Privacy Notice for Account Holders

This notice informs, it does not ask. Reading it is enough for you to have been informed; you do not have to accept it. The document you do have to accept is the Terms of Use.

This notice is about the person who opens the Vardify account. Informing your employees is a separate job and it belongs to you as the controller; the product gives you templates to edit and publish under Settings → Privacy.

Identity of the controller

Nivorbit Teknoloji Limited Şirketi ("Nivorbit"), Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, 17100 Merkez / Çanakkale, Türkiye. Trade registry 0631151313600001. Contact: kvkk@vardify.com · Contact person: not stated yet. Nivorbit is established outside the EU and has designated the representative named in the Privacy Policy under art. 27 where that article applies.

Personal data processed

• Identity and contact: full name, email address, telephone, business name and trade name
• Authentication: the provider you use (Google, Apple, Microsoft), session and sign-in records
• Subscription and payment: plan, period, invoice details, payment result (no card data is processed)
• Transaction security: IP address, device and browser information, audit records. When you accept the Terms of Use these are written into the acceptance record as well — that is the proof of which text, in which version, you accepted and when.
• Support: the messages and attachments you send us

Purposes of processing

To create your account and provide the Service; to run subscription and collection processes; to meet statutory bookkeeping and record-retention obligations; to answer your support requests; to keep the Service secure and detect abuse; to improve the product using aggregated measurements; and, where you have given consent, to send commercial electronic messages.

Lawful bases

• Performance of a contract — GDPR art. 6(1)(b)
• Compliance with a legal obligation (tax, commercial law) — art. 6(1)(c)
• Legitimate interest (security, abuse detection, product improvement) — art. 6(1)(f); you may object under art. 21
• Consent — art. 6(1)(a), only for commercial electronic messages; withdrawable at any time

Recipients and why

• Hosting provider (EU) — Running the Service
• Notification and email providers — Delivering notifications and email
• Paddle.com Market Ltd (online reseller and Merchant of Record) — Taking payment, invoicing and VAT
• Accountant, auditor, legal counsel — Legal obligations and defence of rights
• Competent public authorities — Where required by law

Transfers outside the EU/EEA: Vardify's servers are located in the European Union (Falkenstein, Germany). Nivorbit itself is established in Türkiye and accesses the data from there to operate the Service; that access, and the delivery of mobile notifications through Google's US infrastructure, are transfers under art. 44 and are made under the European Commission's Standard Contractual Clauses (art. 46(2)(c)) with supplementary measures. Data is protected by TLS in transit and disk encryption at rest. Full list: Sub-processor List.

Retention

The periods are set out as a table in §5 of the Privacy Policy.

Your rights

Under GDPR art. 15 to 22 you have the right of access, to rectification, to erasure, to restriction of processing, to data portability, to object, and not to be subject to a decision based solely on automated processing. Applications: kvkk@vardify.com. Answered within one month, extendable by two further months where the request is complex (art. 12(3)). You may lodge a complaint with the supervisory authority of your habitual residence, place of work or the place of the alleged infringement (art. 77).

Providing the identity, contact and payment data above is necessary to conclude the contract; without it the account cannot be opened. Nothing else is required.