This policy describes exactly what the Diyaval mobile application ("App") for iOS and Android does with personal data. The App is a business tool: it is used by employees of organisations that are Diyaval customers, with an account their organisation creates in the Diyaval platform. There is no public sign-up in the App.
Who is responsible
The organisation that gave you your account is the data controller for the business data you see and enter in the App (for example your attendance records, products, invoices). Diyaval ("Diyaval") provides the App and processes that data on the organisation's behalf as data processor. For questions about your organisation's records, contact your organisation first; you may also contact Diyaval at [email protected].
Data the App processes
| Data | When and why | Where it goes |
|---|---|---|
| Organisation's App address, Turkish identity number, password | To sign you in. | Sent over HTTPS to your organisation's Diyaval server. Kept in the App's private storage on your device so you stay signed in. |
| Your user and organisation profile (name, role, organisation name and logo) | Returned at sign-in to show your modules and permissions. | Kept in the App's private storage on your device. |
| Precise location (single reading) | Only when you tap clock-in or clock-out in the Personnel module, to record where the action took place. No background or continuous tracking. | Sent with the clock-in/out record to your organisation's Diyaval server. |
| Camera | When you scan a barcode or take a product photo. Barcode scanning reads the code only; frames are not stored. | Photos you choose to save are uploaded to your organisation's server as product images. |
| Photos from your gallery | Only the images you pick to attach to a product. | Uploaded to your organisation's server. |
| Business records | Products, stock, invoices, e-documents, collections and other records your role allows you to view or enter. | Your organisation's Diyaval server. E-document PDFs you open are stored temporarily in the App's cache and can be shared only when you use your device's share sheet. |
| E-document signature code | The one-time SMS code you enter to sign an e-document. | Sent to your organisation's server to complete the signature. |
What the App does not do
- No advertising, analytics, crash-reporting or tracking SDKs. Diyaval does not track you across other companies' apps or websites.
- No microphone use and no audio recording. On Android the microphone permission appears in the App's manifest because of the camera component; the App never requests or uses it.
- No access to contacts, calendar, health data or background location.
- No sale or sharing of personal data with third parties for their own purposes.
Permissions
The App asks for camera, photo and location permission only when you first use the related function. You can refuse or withdraw a permission in your device settings; only that function stops working.
Security
All communication with your organisation's server uses TLS-encrypted HTTPS. Data stored on the device is kept in the App's private storage, which other apps cannot read. Use a device screen lock, and sign out on shared devices.
Retention and deletion
Data on your device remains until you uninstall the App. Data on your organisation's server is kept according to your organisation's retention rules and statutory obligations (for example, employers must keep personnel records under labour law). See Account and Data Deletion.
Your rights
You have the rights in Article 11 of KVKK. Apply to your organisation, or to Diyaval as described on the Data Subject Application page; we forward requests concerning an organisation's records to that organisation.
Children
The App is a business tool and is not directed at children.
Changes
If the App starts processing new data, this policy and the store privacy declarations are updated before the new version is published.