KVKK Privacy Notice for Employees

This notice is addressed to employees whose employer uses the Mitves time and attendance service. It explains who processes your personal data, which data is processed, for which purposes and on which legal basis, to whom it is transferred, how long it is kept and which rights you have.

This notice is a template that your employer adapts and provides to you in fulfilment of its information obligation under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). Your employer may provide additional or more specific information.

Your employer is the data controller. It decides that attendance is recorded, which verification checks are enabled and how long records are kept.

Mitves (Astalyne Studios, owner Oguzhan Günel, Günzburger Str. 37, 89340 Leipheim, Germany) is the data processor. It processes your data only on your employer’s instructions under a written data processing agreement and does not use it for its own purposes.

If your employer is required to register with the Data Controllers Registry (VERBİS), that registration is maintained by your employer.

• Identity data: name, surname, employee number, position, department, branch or team.

• Contact data: e-mail address and mobile phone number.

• Employment data: role, shifts and work plans, leave balances, leave and excuse requests, break records.

• Attendance events: check-in and check-out time, the location selected and the GPS coordinates captured at the moment of stamping, the authorised device identifier, the scanned QR token identifier and the review status of the record.

• Technical data: IP address, device and app version, and audit log entries.

• Payroll documents published to you by your employer. Their content is not analysed by Mitves.

No biometric data and no other special categories of personal data are processed.

• Recording working time, overtime, breaks and absences.

• Verifying that a check-in or check-out was made at an authorised location and from an authorised device, and reviewing suspicious records.

• Planning shifts and managing leave and excuse requests.

• Preparing attendance (puantaj) reports and exports that your employer uses for payroll.

• Delivering payroll documents and announcements to you through the application.

• Ensuring the security of the system and keeping an audit trail of corrections.

• Processing is necessary for the performance of your employment contract (KVKK Article 5/2-c).

• Processing is necessary for your employer to fulfil its legal obligations, in particular the obligation to record working time under the Labour Law No. 4857 and the related regulations (KVKK Article 5/2-ç).

• Processing is necessary for the legitimate interests of your employer in keeping attendance records accurate and the system secure, provided that your fundamental rights and freedoms are not harmed (KVKK Article 5/2-f).

• Explicit consent, where your employer asks for it in the app, in particular for location verification (KVKK Article 5/1). You can give or withdraw it at any time in the app under Settings; without it, you check in and out by scanning the location QR code and no GPS position is collected.

Within Türkiye, your data may be shared with the authorised managers of your employer, with the accountant or payroll provider your employer appoints, and with public authorities where the law requires it.

Your data is hosted on servers located in the European Union (Netherlands). Under Article 9 of the KVKK this constitutes a transfer of personal data abroad. The transfer rests on the standard contract that your employer, as data controller, and Mitves sign under Article 9(4) of the KVKK; your employer notifies it to the Personal Data Protection Authority within five business days of signing. It relies on that contract and not on your consent.

Mitves uses sub-processors for hosting, DNS and edge protection, SMS and e-mail delivery. They are bound by written agreements and are listed in the data processing agreement between your employer and Mitves.

If you use the web dashboard as an administrator, its location map loads map tiles directly from the OpenStreetMap Foundation (United Kingdom) to show the map for setting a location; your browser then sends your IP address, the usual request headers and the map area being viewed. This is also a transfer abroad. The OpenStreetMap Foundation’s privacy policy: https://osmfoundation.org/wiki/Privacy_Policy

The mobile app sends crash reports to Firebase Crashlytics and receives push notifications through Firebase Cloud Messaging, both services of Google. A crash report contains the error type, code locations in the app, the device model, operating system and app version, the time, a random installation identifier and your phone’s IP address, but not your name, user ID, phone number, position or attendance data. For a push notification, Google receives your phone’s push token and the notification’s title and text; on iPhones it is delivered through Apple’s push service (APNs). Google may process this data in the United States, which is also a transfer abroad. Firebase privacy information: https://firebase.google.com/support/privacy

Your data is kept for the duration of your employment and afterwards for the periods required by the Labour Law, social security legislation and other applicable law, as determined by your employer.

A correction never deletes your original stamp silently: who changed what, when and why is recorded together with the previous values. The GPS position of a stamp is kept only for the period your employer sets (90 days unless changed) and then erased.

When the retention period ends or your employer’s subscription ends, the data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in line with that purpose, to know the third parties to whom it is transferred domestically or abroad, to request rectification if it is incomplete or inaccurate, to request deletion or destruction under the conditions of Article 7, to request that rectification or deletion be notified to third parties, to object to a result that is to your detriment and that arises from analysis exclusively by automated systems, and to claim compensation for damage caused by unlawful processing.

Applications are made to your employer as data controller, in writing or by the other methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller: the contact details your employer gives in its notice.

Your employer concludes the application free of charge and as soon as possible, at the latest within 30 days. If the application is refused, answered insufficiently or not answered in time, you may lodge a complaint with the Personal Data Protection Board.

Questions about the role of Mitves as data processor can be sent to [email protected].