Privacy Policy

Version

1.0

Effective date

6 November 2026

Last updated

6 November 2026

About this translation: This English text is a translation of the Turkish original, provided for information only. The Turkish version is the binding text and prevails in the event of any discrepancy. This translation is pending legal review.

Data Controller: PROTOOLBAG YAZILIM TEKNOLOJİLERİ A.Ş.

1. Introduction and Scope

This Privacy Policy explains how personal data is processed in connection with the multi-tenant Protoolbag SaaS platform operated by PROTOOLBAG YAZILIM TEKNOLOJİLERİ A.Ş. ("Protoolbag", "we") and the products offered through it (PMS — facility/IoT monitoring, FixFlow — maintenance management/CMMS, PHR — HR/payroll, PPM — project management, PEM — energy management, CRM and the operator console).

This policy distinguishes between our two different legal roles:

• Protoolbag as Data Controller: With respect to your own account, identity, billing, subscription and platform operations data. This policy mainly covers this role.
• Protoolbag as Data Processor: With respect to the business data uploaded to the platform by customer-tenants (subscribers) and the personal data contained therein (e.g. employee/payroll PII, CRM contacts). For such data, the data controller is the relevant customer-tenant; the processing terms are governed by a separate Data Processing Agreement (DPA) — see Data Processing Agreement.

Applicable legislation: the Law on the Protection of Personal Data No. 6698 (KVKK) (primary) and, with respect to data subjects located in the EU, the GDPR (General Data Protection Regulation — 2016/679).

2. Identity of the Data Controller (KVKK Art. 10)

3. Categories of Personal Data Processed

The table below covers the data for which Protoolbag is the data controller. Content uploaded by the customer-tenant itself (tickets, work orders, CRM records, HR/payroll records, etc.) is the subject of the DPA, not of this policy.

3.1 Special Categories of Personal Data (KVKK Art. 6 · GDPR Art. 9)

Special categories of personal data are not routinely processed within the scope of Protoolbag's own (controller) data.

However, in the HR/payroll (PHR) module, the following categories relating to employees may be processed by the customer-tenant: Turkish national ID number, IBAN, gross salary, date of birth, gender, marital status, address and emergency contact details. Some of these are special categories of personal data within the meaning of KVKK Art. 6 (and items such as gender/marital status may fall within the scope of GDPR Art. 9); they require heightened protection and — as a rule — explicit consent. For this data, the data controller is the customer-tenant; Protoolbag is only the data processor, and the processing terms are governed by Data Processing Agreement §3.1. An in-product KVKK consent module is provided in the HR module for managing KVKK explicit consent.

4. Purposes of Processing

• Access to the platform, authentication and account management (invitation-only registration),
• Ensuring role-based access control and multi-tenant data isolation,
• Running subscription, licensing and billing processes,
• Information security, prevention of misuse, audit trail and observability,
• Service-related notifications (e.g. task assignment, workflow e-mails),
• Providing optional artificial intelligence features (assistant, natural-language query, AI builder) (see §8),
• Fulfilling legal obligations and responding to legal claims.

5. Legal Bases (KVKK Art. 5/6 · GDPR Art. 6)

Strictly necessary functional browser storage (session token, language, theme) is strictly necessary for the provision of the service; it is not a cookie and does not require separate consent — for details see the Cookie Policy.

6. Retention Periods (Retention Schedule)

Personal data is retained for the period necessary for the purpose for which it is processed and provided for in the relevant legislation. Data whose retention period has expired is erased, destroyed or anonymised (KVKK Art. 7).

Erasure cascade and backup expiry: Erasure is carried out through the tenant data erasure process by deleting the linked records in the live database in sequence; copies in backups cease to exist when the relevant backup retention window expires. Records subject to financial/legal retention obligations may, by way of exception, be retained in anonymised/locked form.

7. Sub-processors and International Transfer

7.1 List of Sub-processors

Your data may be processed through the following sub-processors for the provision of the service. The current and contractual list is in the DPA's sub-processor table — see Data Processing Agreement §6.

Payments are currently received by bank transfer/EFT; when an online payment service provider is put into service, it will be added to this list.

E-mail providers that the customer-tenant can configure itself (Microsoft Exchange 365 / Graph, SendGrid) act as the Customer's own sub-processors; details in Data Processing Agreement §6.

7.2 International Transfer (GDPR Chapter V / KVKK Art. 9)

• Primary storage (EU): Platform data is held in Supabase's Frankfurt (Germany — EU/EEA) region. For GDPR purposes, this means that the data essentially remains within the EU.
• Transfer to the USA (AI and embedding sub-processors): The artificial intelligence (Anthropic, Google, Groq, OpenAI), embedding (Voyage AI) and e-mail (Resend) providers above are US-based; Standard Contractual Clauses (SCC) and/or the relevant transfer safeguard are applied to transfers to these providers.
• TR → EU transfer (KVKK Art. 9): The transfer of data from Türkiye to the infrastructure in the EU (Frankfurt) constitutes a transfer abroad within the meaning of KVKK Art. 9 and requires an appropriate transfer basis; this transfer is carried out in accordance with the instruments provided for under the current KVKK cross-border transfer regime (adequacy decision, standard contract, written undertaking or explicit consent).

8. Artificial Intelligence Transparency (AI Transparency)

The platform offers optional artificial intelligence features. This section explains how these features work, within the framework of the GDPR transparency principles and the KVKK obligation to inform.

• Which features use AI: The AI assistant, natural-language data query, module/design creation with AI (AI builder), and text embedding and result ranking for document search.
• Which providers: For inference, one provider among Anthropic (Claude), Google (Gemini), Groq and OpenAI with failover; for embeddings, Voyage AI. The list of providers is in §7.1.
• What data is sent: Only when you use the relevant feature are the prompt you enter and the context text accompanying that prompt transmitted to the provider. This content may include personal data provided by the user.
• Model training: Under the API terms of use of the relevant providers, inputs sent via the API are not used for training the models.
• International transfer: These providers are US-based; the transfer is subject to the safeguards in §7.2.
• Human oversight: Artificial intelligence outputs are in the nature of suggestions/assistance; final decisions remain under the user's oversight. They are not used for a fully automated decision producing legal effects concerning you (GDPR Art. 22 / KVKK Art. 11).
• Opting out: The artificial intelligence features are optional; as long as you do not use them, no prompt data is sent to the relevant providers.

9. Rights of the Data Subject and Application Procedure (KVKK Art. 11 · GDPR Art. 15-22)

9.1 Your Rights

As a data subject, you have the following rights:

• To learn whether your data is processed and to request information/access (GDPR Art. 15 · KVKK Art. 11),
• Rectification (GDPR Art. 16 · KVKK Art. 11),
• Erasure / right to be forgotten (GDPR Art. 17 · KVKK Art. 7/11),
• Restriction of processing (GDPR Art. 18),
• Portability — in a structured, machine-readable format (GDPR Art. 20),
• To object to processing (GDPR Art. 21 · KVKK Art. 11),
• To object to fully automated decisions / profiling (GDPR Art. 22 · KVKK Art. 11),
• In consent-based processing, to withdraw consent and to claim compensation for damage.

9.2 Exercise of Rights and Mechanisms in Place

The platform technically supports these rights:

• Data portability / export: The data export feature (a JSON/CSV package at user or tenant level; consistent with the "structured, machine-readable" format in GDPR Art. 20).
• Erasure: The tenant data erasure process (linked records are deleted in sequence, it is verified that no record remains, a record of the erasure operation is kept or the data is anonymised) and the user account deletion process.
• Accountability: Tracking of sensitive changes through audit records.

9.3 Application Channel, Identity Verification and Time Limits

• Application channel: E-mail to info@protoolbag.com or a written application to Bilişim Vadisi, Gülbahçe Mah. İçmeler Cad. No:14/1 İç Kapı No: B05, Urla / İzmir, Türkiye.
• Identity verification: To prevent misuse, the applicant's identity is verified by reasonable methods before the request is fulfilled.
• Response time: At the latest 30 days under KVKK Art. 13; 1 month under GDPR Art. 12 (for complex requests, an extension of 2 months is possible under the GDPR). Requests concerning tenant business data (processor role) are forwarded to the relevant customer-tenant (controller) — see Data Processing Agreement §7.

10. KVKK Privacy Notice and Explicit Consent

For the detailed KVKK Art. 10 privacy notice and the explicit consent text relating to cases requiring explicit consent, see the KVKK Privacy Notice. Employee consents in the HR module are managed with the in-product KVKK consent module.

11. Security — Technical and Organisational Measures (TOM · KVKK Art. 12 · GDPR Art. 32)

Protoolbag applies the following technical and organisational measures for the security of personal data.

• Tenant isolation: Row-level security (RLS) on all tables — on all tables in the database, such that each tenant can access only its own data.
• Authentication & authorisation: Signed session tokens and page-level access control, organisation-scoped role-based authorisation (RBAC), multi-factor authentication (MFA) with TOTP, invitation-only registration.
• Content security policy (CSP): Only scripts loaded from our own domain run; dynamic code execution is blocked; the application cannot be embedded in frames of other sites; HSTS and content type protection (nosniff) are enabled.
• Encryption: In transit HTTPS/WSS + HSTS; at rest Supabase managed encryption; signed-URL model for storage.
• Audit logging: Server-side validated system records (only permitted action types, with IP address) and audit records for sensitive changes.
• Outbound connection (SSRF) defence: In notifications sent from the platform to external systems (webhooks), access to private IP addresses is blocked, DNS rebinding is prevented and redirects are not followed.
• Observability & incident response: Central recording of server and browser errors and monitoring on the operator dashboard; a written incident response procedure.

Alignment with standards (for information): The controls above are designed to align with the trust principles of ISO/IEC 27001 (ISMS), ISO/IEC 27701 (PIMS) and SOC 2. This statement is a compliance objective; unless otherwise documented, the company does not claim to hold any certification in respect of these standards.

These measures reflect the current state and are continuously reviewed; additional hardening such as field-level encryption is being evaluated.

12. Personal Data Breach Notification (KVKK Art. 12 · GDPR Art. 33-34)

In the event of a personal data breach:

• GDPR: Notification to the supervisory authority within 72 hours of becoming aware of the breach (Art. 33); notification without undue delay to data subjects if there is a high risk to them (Art. 34).
• KVKK: Notification to the Personal Data Protection Board as soon as possible (72 hours pursuant to the Board's decision) and to the affected data subjects within a reasonable time.
• Tenant data: For breaches concerning the customer-tenant's data, the notification flow is subject to the DPA (Protoolbag = data processor; informs the customer without undue delay) — see Data Processing Agreement §8.
• Internal process: Breaches are handled in accordance with Protoolbag's written incident response procedure.

13. Processing Inventory / Records (GDPR Art. 30) and VERBİS

• Record of processing activities (RoPA): Protoolbag maintains a record of processing activities under GDPR Art. 30 and updates it as processing activities change.
• VERBİS: The obligation to register with the Data Controllers' Registry (VERBİS) is assessed according to the thresholds set by the Personal Data Protection Board; once registration is made, the registry information will be added to §2.

14. Changes

This policy may be updated; the current version is published at protoolbag.com/en/legal/privacy-policy and in the "Legal documents" section of the application portal. The version number and effective date of each document are shown below its title, and changes are shown in the version history at the end of the document. Reasonable notice is given of material changes.

Version history