1. Data Controller
Data controller under Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR"):
- Company: vita RnD Teknoloji Anonim Şirketi
- Address: Sanayi Mah. Teknopark Bul. No: 1/4C İç Kapı No: 307 Pendik / İstanbul, Türkiye
- Email: kvkk@vitarnd.com
- Tax No: 9251032374
2. Personal Data We Collect
When you use our service, we may collect personal data in the following categories:
a) Account and Identity Data
- Full name, company name
- Email address
- Password (stored encrypted, never kept in plain text)
b) Billing and Payment Data
- Billing address, tax ID number, tax office
- Payment transaction records (we do not store card numbers; they are processed by PayTR)
c) Technical and Usage Data
- IP address, browser type, operating system
- API call logs: endpoint, timestamp, response time, status code, number of nodes
- Session and cookie data
- Website visit and page view information (unless analytics cookies are turned off; for visitors arriving via a link in one of our emails, also linked to their customer record)
d) Data Processed Through the API
Coordinates and logistics data you send for route optimization. This data is used to process your request and is not recorded; it is deleted from memory once the API response has been generated.
3. Purposes of Processing and Legal Bases
We process your personal data for the following purposes and on the following legal bases:
- Performance of a contract: Creating your account, providing API access, managing subscriptions, issuing invoices.
- Legal obligation: Keeping invoice and payment records under tax legislation.
- Legitimate interest: Ensuring service security, detecting fraud, usage analysis, linking visits from email links to the customer record, improving service quality.
- Explicit consent: Marketing emails and product updates (your consent is obtained separately and you can withdraw it at any time).
4. Data Sharing and Transfer
We do not sell, rent or transfer your personal data to third parties for commercial purposes. Data is shared with the following parties only where necessary to provide the service:
- Infrastructure service providers: Hosting, database, authentication, email delivery and security (bot protection) infrastructure. Transfers are carried out in accordance with KVKK Art. 9.
- Analytics and ad measurement services: Statistical data on site usage (unless you turn off analytics and marketing cookies).
- PayTR Ödeme Hizmetleri A.Ş. (Türkiye): Payment processing. A data processing agreement under KVKK is in place.
- Paraşüt (Fonzip Yazılım A.Ş., Türkiye): Accounting and e-invoicing integration.
- Competent authorities: Data may be shared with the relevant official bodies where required by law or a court order.
5. Retention Periods
- Account data: For as long as the account is active and for 3 years after the account is deleted.
- Invoice and payment records: 10 years, as required by tax legislation.
- API logs: 90 days (for security and troubleshooting).
- Marketing consents: Until consent is withdrawn or for 3 years from the last interaction.
Data whose retention period has expired is securely deleted or anonymized.
6. Data Security
The technical and administrative measures we apply to keep your personal data secure:
- All communication is encrypted with TLS 1.2+.
- Passwords are stored hashed with bcrypt.
- API keys are stored as SHA-256 hashes; the full key is shown only at the moment it is created.
- Database access is restricted with Row Level Security (RLS).
- Administrator access is protected through a separate internal tool with multi-factor authentication.
- In the event of a data breach, the competent authorities and affected persons are notified under KVKK Art. 12 and GDPR Art. 33.
7. User Rights
Under KVKK Art. 11 and GDPR Art. 15-22, you have the following rights:
- Access: To request information about the data processed about you.
- Rectification: To request correction of inaccurate or incomplete data.
- Erasure: To request deletion of your data ("right to be forgotten").
- Restriction of processing: To request that processing be stopped under certain conditions.
- Portability: To request your data in a machine-readable format.
- Objection: To object to processing based on legitimate interest or for direct marketing.
- Withdrawal of consent: To withdraw your consent for processing based on consent.
You can send your requests to kvkk@vitarnd.com. After identity verification, your request is answered within 30 days at the latest. Your right to object to our response is reserved; in Türkiye you can apply to the Personal Data Protection Authority (kvkk.gov.tr).
8. Cookies
For detailed information on our use of cookies, please see our Cookie Policy.
9. Changes to This Policy
We may update this policy when necessary. Significant changes are notified by email. The current version is always available on this page.