Vardify Privacy Policy

1. Purpose and scope

This Privacy Policy gives the information required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") about the personal data that Nivorbit Teknoloji Limited Şirketi ("Nivorbit") processes as controller (art. 4(7)) through the Vardify web panel, mobile app, kiosk screen and the vardify.com website (together, the "Service"). It covers:

• the account, subscription and support data of the people who open and use a Vardify account;
• technical and usage data collected from everyone who uses the Service (employees included) to keep the Service secure, to track errors and to improve it;
• the data of people who visit the website and fill in its forms.

For the data of subscribing businesses' employees, such as shifts, timesheets, leave, pay, personnel documents and clock-in readings ("Business Data"), the employer is the controller; Nivorbit processes that data only on the employer's documented instructions, as processor (art. 4(8), art. 28), under the Data Processing Agreement. Informing employees about that data and answering their requests is the employer's responsibility. Requests made to Nivorbit on that subject are passed on to the employer, and Nivorbit assists the employer in answering them (art. 28(3)(e)).

2. Controller

• Name: Nivorbit Teknoloji Limited Şirketi
• Address: Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, 17100 Merkez / Çanakkale, Türkiye
• Trade registry (MERSİS): 0631151313600001
• Privacy contact: kvkk@vardify.com
• Contact person: not stated yet
• Representative in the Union (art. 27): not stated yet

Nivorbit is established in Türkiye; where art. 27 applies, its representative in the Union is the one named above.

3. Categories of personal data

• Identity and contact: full name, email address, telephone number, business name.
• Authentication: the provider you sign in with (Google or Apple) and the account identifier, name and email address it reports; session and sign-in records.
• Subscription: plan, period and subscription status. Payment and invoicing are handled by Paddle as seller of record (section 6.3); Nivorbit neither sees nor stores card details.
• Contract and consent records: the version of each text you accepted or read, the time, IP address and device information; your commercial message and cookie choices.
• Support and contact: the messages and attachments you send us; what you enter in the website's contact, newsletter and pilot application forms.
• Transaction security: IP address, browser and device information, request and audit records.
• Mobile app and device: device model and operating system, app version, the random installation key the app generates for device binding, the notification (push) token.
• Error records: when an app or server error occurs, the error type, stack trace, app and device version, and the page transitions and request addresses immediately before the error.
• Usage data: the screens and pages viewed; the names of completed actions such as a shift request, a leave request or publishing a plan; the account's opaque Vardify identifier, its role and the identifier of its business. Names, email addresses and free text are not sent for this. This data is collected only if you allowed it: in the web panel and on the website through your cookie choices, in the mobile app through your answer to the app's question or its settings.
• Marketing measurement: only if you have allowed marketing cookies, cookie and pixel data that measure your arrival from an advertising campaign and conversion events such as sign-up and subscription.

4. Sources

Most of the data comes from you: what you enter in the web panel, mobile app, kiosk and website. Your identity provider (Google or Apple) reports your account identifier, name and email address when you sign in with it. Paddle reports the status of your subscription. Technical, error and usage data is created automatically while the Service is used.

5. Purposes and lawful bases

• Opening the account, authentication and providing the Service: performance of a contract (art. 6(1)(b)).
• Managing the subscription: performance of a contract (art. 6(1)(b)).
• Retaining commercial and tax records: legal obligation (art. 6(1)(c)).
• Proving contract acceptances and defending legal claims: legitimate interest (art. 6(1)(f)).
• Answering support requests and form submissions: performance of a contract or steps prior to entering into one (art. 6(1)(b)), otherwise legitimate interest (art. 6(1)(f)).
• Delivering notifications and transactional email: performance of a contract (art. 6(1)(b)).
• Information security, preventing abuse and fraud: legitimate interest (art. 6(1)(f)).
• Tracking and fixing errors: legitimate interest (art. 6(1)(f)).
• Usage measurement in the mobile app (Google Analytics for Firebase): consent (art. 6(1)(a); ePrivacy Directive art. 5(3)); only if you allowed usage measurement when the app asked or in the app's settings. Until you allow it, measurement is off and every feature of the app remains available. The data used is limited to what section 3 lists and carries no name, email address or free text.
• Usage measurement in the web panel and on the website (Google Analytics): consent (art. 6(1)(a); ePrivacy Directive art. 5(3)); only if you allowed analytics in your cookie choices.
• Measuring advertising campaigns (Meta Pixel): consent (art. 6(1)(a); ePrivacy Directive art. 5(3)); only if you allowed marketing in your cookie choices.
• Sending commercial electronic messages: consent (art. 6(1)(a)); taken separately and optionally at sign-up.

Our legitimate interests are running a secure and working service, keeping proof of what was agreed, and finding and fixing errors. Where processing rests on legitimate interest you may object at any time (art. 21); we then stop unless there are compelling legitimate grounds that override your interests, or the processing is needed for legal claims.

You may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (art. 7(3)): change your cookie choices in the cookie settings on the website or in the panel, your mobile app usage measurement consent in the app's settings, and your commercial message consent through the link in the message or by writing to kvkk@vardify.com. Withdrawing consent does not affect your access to the Service.

Providing the identity, contact and authentication data is necessary to conclude the contract; without it no account can be opened. Everything else is optional or created by the use of the Service.

6. Recipients and transfers

6.1 Recipients

Your personal data is disclosed, to the extent necessary, to the service providers that process it on Nivorbit's behalf (art. 28), to our accountants, auditors and legal advisers, and, where the law requires, to competent public authorities. The full list of service providers, the data they process, their locations and their transfer mechanisms is in the Sub-processor List.

6.2 Transfers outside the EU/EEA

Vardify's servers and file storage are in the European Union (Hetzner, Falkenstein, Germany). The following transfers outside the Union nevertheless take place:

• Nivorbit's own access from Türkiye, to operate and support the Service. The European Commission has adopted no adequacy decision for Türkiye, so the transfer is made under the Standard Contractual Clauses (art. 46(2)(c), Decision (EU) 2021/914) with supplementary measures.
• Service providers headquartered in the United States (Google, Resend, Sentry, Cloudflare), for notification delivery, sending email, error tracking, usage measurement and forwarding incoming email, under the Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework (art. 45).

Data is protected with TLS in transit and encrypted on disk (database and backups included). Special categories of data under art. 9 are additionally encrypted at column level. Encryption is a security measure, not a transfer mechanism; the two are provided separately. You can obtain a copy of the safeguards by writing to kvkk@vardify.com.

6.3 Third parties acting as controllers

The following parties are independent controllers for the service they provide, subject to their own privacy policies:

• Google and Apple: whichever you choose for signing in verifies your identity through your own account.
• Paddle.com Market Ltd: the seller of record (Merchant of Record) that sells the subscription in its own name; it processes the payment and invoicing data itself.
• Meta Platforms Ireland Ltd.: processes Meta Pixel data if you allowed marketing cookies.
• Map and address search services: when a branch location is set in the web panel, your browser connects directly to Google Maps, the OpenStreetMap map servers or the Photon address search (komoot GmbH); these services receive your IP address and your search or map request.

7. Retention periods

Personal data is kept for as long as the purpose it is processed for requires and the law provides; when that period ends it is erased or anonymised.

• Account and contact details: the subscription and the general limitation period of the applicable law, at most 10 years (defence of legal claims).
• Commercial and tax records: 10 years (commercial and tax record-keeping law).
• Session and sign-in records: 2 years (security).
• Audit records: 5 years (accountability, art. 5(2)).
• Support correspondence and form submissions: 3 years (possibility of a dispute).
• Commercial message consent: until withdrawn and 3 years after (burden of proof, art. 7(1)).
• Contract acceptance records: the subscription and the general limitation period (burden of proof).
• Error records: at most 90 days in the error tracking service.
• Usage measurement data: the period set in Google Analytics' retention setting, at most 14 months.
• Cookie choice: 6 months; you are then asked again.
• Backups: data that is deleted or whose retention period has ended stays in the encrypted backups for at most 6 months (180 days) and is deleted with that backup.

Retention of Business Data is governed by the Data Processing Agreement: a 30-day export window after the contract ends, then destruction.

8. Your rights

Under articles 15 to 22 you have the right of access; rectification; erasure; restriction of processing; data portability; objection; and not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. Nivorbit makes no such automated decisions about account holders. Where processing rests on consent you may withdraw it at any time (section 5).

You can exercise the right to erasure inside the product: your own account in the web panel under Settings → Security, in the mobile app under Profile → Delete my account; the whole business under Settings → Business. Deleting a business takes effect after 30 days and can be undone within that period.

Send requests to kvkk@vardify.com. They are answered within one month, extendable by two further months where a request is complex or numerous, in which case you are told within the first month (art. 12(3)). We may ask for information to confirm your identity. You may lodge a complaint with a supervisory authority (art. 77), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

9. Mobile app and permissions

The mobile app asks for the device permissions below only when the related feature is used. Refusing a permission affects only that feature, and you can withdraw permissions at any time in the device settings.

• Camera: scanning the branch QR code at clock-in and clock-out; photographing a sick note or document to attach to an absence, and a checklist photo.
• Location (only while the app is in use): confirming that you are at the branch when you clock in or out, and reading the network name where the business requires the branch Wi-Fi (Android does not provide it without the location permission); ordering results by proximity when you search for your business on Google while setting up a business or branch. If the permission has already been granted, whether you are at the branch is worked out on the device for reminders while the app is open; that location is not sent to the server. Location is never taken in the background and there is no continuous location tracking.
• Notifications: shift reminders, approval and announcement notifications. On Android, the exact alarm permission is also requested so that reminders arrive on time.
• NFC: reading the branch tag at clock-in and clock-out; writing tags for managers.
• Photos and files: only the photo or document you choose to attach is accessed.

The location and network information sent at a clock-in scan is Business Data and is processed on the employer's instructions. The app shows no advertising, does not read the advertising identifier (Android Advertising ID, Apple IDFA) and does not track you across other companies' apps or websites. Usage measurement is turned on only if you allow it when the app asks, and you can turn it off at any time in the app's settings. The mobile app uses no cookies; session information is kept in the device's secure storage.

10. Cookies

The mobile app uses no cookies. The web panel and the website use strictly necessary cookies and browser storage; analytics and marketing cookies are loaded only with your consent. Details are in the Cookie Policy.

11. Security

Nivorbit takes appropriate technical and organisational measures (art. 32). The main ones:

• businesses' data is isolated from one another at database level by row-level security (RLS);
• all connections are encrypted with TLS; the database, backups and documents are encrypted on disk; special categories of data are additionally encrypted at column level;
• access is role-based; pay and identity fields are masked by role; actions are written to an audit log;
• names, email addresses and free text are not sent to error tracking or usage measurement.

Vardify processes no biometric data and uses no facial recognition. In the event of a personal data breach concerning account data, the competent supervisory authority is notified within 72 hours where required (art. 33) and affected persons without undue delay where the breach is likely to result in a high risk to them (art. 34).

12. Children

The Service is meant for businesses and is not offered directly to anyone under 18. Where young workers are employed, their data is Business Data and is the employer's responsibility.

13. Changes

When this policy changes, the current version is published with its effective date and the change is announced at least 30 days beforehand. Earlier versions are kept accessible.

14. Contact

Nivorbit Teknoloji Limited Şirketi · Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, 17100 Merkez / Çanakkale, Türkiye · kvkk@vardify.com · Contact person: not stated yet · Representative in the Union: not stated yet