# KBM Teknik App Privacy Policy **Last Updated:** 12.03.2026 **Effective Date:** 02.05.2025 --- ## 1. Introduction Thank you for choosing KBM Teknik ("we", "our", or "us"). This Privacy Policy explains how our mobile and web application collects, uses, processes, and shares your personal information when you use it on Android, iOS, and web platforms. We are committed to protecting your data and respecting your privacy in full compliance with applicable data protection laws, including the Turkish Personal Data Protection Law (KVKK – Law No. 6698) and the General Data Protection Regulation (GDPR). **Data Controller:** Konya Metropolitan Municipality – Konya Science Center (Konya Büyükşehir Belediyesi – Konya Bilim Merkezi) Website: konyabilimmerkezi.com Contact: kbmteknikapp@gmail.com --- ## 2. Information We Collect ### 2.1 Information You Provide When you register or use our services, you may provide us with the following information: - Full name - Institutional email address (@kbm.org.tr) - Personal email address - Encrypted password - Department and sub-department details - Job title and user role (e.g., admin, employee) - Descriptions of problems and task reports - Comments and messages within the task management system - Images and documents uploaded as part of problem documentation ### 2.2 Automatically Collected Information To improve your experience, our app automatically collects: - Device tokens for push notifications - Authentication and session states - Device information (operating system, device type) - Usage data and interaction metrics - System log records and audit trail logs - Notification preferences --- ## 3. Legal Basis for Processing (KVKK) We process your personal data on the following legal grounds under KVKK: | Article | Basis | |---|---| | Article 5/2-c | Processing is necessary for the performance of a contract to which you are a party | | Article 5/2-f | Processing is necessary for legitimate interests pursued by the data controller, provided these do not override your fundamental rights | | Article 5/2-ç | Processing is necessary for compliance with a legal obligation | | Article 9/1 | Explicit consent for the transfer of personal data abroad (cross-border transfer to Firebase infrastructure in the EU) | --- ## 4. How We Use Your Information We use your information to: - Authenticate and manage user access securely - Facilitate and enhance task management functionality - Send push notifications and updates about tasks - Provide institutional email notifications for task assignments and status updates - Support password reset and account recovery processes - Improve, maintain, and develop our services - Communicate important information regarding your tasks and issues - Process and securely store uploaded images and documents - Monitor task status and assign responsibilities appropriately - Fulfill legal obligations and respond to official requests from authorized public authorities - Maintain audit logs for operational accountability --- ## 5. Consent and KVKK Compliance ### 5.1 Two-Tier Consent System Our application enforces a mandatory two-tier consent model before granting access: 1. **KVKK Disclosure Acceptance (KVKK Aydınlatma Metni):** Informs you about data collection, processing purposes, legal basis, data recipients, storage periods, and your rights under KVKK Law No. 6698. 2. **Explicit Consent for Cross-Border Data Transfer (Yurt Dışına Aktarım Açık Rıza Metni):** Covers your informed and explicit consent to the transfer of your personal data to Google Firebase servers located in Frankfurt, Germany (European Union), as required by KVKK Article 9/1. ### 5.2 Consent Enforcement Both consents are mandatory and enforced at multiple checkpoints: - **Registration:** Both consent checkboxes must be checked before the registration form can be submitted - **Login:** The application checks whether both consents are on record; if not, a non-dismissible blocking dialog is presented - **App Startup:** Consent status is verified for all authenticated users before navigating to the home screen - **Web Platform:** An additional safety check is performed upon entering both the admin and employee panels to ensure no user bypasses the consent requirement > Consent status is stored in the Firestore database for each user account and is visible to administrators in the user management panel. ### 5.3 Consent Withdrawal You may withdraw your consents at any time; however, please note that withdrawal may result in restricted or lost access to the application, as processing is necessary to provide the service. --- ## 6. Data Storage and Security ### 6.1 Cloud Services | Service | Purpose | |---|---| | Firebase Authentication | Secures user credentials | | Cloud Firestore | Stores user data and consent records | | Firebase Storage | Holds uploaded images and document attachments | | Firebase Cloud Messaging | Enables push notification delivery | | Firebase Performance Monitoring | Supports service optimization | | Automatic Cloud Backups | Performed at regular intervals (every 3 days) | ### 6.2 Geographic Location of Data Your data is stored and processed on Google Firebase infrastructure located in **Frankfurt, Germany (European Union)**. This region operates under GDPR protections. By providing your explicit consent, you acknowledge and agree to this international transfer. ### 6.3 Security Measures We employ industry-standard security practices, including: - Secure and encrypted user authentication - HTTPS for all data transfers - Encrypted local storage for sensitive data - Role-based access controls within the app - Audit trail logging for all critical operations --- ## 7. Third-Party Services Our app utilizes reputable third-party services to deliver and enhance functionalities, including: - Firebase (Authentication, Firestore, Storage, Cloud Functions, Messaging, Performance Monitoring) - Image Picker for photo uploads - Flutter Local Notifications for timely alerts - KBM Sys web platform (accessible via embedded web view on the web version of the application) --- ## 8. Data Sharing We do not sell or rent your personal information. Data may be shared only: - Internally within your organization for task management purposes - With managers and authorized unit heads for operational oversight - With domestic IT and cloud support service providers under strict confidentiality agreements - With Google Firebase (EU) for infrastructure services, under the cross-border transfer consent - With authorized public institutions and official bodies as required by law or legal processes --- ## 9. User Rights Under **KVKK Law No. 6698, Article 11**, you have the following rights regarding your personal data: - Right to **learn** whether your personal data has been processed - Right to **request information** about the processing of your data - Right to **access** your personal data - Right to **request correction** of incomplete or inaccurate data - Right to **request deletion or destruction** of your data where legally permissible - Right to **object** to processing based on automated systems that produce decisions against your interests - Right to **request compensation** for damages arising from unlawful processing To exercise your rights, please contact us at: **kbmteknikapp@gmail.com** --- ## 10. Cookies and Local Storage Our app uses cookies and local storage to: - Remember your login status and preferences - Enhance app performance and usability - Maintain session information for improved navigation --- ## 11. Web Platform Our application is also available as a web platform. On the web version: - All KVKK and explicit consent requirements are equally enforced - An additional consent verification layer is applied upon entry to the web navigation panels - The **KBM Sys** management interface is accessible via embedded iframe *(only on web; this feature is not available on mobile or desktop platforms)* --- ## 12. Children's Privacy KBM Teknik is designed for professional use within institutional environments. We do not knowingly collect personal data from minors. All users are expected to be adults acting in their professional capacity. --- ## 13. Data Retention We retain your personal data only for as long as necessary to provide our services or as required by applicable law. Once the retention period expires or the purpose of processing ceases to exist, your data will be deleted, destroyed, or anonymized in accordance with **KVKK Article 7** and applicable regulations. You may request deletion of your account and associated data at any time by contacting us. --- ## 14. International Data Transfers Your personal data may be transferred to and processed in countries outside of Turkey, specifically to **Google Firebase servers in Frankfurt, Germany (EU)**. These transfers occur only with your explicit prior consent (KVKK Article 9/1) and under the safeguards provided by GDPR compliance in the destination region. You may withdraw your consent for international transfer at any time, though this will affect your ability to use the application. --- ## 15. Changes to This Privacy Policy We may update this Privacy Policy periodically to reflect changes in our services, legal obligations, or new features. Any significant changes will be communicated within the app or via email. The "Last Updated" date at the top of this document reflects the most recent revision. Continued use of the app constitutes your acceptance of the updated Policy. --- ## 16. Contact Information If you have any questions, requests, or concerns regarding this Privacy Policy, your personal data, or your rights under KVKK, please contact us at: | | | |---|---| | **Email** | kbmteknikapp@gmail.com | | **Data Controller** | Konya Metropolitan Municipality – Konya Science Center (Konya Büyükşehir Belediyesi – Konya Bilim Merkezi) | | **Website** | konyabilimmerkezi.com | --- ## 17. Compliance We comply with applicable privacy laws and regulations, including: - **KVKK** – Kişisel Verilerin Korunması Kanunu (Law No. 6698, Turkey) - **GDPR** – General Data Protection Regulation (EU) - **CCPA** – California Consumer Privacy Act - Google Play Store and Apple App Store Privacy Requirements - Other relevant data protection standards