. Transfers to other countries

• Our servers and email delivery are in Turkey. There is no European Commission adequacy decision for Turkey. When we process the feedback data of our EU/EEA business customers in Turkey on their behalf, this is, for the business concerned, a transfer to a third country under Chapter V GDPR; we therefore conclude a data processing agreement (DPA) with these businesses and apply the Standard Contractual Clauses (SCC; Commission Implementing Decision (EU) 2021/914, Module 2: controller to processor). Data that we collect directly from you (as a visitor or user) is not a transfer within the meaning of Chapter V.
• Push notifications: Google (EU/USA) and Apple (USA) are used. For transfers to the USA, Google relies on the EU–US Data Privacy Framework (DPF; Google LLC is certified) and on the standard contractual clauses in Google's terms; for Apple, Apple's APNs terms apply. The notification permission is granted on your device and can be switched off.
• KVKK: Transfers abroad are made within the framework of Art. 9 KVKK: for push notifications, on the notification permission you grant on your device; in relation to business customers, on safeguards such as the data processing agreement and standard-contract-type clauses.

11. Retention and deletion periods

The retention and deletion periods we apply are:

Deleting your account

You can delete your account at any time: the manager goes to Settings › Subscription › Delete My Account in the app and enters the code received by email. The business and all its data (forms, feedback, attachments, staff, support records, logs) are deleted immediately and permanently, and you will receive a confirmation email. A staff member can delete their own record. Deleted data may remain in the hosting provider's backups until the backup cycle ends. If you need help with deletion, you can write to us.

12. Your rights and how to exercise them

Your rights under Art. 11 KVKK

By applying to the controller, you may:

• find out whether your personal data is being processed,
• request information if it has been processed,
• learn the purpose of the processing and whether the data is used in line with that purpose,
• know the third parties in Turkey or abroad to whom the data is transferred,
• request correction if the data is incomplete or inaccurate,
• request erasure or destruction under Art. 7 KVKK,
• request that corrections and erasures be notified to the third parties to whom the data has been transferred,
• object to a result that is to your detriment and arises solely from analysis by automated systems,
• claim compensation if you suffer damage because the data was processed unlawfully.

Your rights under the GDPR

Where the GDPR applies, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), the right to object (Art. 21) and the right to withdraw your consent at any time (Art. 7(3)). You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f)). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

How to exercise your rights

Please send your requests by email to info@bildir365.com. We may ask for additional information to verify your identity. Your request is free of charge, and we will respond within 30 days at the latest. If you submitted feedback through a business's form, please contact that business first; we will also help to forward and fulfill your request.

Right to lodge a complaint

• Turkey: You can lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). Under the KVKK this is possible if your application is rejected, if you consider our response inadequate or if you receive no response in time.
• EU/EEA: You have the right to lodge a complaint with the supervisory authority in the place of your residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). In Germany, the competent authority is the data protection authority of the relevant federal state; you can find the addresses in the BfDI's list of authorities.

13. No automated decision-making, provision of data and minimum age

No automated decisions. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR; Art. 11(1)(g) KVKK), and we do not profile you. The inappropriate-word filter and our abuse-prevention measures are not decisions of this kind.

Provision of data. The fields required to open an account and use the Service are mandatory; if they are not provided, we cannot open the account or provide the Service. For feedback forms, the business concerned decides which fields are mandatory.

Minimum age. The Service is intended for users aged 18 and over; we do not knowingly collect personal data from children. If you believe a child has sent us data, please write to us.

14. Security measures

To protect your data, we apply the following technical and organizational measures:

• transmission over HTTPS/TLS;
• passwords stored only as bcrypt hashes; only a SHA-256 hash of API tokens is kept on the server;
• optional two-step verification by email (mandatory for the provider's administrator accounts);
• rate limiting and brute-force protection for login, registration, password reset and two-step verification; CSRF protection;
• role-based access and isolation of data between businesses: each business sees only its own data, and staff see only the forms they are authorized for;
• feedback and support attachments are not public: they are served only to authorized users (business logos excepted);
• session cookies set as HttpOnly, SameSite and (over HTTPS) Secure;
• input validation and output escaping;
• an inappropriate-content filter, plus reporting and blocking tools;
• automatic cleanup of deleted or expired data (Section 11);
• access to data limited to the person needed to operate the Service (currently: the provider alone).

Backups are made by the hosting provider; the details are not under our control. Despite these measures, the absolute security of transmission over the internet and of electronic storage cannot be guaranteed.

15. Changes

We may update this policy as our Service or the law changes. The current version is always on this page; we will announce significant changes on this page and, where appropriate, in the app. The “Last updated” date at the top of the page shows when the text was last changed.