This is an English translation of the Turkish
Gizlilik Politikası, provided for convenience.
In the event of any discrepancy, the Turkish text prevails.
1. Overview
CPI Teknoloji Yazılım Arge ve Danışmanlık Tic. Ltd Şti. values your privacy. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our website, use our services or contact us.
This policy has been prepared in line with the KVKK (Law No. 6698) in Türkiye and the GDPR (Regulation (EU) 2016/679) in the EU and EEA. For detailed and sector-specific matters, please also see:
2. Information We Collect
2.1 Information You Provide Directly
- When you complete a contact form: name, e-mail, company, message content
- When you request a demo: the above plus telephone and intended use case
- When you apply for a job: CV and contact details
- When you attend our events: attendance details
2.2 Information Collected Automatically
- IP address, browser type, operating system
- Time of visit, pages visited, time spent
- Referring site (referrer)
- Data collected through cookies (see the Cookie Policy)
2.3 Information Received from Third Parties
- Information shared by our business partners in the context of joint customer relationships
- Publicly available profile information from professional networks (LinkedIn and similar)
3. How We Use Your Information
- To provide and improve our services and products
- To respond to your requests
- To perform contractual obligations
- To comply with our legal obligations
- To develop and secure the website
- Marketing and event communication (only with your explicit consent)
- To prevent fraud and unauthorised access
4. Who We Share Your Information With
We do not sell your personal data. We share it only in the following limited circumstances:
- Service providers: Cloud infrastructure (KVKK/GDPR compliant), e-mail, CRM and analytics tools — only to the extent necessary to deliver the service
- Legal authorities: Where required by law
- Corporate transactions: In a merger or acquisition, transfer to the new entity (with prior notice)
- With your explicit consent, in any other case you determine
We sign Data Processing Agreements (DPAs) with all of our service providers.
5. International Data Transfers
Our head office is in Türkiye. Where data is transferred from the EU/EEA, Standard Contractual Clauses (SCCs) and supplementary technical and organisational measures are applied within the framework of Chapter V of the GDPR. Details are available on our GDPR Compliance page.
6. Data Security
We take comprehensive measures to protect your information:
- Information security controls aligned with ISO 27001 principles
- End-to-end encryption (TLS 1.3 in transit, AES-256 at rest)
- Role-based access control and multi-factor authentication
- Regular security testing and patch management
- Employee training and confidentiality agreements
- Incident response plan and data breach notification procedure
Even so, no transmission of data over the internet can be guaranteed to be 100% secure. If you have any concerns regarding information security, please contact us.
7. Retention Periods
We retain your data only for as long as necessary for the purpose for which it was collected:
- Customer relationship data: contract term + 10 years (financial/legal)
- Marketing data: until explicit consent is withdrawn
- Web analytics data: maximum 14 months (anonymised)
- Job applications (unsuccessful): 1 year
8. Your Rights
Depending on your jurisdiction, you have the following rights:
- The right to access your data
- The right to request rectification
- The right to erasure (“right to be forgotten”)
- The right to request restriction of processing
- The right to data portability
- The right to object
- The right to withdraw explicit consent
- The right to lodge a complaint with a supervisory authority
To exercise these rights, write to kvkk@cpiteknoloji.com; your request will be completed free of charge within 30 days at the latest.
9. Children's Privacy
Our services are designed for corporate users and are not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16.
10. Third-Party Links
Our site may contain links to third-party sites. We are not responsible for the content or privacy practices of those sites. We recommend reading their own privacy policies before visiting them.
11. Changes to This Policy
This Privacy Policy may be updated as needed. Material changes will be communicated to you by e-mail or by notice on the site. You can follow the “Last updated” date at the top of this page.
12. Bukalemun Mobile App (iOS/Android)
This section explains which data the Bukalemun mobile app (iOS and Android) processes and why. The app is developed by CPI Teknoloji Yazılım Arge ve Danışmanlık Tic. Ltd Şti. ("CPI") and provided to businesses as an enterprise service; your account is set up by your employer.
Data collected
- Username: the username your employer assigned to you.
- Session data: a session key confirming that you are signed in.
- Device identifier: a random identifier generated by the app.
- Photos: photos you attach to a form (taken with the camera or chosen from your gallery).
- Form data: the information you enter in forms as part of your work processes.
- RFID and barcode reads: the values of the tags and barcodes you scan.
Permissions and why we ask for them
- Camera: requested so that you can take a photo and attach it to a form.
- Photos: requested so that you can attach a photo from your gallery to a form.
- Bluetooth: requested to connect to handheld devices such as RFID readers and barcode scanners.
- Location: on Android, location permission is requested only to find nearby Bluetooth devices; your location is not recorded.
Purpose of use
The data is used only for your employer's business processes. It is not used for advertising, tracking or analytics, and it is not sold.
Who owns the data
Bukalemun is provided by your employer, and your data goes to your employer's server. Your employer is the data controller for this data. CPI provides the service on your employer's behalf and under its instructions (data processor).
Parties the data is shared with
- Your employer and the users your employer authorises (for example, your manager).
- CPI: for installation, maintenance and support, and only on your employer's instructions.
- Hosting providers: where your employer's server runs on a cloud or data-centre service.
- Competent public authorities: only where required by law.
These parties are required to protect your data to the same or an equivalent standard as described in this policy. Your data is not shared with anyone else.
Retention
App data on your device is deleted when you delete the app. Data on the server is kept for as long as your employer determines.
Deletion requests and permissions
To have your account and data deleted, contact your company administrator or write to kvkk@cpiteknoloji.com; your request will be completed within 30 days at the latest. You can turn permissions off at any time in your device settings.
For help with the app: App Support
13. Contact
For questions and requests:
- Personal data, KVKK and GDPR requests: kvkk@cpiteknoloji.com
- General enquiries: info@cpiteknoloji.com
- KEP: cpiteknoloji@hs01.kep.tr
- Post: CPI Teknoloji Yazılım Arge ve Danışmanlık Tic. Ltd Şti., Çifte Havuzlar, YTÜ-Davutpaşa Campus Technopark area D:1 block, 34220 Esenler/Istanbul