Privacy Policy & KVKK

Version: 1.0.0 | Effective Date: January 1, 2025

1. Data Controller Information and Contact Details

For the purposes of applicable data protection legislation, the data controller responsible for the processing of your personal data is identified as follows:

Legal Entity Name: Collabrix
Registered Office Location: Istanbul, Republic of Turkey
Data Protection Officer Contact Email: kvkk@deepytech.com

The data controller assumes full responsibility for determining the purposes and means of processing personal data and ensuring compliance with all applicable legal requirements.

2. Categories of Personal Data Collected and Processed

In the course of providing our services and maintaining the functionality of the Collabrix platform, we collect and process various categories of personal data. The specific types of personal information we collect include, but are not limited to, the following:

2.1 Registration and Account Identification Information

• Email Address: Required for account creation, authentication, and official communication purposes
• Display Name: User-designated identifier for profile presentation and team collaboration
• Unique User Code: System-generated six-character alphanumeric identifier assigned to facilitate user discovery and team member addition
• Authentication Credentials: Password information stored in encrypted format using industry-standard cryptographic hashing algorithms
• Profile Picture: Optional photographic or graphical representation uploaded at the user's discretion

2.2 Usage and Behavioral Data

• User-Generated Content: All projects, tasks, team structures, documents, comments, and collaborative materials created, uploaded, or otherwise provided by the user within the platform
• Activity and Interaction Logs: Comprehensive records of user activities, interactions, feature utilization, and chronological timestamps associated with platform usage
• Device and Technical Information: Details regarding device type, operating system version, application version, browser type, IP address, and other technical identifiers necessary for service provision
• Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens utilized exclusively for delivering push notifications and real-time updates to registered devices

3. Legal Basis and Purposes for Data Processing

We process your personal data only when we have a valid legal basis as required by applicable data protection laws. The following legal grounds justify our processing activities:

• Contractual Necessity (Article 6(1)(b) GDPR): Processing is necessary for the performance of the contract between you and Collabrix, specifically to provide, maintain, and deliver the project management and collaboration services you have subscribed to, including account management, feature access, and technical support.
• Legitimate Interests (Article 6(1)(f) GDPR): Processing is necessary for the purposes of our legitimate interests in improving service quality, enhancing user experience, ensuring platform security, preventing fraudulent activities, conducting analytics to understand usage patterns, and maintaining the operational integrity of our systems, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent (Article 6(1)(a) GDPR): Where required by law or where we seek to process data for specific optional features such as personalized push notifications, marketing communications, or advanced analytics, we obtain your explicit and freely given consent, which you may withdraw at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Legal Obligations (Article 6(1)(c) GDPR): Processing is necessary for compliance with legal obligations to which Collabrix is subject, including but not limited to tax regulations, financial reporting requirements, and responses to lawful requests from governmental authorities.

4. International Data Transfers and Cross-Border Processing

5. Purposes and Scope of Data Utilization

The personal data we collect is processed exclusively for the following legitimate purposes, which are essential to the operation and improvement of our services:

• Service Provision and Maintenance: To provide, operate, maintain, and administer the Collabrix platform, including user account management, authentication, authorization, and ensuring continuous availability and functionality of all platform features.
• Collaboration and Team Management Features: To enable and facilitate collaborative functionalities, including but not limited to team creation and management, project organization, task assignment and tracking, document sharing, real-time updates, and inter-user communication within the platform environment.
• Communications and Notifications: To send you service-related notifications, updates, technical alerts, security warnings, administrative messages, and, where you have provided consent, marketing communications regarding new features, updates, or promotional offers.
• User Experience Enhancement and Platform Optimization: To analyze usage patterns, conduct statistical analysis, identify areas for improvement, develop new features, optimize application performance, and enhance overall user experience through data-driven insights.
• Security, Fraud Prevention, and Abuse Detection: To detect, prevent, and respond to fraudulent activities, unauthorized access attempts, security breaches, violations of our Terms of Use, and other potentially harmful or illegal activities that may compromise the integrity of our platform or the safety of our users.

6. Data Sharing, Disclosure, and Third-Party Access

Fundamental Principle - No Sale of Personal Data: We categorically do not sell, rent, lease, or otherwise commercially exploit your personal data to third parties for their marketing or other purposes. We value your privacy and are committed to protecting the confidentiality of your information.

However, we may share your personal data with the following categories of recipients under strictly defined circumstances and for specific legitimate purposes:

• Third-Party Service Providers (Data Processors): We engage Google Firebase and its affiliated services as our primary technology infrastructure provider for cloud hosting, database storage and management, user authentication and identity management, push notification delivery, and analytics services. These service providers act as data processors on our behalf and are contractually obligated to process your data only in accordance with our instructions and to maintain appropriate security measures.
• Team Members and Collaborators: In accordance with the collaborative nature of the platform, certain information such as your display name, email address, profile picture, and user code may be visible to other members of teams or projects in which you participate. This sharing is essential to facilitate team collaboration and is limited to the information necessary for collaborative work.
• Legal and Regulatory Authorities: We may disclose your personal data when required to do so by applicable law, legal process, court order, governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, prevent illegal activities, or respond to lawful requests from public authorities, including to meet national security or law enforcement requirements.
• Business Transfers: In the event of a merger, acquisition, reorganization, sale of assets, bankruptcy, or other business transaction involving Collabrix, your personal data may be transferred to the successor entity, provided that such entity agrees to comply with this Privacy Policy or provides you with notice and an opportunity to opt out of such transfer.

7. Data Subject Rights Under GDPR and KVKK

In accordance with the General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK), you possess certain fundamental rights regarding your personal data. We are committed to facilitating the exercise of these rights in a timely and transparent manner:

• Right of Access (GDPR Article 15, KVKK Article 11): You have the right to obtain confirmation as to whether or not your personal data is being processed, and if so, to request access to such data along with information about the purposes of processing, categories of data processed, recipients of the data, and the envisaged retention period.
• Right to Rectification (GDPR Article 16, KVKK Article 11): You have the right to request the correction, completion, or updating of inaccurate, incomplete, or outdated personal data concerning you without undue delay.
• Right to Erasure / Right to be Forgotten (GDPR Article 17, KVKK Article 7): You have the right to request the deletion of your personal data and the permanent termination of your account, subject to certain legal exceptions where we may be required to retain specific information for compliance with legal obligations or for the establishment, exercise, or defense of legal claims.
• Right to Data Portability (GDPR Article 20, KVKK Article 11): You have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as JSON or CSV) and to transmit that data to another controller where technically feasible.
• Right to Object (GDPR Article 21, KVKK Article 11): You have the right to object to the processing of your personal data on grounds relating to your particular situation, particularly where processing is based on legitimate interests, including objecting to direct marketing communications.
• Right to Withdraw Consent (GDPR Article 7(3), KVKK Article 5): Where processing is based on your consent, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing conducted prior to withdrawal. You may opt out of non-essential notifications and marketing communications at any time through your account settings.
• Right to Lodge a Complaint (GDPR Article 77, KVKK Article 14): You have the right to lodge a complaint with the relevant supervisory authority if you believe that the processing of your personal data violates applicable data protection laws.

Procedures for Exercising Your Data Subject Rights

To exercise any of the aforementioned rights, you may utilize the following methods:

• Account Deletion: Navigate to Settings → Account Settings → Delete Account within the application interface to initiate permanent account deletion.
• Data Export and Portability Requests: Submit a formal request via email to our Data Protection Officer at kvkk@deepytech.com, specifying the nature of your request and providing adequate identification to verify your identity.
• Data Rectification and Updates: Modify and update your personal information directly through the application settings interface, or contact us for assistance with corrections that cannot be made through self-service options.
• General Rights Inquiries: For any questions or concerns regarding your data subject rights or the exercise thereof, please contact kvkk@deepytech.com. We commit to responding to all legitimate requests within thirty (30) calendar days, or as otherwise required by applicable law.

8. Data Retention Periods and Deletion Procedures

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention periods are as follows:

• Active User Accounts: Personal data associated with active user accounts is retained for the entire duration of your continued use of the Collabrix platform and for as long as your account remains active and in good standing.
• Deleted Accounts: Upon user-initiated account deletion, all associated personal data will be permanently and irrevocably deleted from our active production systems within a maximum period of thirty (30) calendar days, subject to technical limitations and legal retention requirements.
• Inactive Accounts: Accounts that remain inactive for a continuous period exceeding twenty-four (24) months may be subject to deletion following prior written notification to the registered email address. Users will be provided with a reasonable opportunity to reactivate their accounts before permanent deletion occurs.
• Backup and Archival Systems: Data residing in backup systems and disaster recovery archives will be automatically purged and permanently deleted within ninety (90) calendar days following deletion from production systems, in accordance with our standard backup retention policies.
• Legal Retention Obligations: Notwithstanding the above, certain data may be retained for extended periods where required by applicable laws, regulations, legal proceedings, or for the establishment, exercise, or defense of legal claims, provided that such retained data is subject to appropriate safeguards and access restrictions.

9. Security Measures and Data Protection Safeguards

We implement and maintain comprehensive technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, disclosure, or any form of unlawful processing. Our security framework includes, but is not limited to:

• Encryption in Transit: All data transmissions between your device and our servers are protected using industry-standard Transport Layer Security (TLS) and Secure Sockets Layer (SSL) encryption protocols to ensure confidentiality and integrity during transmission over public networks.
• Password Security and Hashing: User authentication credentials are never stored in plain text. All passwords are hashed using state-of-the-art cryptographic algorithms (including bcrypt and scrypt) with appropriate salt values, rendering them computationally infeasible to reverse-engineer or decrypt.
• Enterprise-Grade Infrastructure: Our platform utilizes Google Firebase's enterprise-grade security infrastructure, which undergoes regular third-party security audits, maintains SOC 2 Type II compliance, and implements defense-in-depth security architecture with multiple layers of protection.
• Access Controls and Authentication: We implement strict role-based access controls (RBAC), multi-factor authentication options, and the principle of least privilege to ensure that access to personal data is restricted to authorized personnel and systems only when necessary for legitimate business purposes.
• Continuous Security Monitoring: We maintain continuous security monitoring, intrusion detection systems, automated vulnerability scanning, and regular security assessments to identify and remediate potential security threats in a timely manner.
• Regular Security Updates: Our systems and applications are subject to regular security updates, patches, and upgrades to address newly discovered vulnerabilities and maintain protection against evolving security threats.

10. Children's Privacy

Collabrix is not for users under 13 (16 in EU). We don't knowingly collect children's data.

11. Cookies & Tracking

• Firebase Analytics (anonymized)
• Session management
• Performance monitoring

Disable in: Settings → Privacy Preferences

12. Changes to Policy

We'll notify you of changes via:

• In-app notification
• Email
• Website notice

13. Contact Us

14. Compliance

This policy complies with:

• EU GDPR (General Data Protection Regulation)
• Turkish KVKK (Law No. 6698)
• CCPA (California Consumer Privacy Act)