Privacy Policy

Within the service we collect only the data required for employee time and attendance: identity and contact details, clock-in/out and leave/shift records, location verification at the moment of clock-in, and device/IP information for account security.

On the free trial, quote / contact and partner forms of our website we ask only for the contact details needed to handle your request.

On the promotional pages we keep visit statistics without cookies: the pages viewed, the link a visit came from, browser and device type, approximate location (country, city) and clicks on trial, phone and email links. We do not store your IP address in these statistics; details are in the Cookie Policy.

We do not collect biometric data and do not perform continuous location tracking.

We use data only to provide the service, ensure the accuracy of attendance records, maintain security and fulfil legal obligations. We use visit statistics only to see which pages and links of our site are used. We do not sell your data for advertising purposes.

Point PDKS runs on a multi-tenant architecture. Every query is automatically isolated by organization; one business's data cannot be viewed by another. This isolation is a core part of the application infrastructure.

Your data is encrypted in transit with SSL/TLS. Passwords are stored in an irreversibly hashed form. Critical actions are recorded in an audit log together with IP, device and change information. Access is restricted through role-based authorization.

We work with a limited number of infrastructure providers to operate the service:

• Hosting infrastructure (Türkiye) — the service and the website; our servers are in Türkiye.
• NetGSM (Türkiye) — invitation and one-time verification code SMS messages.
• Resend (USA; delivered from Ireland) — forwarding website form requests to our team by email.
• Google (USA) — our team's mailbox, mobile app notifications (Firebase Cloud Messaging), the map in the web panel (Google Maps) and crash reports from versions 1.4.0 and earlier of the mobile app (Firebase Crashlytics).
• Apple (USA) — notification delivery to iOS devices.
• Cloudinary (abroad) — expense receipt images uploaded with older versions of the mobile app.

We use no separate provider for visit statistics: the open-source Umami software runs on our own server in Türkiye.

Transfers abroad are described in section 5 of the KVKK Notice.

You may request a copy of your data to be exported or have it deleted. Your account deletion request, outside of legal retention obligations, is processed within a reasonable time. For your requests, you may write to info@cnutlabs.com.