Effective date: 11.11.2026
This policy explains which personal data the Çalışkan Galvaniz iOS app (the "App") and the management panel it connects to process, why they are processed and how they are protected. The data controller is Çalışkan Galvaniz Metal İnş. San. Tic. Ltd. Şti. For the company's general policy, see the Protection of Personal Data page.
1. Who uses the App?
The App is only for Çalışkan Galvaniz staff and authorised employees of the company's business customers. Accounts cannot be created in the App. Company administrators create them in the management panel.
2. Data we process
Account data:
- Username and full name
- Role (e.g. supervisor, customer) and the company and plant you belong to
- Password. It is stored hashed; company staff cannot see your password.
- For some administrator roles, a two-step verification (TOTP) record
Business records you enter in the App:
- Vehicle notices: licence plate, driver name and phone, weighbridge weight, items and quantities carried
- Production, stock, shipment and material movements
- Which user entered each record and when
Device and technical data:
- Notification token: the device identifier Apple issues so we can send notifications to your phone. It is not collected if you do not allow notifications.
- Request log: the identifier, type and result of each operation, so that the same record is not written twice on a weak connection
- Session: after you sign in, your session is kept in your device's secure key store (iOS Keychain).
Data we do not process:
- Location, camera, photos, microphone, contacts and health data are not processed.
- There are no ads. The advertising identifier (IDFA) is not used.
- There are no third-party analytics or tracking tools. The App does not track you across other apps or websites.
3. Why we process data
- To create your account, verify your identity and show the screens your role allows
- To run the galvanizing service: receiving goods, planning and recording production, tracking stock and shipping
- To show customers the status of their own goods
- To send notifications, for example when a vehicle arrives or goods are ready
- To prevent errors and misuse by recording who entered each record
- To meet legal obligations
The legal grounds are the performance of a contract, compliance with legal obligations and the company's legitimate interests under Article 5(2) of the Turkish Personal Data Protection Law (KVKK).
4. Data kept on your device
So that it also works without internet, the App keeps a copy of the data shown to you and records not yet sent in a local database on your device. This data is stored with iOS file protection. It is removed from the device when you sign out or delete the App.
5. Service providers
Your data is not sold or shared for advertising. It is only transferred to the following providers needed to run the App:
- Supabase: database, authentication and server hosting (European Union, Frankfurt)
- Apple Push Notification service: delivering notifications to your device (USA / global)
- Expo Push Service: passing notifications to Apple (USA)
- GitHub: encrypted daily database backup (USA / global)
Notifications carry only the notification text and the notification token. Backups are encrypted; the provider cannot read their contents. Transfers abroad comply with Article 9 of the KVKK. Otherwise data is only shared with competent public authorities when required by law.
6. Retention
- Account data: kept while the account is open.
- Business records (vehicles, stock, production, shipments): kept for the commercial and tax retention periods.
- Notification token: revoked when you sign out or the account is closed.
- Backups: kept for 30 days, then deleted automatically.
Data whose retention period has ended is deleted or anonymised.
7. Security
- All traffic between the App and the server is encrypted with HTTPS.
- Each user can only see the data their role and company allow. This rule is enforced in the database.
- Two-step verification is mandatory for administrator roles.
8. Your rights and account deletion
Under Article 11 of the KVKK you have the right to:
- learn whether your data is processed and request information,
- request correction, deletion or destruction of your data,
- learn who your data has been transferred to,
- object and claim compensation for damages.
Deleting your account and personal data: because accounts are created by the company, you only need to send us a request. Send it to info@caliskangalvaniz.com with your registered username. Your request is completed within 30 days at the latest. Your account is closed and your name and contact details are deleted. Business records subject to legal retention are kept in a form that can no longer be linked to you.
You can also end the App's access at any time by turning off notifications, signing out or deleting the App.
9. Children
The App is for business use. It is not designed for people under 18 and we do not knowingly collect data from them.
10. Changes
When this policy is updated, the new text is published on this page and the effective date changes. Significant changes are also announced to App users.
11. Contact
Çalışkan Galvaniz Metal İnş. San. Tic. Ltd. Şti. Email: info@caliskangalvaniz.com. For address and phone, see the Contact page.