KVKK Privacy Notice

Data controller: CNUTLABS YAZILIM MÜHENDİSLİK TİCARET LİMİTED ŞİRKETİ ("CNUTLABS") — Göztepe Mah. Uşakizade Muammer Bey Sk. No: 26 İç Kapı No: 13, Konak / İzmir, Türkiye · MERSIS: 0211155028800001 · Email: info@cnutlabs.com.

The business using the Point PDKS service is the data controller for its own employees' personal data; CNUTLABS processes that data on the business's behalf as data processor. For website visits, data sent through the forms on the website and the mobile app's crash reports, CNUTLABS is the data controller.

The following categories of personal data are processed:

• Identity data: first name, last name, employee/registration number.
• Contact data: email address, phone number.
• Location data: a momentary location point recorded only at the moment of clock-in/out, solely to verify whether you are within the relevant location's geofence. No continuous location tracking is performed.
• Activity/attendance data: clock-in/out times, lateness, early leave, overtime, leave and shift records.
• Device data: device identifier (for single-device locking), IP address and browser/app information.
• Fake-location attempt records: coordinates, reason, IP and app information, recorded for fraud detection.
• Website forms: full name, email address, phone number, company name, number of employees, city, request subject and your message; in the self-service trial sign-up also the organization type, IP address and verification data (section 9).
• Website visit data: the page viewed, the link the visit came from (including campaign tags), browser, operating system, device type, screen size, language, approximate location derived from the IP address (country, city), and clicks on free trial buttons, phone and email links — for a click only the kind of link and its place on the page, not the phone number or email address.
• Server logs: for every request to the website and the panel, the IP address, time, requested address and browser information.
• Crash reports (mobile app versions 1.4.0 and earlier): the error log, device model, operating system and app version; in the iOS app also the user number, full name, email address, role and department, in the Android app the app's warning and error logs.

Data is collected through the mobile app, the web panel and the forms on the website, by automated and partly automated means. Please do not write special categories of personal data, such as health information, in form messages.

Visit data is collected only on the promotional pages, with the open-source Umami software running on our own server in Türkiye. No cookies or browser storage are used and the IP address itself is not stored; no visit data is collected on the sign-in page or in the panel.

Biometric data such as fingerprints or faces is not processed. Point PDKS deliberately operates biometric-free.

• Creating and verifying employee attendance (clock-in/out) records.
• Operating shift, leave and overtime processes.
• Ensuring record reliability through location verification and fake-location detection.
• Maintaining service security, keeping audit logs and preventing misuse.
• Fulfilling legal obligations and responding to requests.
• Handling free trial, quote / contact and partner requests sent through the forms on the website, and contacting you by phone or email for that purpose.
• Opening a trial account through the self-service sign-up, verifying the phone number and preventing abuse (section 9).
• Following how often the promotional pages are visited, which channel visitors come from and which links are used, through aggregate visit statistics.
• Showing workplace locations on a map in the web panel.
• Fixing errors in the mobile app.

The legal ground relied on for each purpose (KVKK Art. 5/2) is as follows:

• Attendance records, shift, leave and overtime processes and location verification: the legal ground for employee data is determined by the business as data controller and stated in its own notice; CNUTLABS processes this data on the business's instructions under the service contract with the business.
• Service security, audit logging and preventing misuse: the data controller's legitimate interest (Art. 5/2(f)).
• Fulfilling legal obligations and responding to requests: the data controller's legal obligation (Art. 5/2(ç)).
• Free trial and partner applications and quote requests: processing directly related to the conclusion of a contract (Art. 5/2(c)).
• Other questions through the contact form (sales, technical support, other): our legitimate interest in answering your question (Art. 5/2(f)).
• Self-service trial sign-up: opening the account and verifying the phone are directly related to the conclusion of a contract (Art. 5/2(c)); one trial account per phone and the attempt limits rest on our legitimate interest (Art. 5/2(f)) — details in section 9.
• Website visit statistics: our legitimate interest in seeing which pages and links of our site are used (Art. 5/2(f)).
• The map in the web panel and fixing errors in the mobile app: our legitimate interest in providing the service in working order (Art. 5/2(f)).

The "I have read the KVKK Notice" box on the forms is neither an approval nor explicit consent; it only records that this notice was presented to you. Data sent through the forms is not processed on the basis of explicit consent.

Your personal data is transferred to the following recipient groups, for the purpose stated next to each and only as far as that purpose requires:

• Hosting infrastructure provider (Türkiye) — to run the service and the website; our servers are in Türkiye.
• SMS provider NetGSM (Türkiye) — to send invitation links and one-time verification codes for sign-in, password reset and the self-service trial sign-up; only the phone number and the message text.
• Authorized public institutions — on request, to fulfil legal obligations.

Transfers abroad:

• The information you send through the website forms (full name, email, phone, company, number of employees, city, subject and message; in the self-service trial sign-up also the company code) is transferred to the email delivery provider Plus Five Five, Inc. (Resend, United States of America) so that your request reaches our team by email; the provider sends the email from its infrastructure in Ireland (European Union).
• This email reaches our team's mailbox provided by Google LLC (United States of America); correspondence about your request is also carried out through this service.
• So that notifications can be sent to the mobile app, your device's notification token and the notification content are transferred to Google LLC's (United States of America) Firebase Cloud Messaging service; on iOS devices the notification is also delivered through the notification service of Apple Inc. (United States of America).
• Expense receipt images uploaded with older versions of the mobile app are stored on servers abroad of the image hosting provider Cloudinary Ltd.; in current versions receipts are kept on our servers in Türkiye.
• When workplace locations are shown on a map in the web panel, your browser loads the map from the Google Maps service of Google LLC (United States of America); in doing so your IP address, browser information and the area shown on the map reach Google.
• Versions 1.4.0 and earlier of the mobile app send the crash report listed in section 2 to the Firebase Crashlytics service of Google LLC (United States of America) when the app crashes or an error log is written. Once you update the app to the version that removes Crashlytics, this stops.

Website visit statistics are kept on our own server in Türkiye; they are not sent to a separate statistics provider.

Data is not shared with third parties for marketing purposes and is never sold.

Your personal data is retained for as long as the purpose of processing requires, subject to the statutory limitation periods set out in the relevant legislation. Upon termination of your service subscription, data outside the scope of legal retention obligations is deleted or anonymized within a reasonable time.

Requests sent through the website forms are kept on our servers in Türkiye for at most 3 days until they reach our team, and this copy is deleted once delivered. Email correspondence about your request is kept for as long as the request is evaluated and any resulting business relationship lasts, subject to the statutory limitation periods.

The retention periods of the self-service trial sign-up are in section 9.

The business may request the export or deletion of its data at any time.

Under KVKK Art. 11 you may apply to the data controller to exercise the following rights:

• a) To learn whether your personal data is processed.
• b) To request information if your personal data has been processed.
• c) To learn the purpose of processing and whether your data is used in line with that purpose.
• ç) To know the third parties in Türkiye or abroad to whom your personal data is transferred.
• d) To request correction if your personal data is incomplete or processed inaccurately.
• e) To request erasure or destruction of your personal data under the conditions set out in KVKK Art. 7.
• f) To request that the actions under (d) and (e) be notified to the third parties to whom your personal data was transferred.
• g) To object to a result against you arising from the analysis of the processed data exclusively through automated systems.
• ğ) To request compensation if you suffer damage due to unlawful processing of your personal data.

You may send your application in writing to the address above, or to info@cnutlabs.com using registered electronic mail (KEP), a secure electronic signature, a mobile signature or the email address registered in our system. Depending on the nature of the request, your application is concluded free of charge within thirty days at the latest; where the process incurs an additional cost, a fee may be charged according to the tariff set by the Board.

Your application must clearly include information verifying your identity and the nature of your request.

This section brings together the personal data processed when you open a trial account yourself on the free trial page of the website (self-service sign-up). For this data the data controller is CNUTLABS, named in section 1; once the trial account is open, your business is the data controller for the employee data you add to it.

Data processed:

• What you give in the form: organization type, company name, first name, last name, mobile phone number, email address and number-of-employees range.
• Verification data: a digest of the one-time code sent to your phone by SMS (the code itself is not stored), the number of wrong attempts and the time of verification.
• Sign-up data: the IP address the sign-up started from, the time the sign-up started and was completed; the completed sign-up is the record of your acceptance of the Terms of Service.
• Your password: stored only in an irreversible form (as a digest).

Purposes and legal bases:

• Opening your trial account and your administrator user, verifying your phone number by SMS code and contacting you by phone or email about your trial account: directly related to the conclusion of a contract (Art. 5/2(c)).
• Allowing only one trial account per phone number and preventing abuse with attempt limits per IP address and per phone number: the data controller's legitimate interest (Art. 5/2(f)).

Transfers:

• Your phone number and the verification code are transferred to NetGSM (Türkiye) to be sent by SMS.
• When your sign-up is completed, the company name, full name, phone, email, number-of-employees range and company code are sent by email to our sales team so that it can contact you about your trial account; this email travels through the Resend (United States of America; sent from its infrastructure in Ireland) and Google (United States of America) services named in section 5.

Retention:

• Unfinished sign-ups (code not verified or password not set) are deleted within 3 days at the latest.
• The data of a completed sign-up is kept while the trial account lasts; closing the trial account and deleting its data follow the free trial clause of the Terms of Service.
• To prevent a second trial account with the same phone number, the phone number and the sign-up dates are kept after the trial account is deleted.

The "I have read and accept the Terms of Service" box on the form records that you accept the terms of the trial service; it is neither an approval of nor explicit consent to the processing of your personal data. No processing in the self-service sign-up rests on explicit consent. Your rights and how to apply are in sections 7 and 8.