Hullcore · KVKK
Personal Data Processing Notice
1. Person Processing Your Data (Data Controller)
Hullcore (Osman Can Çınar) as the Data Controller, we attach utmost importance to the security of your personal data. Pursuant to the Law on the Protection of Personal Data No. 6698 ("LPPD") we take the necessary measures to ensure an appropriate level of security when processing your personal data and transferring it to third parties, to prevent unlawful processing of and access to your personal data and to ensure its preservation. With the awareness of this responsibility, we process your personal data within the framework specified below, in our capacity as Data Controller pursuant to the LPPD and the relevant legislation.
2. Your Personal Data Being Processed
| Data category | Data | Notes |
|---|---|---|
| Identity Data | Full Name (optional) | |
| Contact Data | E-mail Address | |
| Transaction Security Data | IP Address, User Account Information, Password (stored as a hash), Session/authentication tokens (and, if enabled, secure session + CSRF cookies), Device Information, Security and authentication log records, Push notification device token (FCM), Access-audit and security-event log records (which sensitive fields were read, by whom, when; login/lockout/2FA/role-change events) | |
| Identity/Contact Data (Apple) | Apple account identifier and verified/relay e-mail (from the Apple ID token) | Only when you use / enable the related feature. |
| Marketing Data | Notification preferences, commercial-communication consent status | Only when you use / enable the related feature. |
| Visual and Audio Data | Photo / image (camera or photo-library content, user-initiated) | Only when you use / enable the related feature. |
| Location Data | Location (GPS) information, only when a location-based feature is used | Only when you use / enable the related feature. |
| Transaction Security / Usage Data | Diagnostics/crash data and product-usage events | Only when you use / enable the related feature. |
3. Method of Collecting Your Personal Data
Your personal data is collected in accordance with the LPPD, depending on the service provided and your legal relationship with the Data Controller, through:
- Registration and profile information via the mobile (Android and iOS) and web application
- Automatic recording of IP address and User-Agent during legal-consent processes (LPPD proof obligation)
- "Sign in with Apple" (verification of an Apple-issued ID token), if you use it
- Your device's notification permission, only when you enable notifications
- Your device's photo/camera permission, only when you use a feature that picks or captures an image
- Your device's location permission, only when you use a location-based feature
- On mobile, the Analytics/Crashlytics SDK initializes on every launch, but collection itself stays off until you opt in; on the web surface, an optional error-monitoring tool (Sentry) operates only with your explicit consent
- Automatic server-side logging of sensitive-data reads and security events
4. Personal Data Processing Purposes and Legal Basis
Processed on a limited basis under Article 5 of the LPPD (contract performance; the Data Controller's legal obligations; establishment/exercise/protection of a right; and the legitimate interests of the Data Controller where this does not harm your fundamental rights and freedoms), for:
- 2. Conducting Information Security Processes
- 8. Conducting Audit / Ethics Activities
- 10. Managing Access Authorizations
- 11. Ensuring Activities Comply with Legislation
- 16. Pursuing and Conducting Legal Matters
- 18. Conducting Communication Activities
- 20. Conducting Business Activities
- 46. Ensuring Security of Data Controller Operations
- 50. Providing Information to Authorized Persons, Institutions, and Organizations
Separately, subject to your explicit consent under Article 5/1 of the LPPD (each off by default):
- 21. Receiving and Evaluating Suggestions for Improving Business Processes
- 22. Conducting Business Continuity Activities
- 45. Conducting Product / Service Marketing Processes
5. Sharing of Your Personal Data
Your personal data may be shared, limited to the purposes above and where necessary, with authorized public institutions and organizations, and with suppliers or private-law legal entities. Where a deployment enables an optional service provider (for example push-notification delivery, payment processing, or optional analytics), the relevant data may be transferred to that provider, some of which may be located abroad; such transfer is carried out under Article 9 of the LPPD with appropriate safeguards (standard contractual clauses), and analytics transfers occur only where your explicit consent exists. In the current Hullcore demo build, no external service provider is enabled by default. The full, current list of enabled providers, the data shared, and their country is set out in the Privacy Policy.
6. Deletion of Your Personal Data
The Data Controller retains personal data for the periods prescribed by legislation. Where none is specified, data is retained for the period required by the Data Controller's practices and commercial custom, and thereafter only for the period needed to constitute evidence in possible legal disputes. After those periods, the data is deleted, destroyed, or anonymized at the first disposal date pursuant to Article 7 of the LPPD.
7. Your Rights Regarding the Processing of Personal Data
You may exercise your rights under Article 11 of the LPPD, in accordance with the Communiqué on Procedures and Principles of Application to the Data Controller (10.03.2018), using the "Data Subject Application Form" at https://hullcore.dev/legal/kvkk-basvuru-form/:
- by sending it from your registered e-mail address to legal@hullcore.dev.
For a person other than the data subject to apply, a notarized special power of attorney is required. Requests are concluded within thirty days at the latest; where a response requires additional cost, a fee within the Personal Data Protection Board ("Board") tariff may apply. Under Article 14 of the LPPD, you may complain to the Board within thirty days of learning of the response and in any case within sixty days of the application.
Hullcore (Osman Can Çınar) · legal@hullcore.dev · https://hullcore.dev Version 1.0 · effective on publication Prepared in compliance with Google Play Developer Policies, Apple App Store Review Guidelines, LPPD, and GDPR.