Privacy Notice on the Processing of Personal Data

As Akyol Mobilya Orman Ürünleri Sanayi ve Ticaret Limited Şirketi ("Company"), acting as data controller under the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), we would like to inform you about the personal data processed through this mobile application ("Application") made available to our employees. The Application is available exclusively to Company employees. You may view this notice again at any time within the Application.

What data do we process?

• Identity data: first name, last name, Turkish ID number (used as your login username), date of birth, job title, employment start date
• Contact data: corporate e-mail address, internal extension number; and, subject to your explicit consent, personal e-mail address and mobile phone number
• Employment data: department, collar type, your direct manager, job description, your leave requests and leave history, your payslip and document requests
• Profile photo (optional, subject to your explicit consent)
• Financial data: travel expense and expenditure reports, receipt/invoice images you upload, amount and VAT details, cash advance requests; your salary and IBAN details as entered by Human Resources (the salary is not shown in the Application; the IBAN is shown only to you)
• Training data: training video completion records and quiz results
• Health data: the medical report you upload with a sick leave request (special category personal data)
• AI and voice content (if the Company enables the related features): questions you type or ask by voice to the AI Assistant and the research assistant, files you attach, voice recordings you upload for transcription and their text
• Participation content: your answers in non-anonymous surveys, your non-anonymous suggestions and complaints, your idea submissions, your OHS and emergency reports, life events board content
• Transaction security data: records of signing in to and out of the Application, session information, device notification identifier, and audit records of sensitive operations
• Workplace attendance (timekeeping) data (if the Company enables the Attendance Tracking feature and includes you in it): the date and time of your check-ins and check-outs at the workplace, the name of the terminal and of the defined workplace location, the verification method (QR code and/or location), the location taken from your device at the moment of the check-in/out (latitude, longitude, location accuracy, distance to the workplace area and the mock-location flag reported by the device; including, if the Company so chooses and your location service is on, the location at the moment of a QR code scan), IP address, device platform and app version; if the Company enables phone verification, the mobile phone number defined by Human Resources, the sending and verification records of verification codes, the random device key given to the verified phone (only its hash is stored on the server) and, on Android devices, line information used to detect a change of SIM (operator code and the line’s local sequence ID on the device); working time, break, late arrival, early leave, overtime, missing check-in/out and absence information calculated from these records; and, for manual corrections, the reason, the date and the person who made the correction
• Application usage data: the general in-app path of the screens viewed (e.g. "/leave/new"; it never contains record numbers, names, Turkish ID numbers or e-mail addresses), session start and duration, automatic events such as the first opening, update and removal of the Application, a randomly generated installation identifier specific to the Application, device type, brand and model, operating system and app version, screen resolution, language setting, and approximate location no more precise than city level (country, region, city) derived from the IP address; in the web version of the Application, cookies used for this purpose

In the anonymous modules (anonymous suggestion/complaint, anonymous question, anonymous emergency report, anonymous survey), your identity, IP address and device information are never recorded together with the content you submit; content submitted through these modules is never linked to you. Opening these screens is measured, as for any other screen, only as application usage data at screen-path level (e.g. "/suggestion/new") and is never linked to the content you submit.

For what purposes do we process your data?

• Receiving, processing and finalizing your leave, travel expense, advance, payslip and document requests, and managing the related approval workflows
• Carrying out internal announcements, notifications and communication processes
• Monitoring OHS and mandatory training, and managing OHS and emergency reports
• Managing surveys, suggestions/complaints and idea management processes
• Creating, authorizing and managing your user account
• Recording check-ins and check-outs at the workplace; determining working time, overtime, late arrivals and absences for timekeeping and payroll; verifying that check-ins and check-outs are made at the workplace and from your own verified phone; if the Company so chooses, recording where a QR code check-in/out was made
• Ensuring information security, preventing unauthorized access, and keeping audit records of sensitive operations
• Measuring statistically which screens of the Application are used and to what extent, detecting errors and usability problems, and improving the Application
• Fulfilling obligations arising from the Labour Law, the Occupational Health and Safety Law and other applicable legislation

Legal grounds

Your personal data is processed under Article 5/2 of the KVKK on the following legal grounds: the processing being expressly provided for by law, being directly related to the performance of your employment contract, being necessary for the Company to fulfil its legal obligations, and the legitimate interests of the Company, provided that your fundamental rights and freedoms are not harmed. Your profile photo, personal e-mail address and personal mobile phone number (except the number defined by Human Resources for phone verification) are processed solely on the basis of your explicit consent; withholding consent does not prevent you from using the core functions of the Application. The medical report you upload for sick leave is special category personal data and is processed under Article 6 of the KVKK to fulfil legal obligations relating to employment and occupational health and safety. Application usage data is processed on the basis of the Company’s legitimate interests (KVKK Article 5/2-f), provided that your fundamental rights and freedoms are not harmed; this data is not linked to your account (name, surname, Turkish ID number, e-mail), is not used for advertising, and no advertising identifier is collected. Workplace attendance (timekeeping) data is processed on the grounds of the performance of the employment contract (KVKK Article 5/2-c), the legal obligations arising from the Labour Law and related legislation on recording working time and overtime (KVKK Article 5/2-ç) and the Company’s legitimate interests (KVKK Article 5/2-f); the location taken at the moment of a check-in/out is processed solely to verify that it is made within the defined workplace area and, if the Company so chooses, to record where a QR code check-in/out was made, and only to that extent; no continuous location tracking takes place. For phone verification, your mobile phone number and the device key are processed on the same legal grounds solely to send the verification code and to ensure that check-ins and check-outs are made from your own verified phone; your number is not used for any other communication.

With whom is your data shared?

Within the Company, the details of your requests are visible to the people in your approval chain (your manager, their deputy if any, and HR); once your leave is approved, your name and leave dates (without the leave type) are sent as a notification to colleagues reporting to the same manager and are shown, with your profile photo, on the team calendar. Your attendance and timekeeping records are visible to HR and to your department manager and their deputy (within the departments they manage); the location taken at the moment of a check-in/out is visible to these authorised persons only in the record details and is not transferred abroad. You can see your own records on the attendance history screen of the Application. Your personal data may be shared with authorized public institutions and authorities where legally required, and with the supplier providing development and hosting services for the Application, acting as data processor and only to the extent required by the service. For phone verification, your mobile phone number and the verification code are transferred, for sending the SMS, to the SMS service provider established in Türkiye (Netgsm), acting as data processor. Application data is hosted on servers within the borders of Türkiye, with the exception of the following service providers, whose servers are located abroad, including in the United States: (i) push notifications are delivered through the Expo notification service (650 Industries, Inc., USA) to Apple (APNs) and Google (Firebase Cloud Messaging); these services receive the device notification identifier, the notification title and text, the unread notification count, and the in-app screen and record number opened when the notification is tapped; for system-generated leave request and approval notifications this text contains no name, leave type or dates, and the details are shown only on the Notifications screen inside the Application; (ii) application usage data is processed through the Google Analytics for Firebase service provided by Google LLC and Google Ireland Limited; (iii) training videos are played through YouTube (Google LLC); when a training video screen is opened the player loads from YouTube servers, your IP address and device and browser information are sent to Google, and YouTube may place cookies and similar identifiers on your device; (iv) receipt images you upload with expense reports (for automatic reading of the amount and date) and, if the Company enables the related features, your questions to the AI Assistant and the research assistant, attached files and other content required for the task are sent via OpenRouter, Inc. (USA) to the provider of the selected AI model (e.g. Google, OpenAI); depending on the selected model, your voice questions go either directly to that provider or to ElevenLabs (USA) for transcription; for voice recording transcription, recordings do not leave the country when the local engine is used and are sent to ElevenLabs only if the Company selects the ElevenLabs engine; (v) Cloudflare Turnstile is used for bot protection on the web admin panel login and the public account deletion page, which sends your IP address and browser information to Cloudflare, Inc. (USA). These transfers abroad are carried out under Article 9 of the KVKK by signing the standard contracts published by the Personal Data Protection Board with the relevant service providers and notifying them to the Personal Data Protection Authority. All communication takes place over encrypted connections.

How is your data collected?

Your data is collected electronically through the transfer of user records from Human Resources, through the entries, uploads and updates you make in the Application, and automatically during the operation of the Application. Application usage data is collected automatically through the Google Analytics for Firebase software component integrated into the Application, from the first time the Application is opened (including before you sign in); the web version of the Application uses cookies for this purpose. Photos you upload are stored after EXIF data containing location and device information has been removed. Your workplace check-ins and check-outs are collected when you scan, on the Attendance screen of the Application, the QR code shown on the terminal screen at the workplace entrance and/or through the location service of your device; location is taken only while the Attendance screen is open, the Application is in the foreground and you have granted location permission, and no location tracking takes place in the background or during working hours. When the QR code is scanned, the camera image is neither recorded nor sent to the server; only the scanned code is transmitted, together with, if the Company so chooses and your location permission and location service are on, the location at the moment of the scan, which is not used for verification (the scan is recorded even if no location can be taken). If the Company enables phone verification, check-ins and check-outs can only be made from a phone verified by an SMS code; the code is sent to your mobile phone by SMS, on Android devices only that SMS is read by the Application with your approval (the Application has no permission to access your SMS messages), and on iOS devices the code is entered from the keyboard suggestion. If you do not grant location permission and the verification method chosen by the Company requires location, your check-in/out cannot be recorded through the Application; in that case Human Resources may record it manually, stating the reason. When you choose the "nearest" sorting on the travel screens, your device’s current location is sent to the server only for sorting and is not stored; when you save a customer’s location using your device’s location, this information is stored as the location of that customer (business).

How long is your data retained?

• Leave records, survey results, training completion records and OHS reports are retained for the periods required by applicable legislation
• Audit records are retained for 5 years
• Workplace attendance (timekeeping) records and the related correction records are retained for the retention and limitation periods required by legislation on working time and wages
• Event-level and user-level records of application usage data are deleted in the service provider's monthly automatic deletion run once the 2-month retention period has expired; aggregated reports that contain no name, Turkish ID number, e-mail address or installation identifier (e.g. usage counts by screen, device type, app version and region) may be kept longer. The installation identifier stays on the device until the Application is removed or its data is cleared, and the expiry of analytics cookies in the web version is renewed on each visit, so they stay in the browser for 13 months after your last visit
• Life events board content is automatically archived after 90 days
• When your employment ends, your account is deactivated; your personal data is deleted, destroyed or anonymized within 10 years at the latest, except for records subject to statutory retention periods

Your rights

Under Article 11 of the KVKK, you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of the processing and whether the data is used in accordance with that purpose; know the third parties in Türkiye or abroad to whom your data has been transferred; request correction of incomplete or inaccurate data; request deletion or destruction of your data; request that such corrections, deletions or destructions be notified to third parties to whom the data has been transferred; object to a result arising against you through analysis carried out exclusively by automated systems; and claim compensation for damages arising from unlawful processing.

You may submit requests regarding these rights in writing to the Human Resources department or by e-mail to info@akyollife.com.tr. Your request will be concluded free of charge within 30 days at the latest.