Vardify Privacy Policy

0. First, this distinction: Vardify holds two separate piles of data

This distinction is the only thing that makes the policy legible, so it comes first.

Account data

• Whose? — The person who opens and uses the Vardify account
• What? — Name, email, sign-in records, subscription and invoicing, support correspondence
• Nivorbit's role — controller (GDPR art. 4(7))
• Who decides? — Nivorbit
• Which document? — this policy

Employee data

• Whose? — The Subscriber's employees
• What? — Shifts, timesheets, leave, pay, personnel documents, location read
• Nivorbit's role — processor (art. 4(8))
• Who decides? — the employer (Subscriber)
• Which document? — Data Processing Agreement

In other words: Nivorbit does not decide what happens to employee data — the employer does, and Nivorbit acts on their documented instructions (art. 28(3)(a)). If an employee approaches Nivorbit about their own data, Nivorbit refers them to their employer and assists the employer; it does not erase, correct or disclose on its own.

This policy is about account data.

1. Controller

Nivorbit Teknoloji Limited Şirketi ("Nivorbit"), Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, 17100 Merkez / Çanakkale, Türkiye. Trade registry 0631151313600001. Contact: kvkk@vardify.com · Contact person: not stated yet. Nivorbit is established in Türkiye; where art. 27 applies, its representative in the Union is not stated yet.

2. The account data we process

• Identity and contact — Example: Full name, email, telephone, business name · Where it comes from: From you
• Authentication — Example: Provider (Google/Apple/Microsoft), session and sign-in records · Where it comes from: From you and your identity provider
• Subscription and payment — Example: Plan, period, invoice details, payment result · Where it comes from: From you and from the payment provider
• Support — Example: The messages and attachments you send us · Where it comes from: From you
• Technical records — Example: IP address, device/browser information, error and audit logs · Where it comes from: Automatically

We never see or store your card details. Payment is taken on the payment provider's infrastructure; only the result of the transaction comes back to us.

3. Purposes and lawful bases

• Opening the account, providing the Service — Performance of a contract (art. 6(1)(b))
• Pricing, invoicing, collection — Performance of a contract + legal obligation (art. 6(1)(c))
• Retaining invoices and commercial books — Legal obligation (tax and commercial law)
• Security, abuse and fraud detection — Legitimate interest (art. 6(1)(f))
• Answering support requests — Performance of a contract
• Improving the Service (aggregated measurement) — Legitimate interest (art. 6(1)(f))
• Sending commercial electronic messages — Consent (art. 6(1)(a)) — taken separately, refusable, withdrawable

Apart from commercial messages, no processing rests on consent; withdrawing your consent therefore does not affect your access to the Service. Where processing rests on legitimate interest you may object at any time (art. 21); we then stop unless compelling legitimate grounds override your interests.

4. Recipients and transfers

4.1 Recipients

Our accountants and auditors, our legal advisers, the payment provider and, on request, competent public authorities — only to the extent necessary.

4.2 Transfers outside the EU/EEA — said plainly

Vardify's servers are hosted in the European Union (Falkenstein, Germany). Two transfers outside the Union nevertheless take place and are named here rather than implied:

• Nivorbit's own access from Türkiye, to operate and support the Service. The European Commission has adopted no adequacy decision for Türkiye, so the transfer is made under the Standard Contractual Clauses (art. 46(2)(c), Decision (EU) 2021/914) with supplementary measures.
• Mobile notification delivery through Google (USA), under the SCCs and, where Google LLC is certified, the EU-US Data Privacy Framework.

Data is kept with TLS in transit and encrypted on disk (database and backups included). Special category data under art. 9 (blood type, disability degree, trade-union membership) is additionally encrypted at column level. Encryption is a security measure, not a transfer mechanism; the two are provided separately.

For the full list of sub-processors, what they process and where they are: Sub-processor List.

5. Retention periods

• Account and contact details — Period: Subscription + the general limitation period of the applicable law (10 years at most) · Reason: Defence of legal claims
• Invoices and financial records — Period: 10 years · Reason: Tax and commercial record-keeping law
• Session and sign-in records — Period: 2 years · Reason: Security, legitimate interest
• Audit log — Period: 5 years · Reason: Accountability (art. 5(2))
• Support correspondence — Period: 3 years · Reason: Possibility of a dispute
• Commercial-message consent — Period: Until withdrawn + 3 years · Reason: Burden of proof (art. 7(1))
• Contract acceptance record (identity, document version, timestamp, IP, device) — Period: Subscription + the general limitation period · Reason: Burden of proof

Retention of Business Data is governed by the Data Processing Agreement: a 30-day export window after the contract ends, then destruction.

6. Your rights (GDPR art. 15–22)

Access; rectification; erasure; restriction of processing; data portability; objection; and not to be subject to a decision based solely on automated processing which produces legal effects concerning you. Nivorbit makes no such automated decisions about account holders.

You can exercise the right to erasure from inside the product: your own account under Settings → Security (on the phone, Profile → Delete my account), the whole business under Settings → Business. Deleting a business takes effect after 30 days and can be called off throughout.

Send requests to kvkk@vardify.com; they are answered within one month, extendable by two further months where a request is complex (art. 12(3)). You may lodge a complaint with a supervisory authority (art. 77), in particular the one of your habitual residence.

7. Cookies

The panel uses the cookies and browser storage it needs to work. Details: Cookie Policy.

8. Security

Tenant data is isolated at database level by row-level security (RLS); access is role-based; pay and identity fields are masked according to role; actions are written to an audit log. Vardify does not use biometric data or facial recognition. Location is read only at the moment of a clock-in scan and only with consent; there is no continuous location tracking.

In the event of a personal data breach concerning account data, the competent supervisory authority is notified within 72 hours where required (art. 33) and affected persons without undue delay where the breach is likely to result in a high risk to them (art. 34).

9. Children's data

Vardify is a business product and is not offered directly to anyone under 18. Where young workers are employed, their data is employee data and is the employer's responsibility.

10. Changes

If this policy changes, you will be told at least 30 days beforehand. Past versions are kept accessible.

11. Contact

Nivorbit Teknoloji Limited Şirketi · Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, 17100 Merkez / Çanakkale, Türkiye · kvkk@vardify.com · Contact person: not stated yet