Privacy Notice: customers, product users, business partners, and suppliers
Version 2026-10-v1 · Updated October 20, 2026
This English translation is provided for convenience. The Turkish text is the governing version.
In brief
This notice explains how Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”, “we”) processes the personal data of representatives of IWB customers, users of the IWB application, and representatives of our business partners and suppliers. In this notice, “customer” means the company that subscribes to IWB, and “user” means a person for whom the customer has set up an account in IWB.
We are the data controller for data we process for our own purposes, such as quotes, contracts, billing, support, and account and platform security; this notice covers only those processing activities. For business data entered into a customer’s IWB workspace, the customer is the data controller; we process that data as a data processor on the customer’s behalf and on its instructions. This distinction is explained in the “Data in your workspace” section below.
Data controller
Under Law No. 6698 on the Protection of Personal Data (KVKK), the data controller for the personal data described in this notice is Firmanet:
Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”), Büyükkayacık OSB Mahallesi, 101. Cadde, InnoPark Konya TGB, B Blok, No:4/105, 42160 Selçuklu / Konya. Phone: +90 (312) 439 3940. Email: [email protected]
You can use these details to contact us with your questions and applications about your personal data.
What data we process, and whose
| Whose data | Category | Data |
|---|---|---|
| Customer representative | Identity | Full name, title or role |
| Customer representative | Contact | Work email, phone, work address |
| Customer representative | Customer transaction | Quote, contract, order, and service records (installation, training, customization, data migration); subscription and plan information; support requests |
| Customer representative | Legal transaction | Contract signature and contract files |
| Customer representative | Finance | Billing information (if the customer is a sole proprietorship, the Turkish national ID number or tax ID number, and address), payment records |
| User | Identity | Name |
| User | Contact | Email address; sending records of invitation, password reset, and verification code emails |
| User | Transaction security | Password hash; two-step verification key and recovery codes; failed sign-in counter; device ID cookie; browser and operating system label; IP address with the last segment masked; last seen time |
| User | Transaction security | IP address, date, request, and browser information in the application server’s access log |
| User | Transaction security | The type and time of any change that Firmanet staff make to your account from the admin panel |
| User | Customer transaction | The name, email, workspace and company name, page URL, browser information, application error logs, and description in your support request |
| Business partner and supplier representative | Identity, Contact | Full name, title or role, work email, phone, work address |
| Business partner and supplier representative | Legal transaction | Contract and order records |
| Business partner and supplier representative | Finance | For suppliers, bank account details; invoice and payment records |
| Customer that installs IWB on its own server (if it has turned on the update agent) | Transaction security | The server’s IP address; version, health, disk, and backup status information. This information contains no content linked to an individual |
To enforce plan limits and for billing, we also process the number of users and the amount of IWB AI usage per customer; we keep these figures as totals, without linking them to any individual.
Account and session security
We store user passwords only in hashed form. Passwords are at least 8 characters long and contain an uppercase letter, a lowercase letter, and a digit; after 5 failed attempts, the account is locked for 5 minutes. Users can turn on two-step verification themselves; it can also be made mandatory across the installation.
In session records, the last segment of the IP address is masked, and no browser fingerprint is kept; records of ended sessions are deleted after 90 days. A device ID cookie is used to control the number of sessions that can be open at the same time. The application’s cookies are used only for sessions and security and are first-party; no third-party cookies or measurement tools run in the application. The names, purposes, and durations of the cookies are on the Cookie Policy page.
When Firmanet staff make a change in a workspace from the admin panel, such as creating a user account, lifting an account lock, resetting a password, or anonymizing an account, the action is written to the customer’s security log as a “Panel” entry. This lets the customer see the changes Firmanet makes in the workspace from the admin panel.
Purposes and legal bases
We process your data only for the purposes below and on the legal basis stated next to each purpose.
| Purpose | Whose data | Data categories | Legal basis |
|---|---|---|---|
| Preparing quotes, establishing and performing the contract (including installation, training, customization, and data migration services) | Customer representative | Identity, Contact, Customer transaction, Legal transaction | If the customer is a natural person or a sole proprietorship, KVKK Article 5(2)(c) (being directly related to the establishment and performance of a contract). If you are a representative of a customer that is a legal entity, KVKK Article 5(2)(f): our legitimate interest in performing the contract we have concluded with the customer |
| Billing, collection, and accounting | Customer representative, supplier representative | Finance | KVKK Article 5(2)(ç): our legal obligation under Tax Procedure Law No. 213 (VUK) and Turkish Commercial Code No. 6102 (TTK); KVKK Article 5(2)(c) |
| Sending service notifications (maintenance, release, and security announcements) | Customer representative | Contact | KVKK Article 5(2)(c). These messages do not require consent because they are usage and maintenance messages within the scope of Article 6(1) of Electronic Commerce Law No. 6563 (ETK) |
| Managing business partner and supplier relationships (purchasing, joint sales) | Business partner and supplier representative | Identity, Contact, Legal transaction, Finance | If you are a party to the contract, KVKK Article 5(2)(c); if you are a representative of a company, KVKK Article 5(2)(f): our legitimate interest in managing the business relationship with that company |
| Keeping accounts and sign-ins secure | User | Identity, Contact, Transaction security | KVKK Article 5(2)(f): our legitimate interest in keeping the platform and accounts secure; KVKK Article 5(2)(c) for providing the service to the customer |
| Sending account emails (invitation, password reset, verification code) | User | Contact, sending records | KVKK Article 5(2)(f): our legitimate interest in providing secure access to your account; KVKK Article 5(2)(c) |
| Responding to support requests (“Report a bug”, email, phone) | User, customer representative | Identity, Contact, Customer transaction | KVKK Article 5(2)(c) (performance of the service we provide to the customer); KVKK Article 5(2)(f): our legitimate interest in resolving the reported issue |
| Keeping the application server secure | User | Transaction security (access log) | KVKK Article 5(2)(f): our legitimate interest in protecting our servers against misuse |
| Recording and proving actions taken from the admin panel | User | Transaction security | KVKK Article 5(2)(f): our legitimate interest in being able to demonstrate the actions we take on the customer’s behalf |
| Updates and operation for installations on the customer’s own server | Customer | Transaction security (server information) | KVKK Article 5(2)(f): our legitimate interest in monitoring that the installation stays up to date and in working order |
| Enforcing plan limits and billing | Customer | Usage figures not linked to any individual | KVKK Article 5(2)(c) |
| Protecting our rights and responding to requests from public authorities | All groups | Legal transaction, correspondence | KVKK Article 5(2)(e) (establishment, exercise, or protection of a right); KVKK Article 5(2)(ç) (our legal obligation) |
Where we rely on our legitimate interest, we take care that the processing does not harm your fundamental rights and freedoms, and we keep the data limited to the purpose.
Apart from service notifications, we send marketing emails, such as campaigns and announcements of new features and events, only if you have given separate consent; even if you are a merchant or tradesperson, we do not send you marketing messages without your consent. The scope of the consent and how to withdraw it are explained on the Commercial electronic message consent and explicit consent text page.
How we collect data
Customer, business partner, and supplier representatives. We obtain your data directly from you or from the company you work for, through quote and contract documents, email, phone calls, and meetings. Emails and electronic documents are collected electronically. What you tell us by phone or in meetings is entered into our records by the relevant employee; this is collection by non-automated means as part of a data filing system. Subscription, plan, billing, and contract records are kept in Firmanet’s admin panel.
Users. Your account is created by an administrator of the customer you work for; the customer enters your name and email address. Because your data comes from the customer rather than from you, this notice is made available to you at the first contact, that is, through the invitation email and the link on the application’s sign-in page. When you use the application, session records, the access log, and the sending records of account emails are generated by fully automated means.
Support requests. You submit a support request through the “Report a bug” form in the application, by email, or by phone. In the “Report a bug” form, you write the description; the page URL, browser information, and application error logs are added to the form automatically. This collection is carried out by partly automated means. Support requests are kept in our own support ticketing system in Turkey.
Installation on your own server. The update agent is optional. If the customer turns on the agent, operational information is sent to us automatically by the agent.
This notice is for information purposes; you do not need to give consent in order to read it, and we do not ask you for consent.
Who we share data with
Within Firmanet, only employees who need your data for their duties have access to it. We transfer your data to the recipients below only for the purpose stated next to each recipient and only to the extent that purpose requires.
| Recipient | Data transferred | Purpose |
|---|---|---|
| Administrators of the customer you work for | Your session records and entries in the security log (including “Panel” entries) | The customer’s own user management and security monitoring. For this use, the customer is the data controller |
| Server hosting provider in Turkey | Your data held on our servers | Hosting the servers on which the application and our records run |
| Resend | Your name, email address, and the content of the account email | Sending invitation, password reset, and verification code emails |
| Microsoft (corporate email service) | Our email correspondence with you and its attachments (quote, contract, invoice, and support correspondence) | Communicating with you by email |
| E-invoicing integrator (özel entegratör) and the Turkish Revenue Administration (GİB) | Invoice information | Issuing e-invoices and meeting our tax obligations |
| Banks | Payment and collection records; for suppliers, bank account details | Collections and payments |
| Persons who provide us with legal and financial advisory services | Contracts, invoices, and correspondence, to the extent necessary | Advisory services, audits, and protection of our rights |
| Personal Data Protection Board (the Board), courts, enforcement offices, and other competent public authorities | Data they request or that the law requires | Fulfilling our legal obligations and handling disputes |
Transfers abroad
We use Resend to send account emails (invitation, password reset, verification code); in doing so, your name, email address, and the content of the email are transferred abroad. Since there is no adequacy decision of the Personal Data Protection Board for the country of transfer, the transfer is made by signing the standard contract announced by the Board and notifying the Authority (KVKK Article 9(4)(c) and Article 9(5)). Here, “the Authority” means the Personal Data Protection Authority.
We use Microsoft for our corporate email service; in doing so, our email correspondence with you and its attachments, together with your identity, contact, customer transaction, legal transaction, and finance information they contain, are transferred abroad. Since there is no adequacy decision of the Personal Data Protection Board for the country of transfer, the transfer is made by signing the standard contract announced by the Board and notifying the Authority (KVKK Article 9(4)(c) and Article 9(5)).
Our servers are located with a hosting provider in Turkey. Transfers abroad of workspace data that we process on the customer’s behalf, including for IWB AI, are described on the Data Processing Agreement and Privacy Policy pages.
How long we keep data
| Record | Period | Period starts from |
|---|---|---|
| Quotes, contracts, orders, and commercial correspondence | 10 years | End of the calendar year in which the relationship ends |
| Invoices and accounting documents | 10 years | End of the calendar year to which the document relates |
| Contact card of a representative whose relationship has ended (other than the two rows above) | 2 years | End of the relationship |
| User account | Until the account is anonymized or the workspace is permanently deleted | – |
| Session records | 90 days | End of the session |
| Sending records of account emails | 90 days for delivered emails, 365 days for undelivered emails | Time of sending |
| Application access logs (app.iwb.com.tr) | 1 year | Time of recording |
| Support ticket (subject and correspondence) | 10 years | End of the calendar year in which the contract ends |
| Support attachments and screenshots | 6 months | Closing of the request |
| Admin panel action records | 2 years | Time of recording |
| Operational information for installations on the customer’s own server | 1 year | Time of recording |
The 10-year period for commercial records and financial documents comes from Article 82 of the TTK; it applies because it is longer than the 5-year period in Article 253 of the VUK. Backups are not kept for longer than 30 days.
Records whose period has expired and that are not deleted automatically are deleted, destroyed, or anonymized in the first periodic destruction after the period ends. We carry out periodic destruction every six months, in January and July, and document it in a written record. If no reason remains that requires us to keep the data, we complete your deletion request within 30 days at the latest, without waiting for the periodic destruction. Our full retention and destruction rules are on the Personal Data Retention and Destruction Policy page.
Data in your workspace
For business data entered into the customer’s IWB workspace (such as contact, employee, document, email, file, service, and location records), the customer is the data controller. In the cloud installation, we host and process this data as a data processor on the customer’s behalf and on its instructions; the rules are set by the Data Processing Agreement between the customer and us. The customer fulfills the duty to inform data subjects about this data; this notice does not cover it.
The same rule also applies to the following data:
- Business data in screenshots and files you attach to a support request.
- The actions themselves that Firmanet staff take from the admin panel on the customer’s behalf (creating a user account, lifting an account lock, resetting a password, anonymizing an account). Our recording of these actions for evidentiary purposes, however, is a processing activity described above for which we are the data controller.
- Conversations with IWB AI and records processed by IWB AI.
- Data sent and received through services the customer connects with its own account (e-document integrator, SMS, WhatsApp, bank feed, mailbox).
- Migration of legacy ERP data into IWB.
- Daily usage counters of the Tasks module per workspace.
The customer itself uses the personal data tools in the application, such as anonymizing users, contacts who are natural persons, and contact persons. When the customer closes its workspace, the workspace can be restored within 30 days and is then permanently deleted; if there are financial documents whose retention period has not expired, the workspace is not deleted automatically.
In installations on your own server, the data is on the customer’s server; no inbound connection is opened for management, and the license is validated without an internet connection. We do not access this data. We access it only with the customer’s permission and by the method the customer provides, for installation, data migration, customization, and support; in such access, we are a data processor on the customer’s behalf.
You must submit applications concerning your data in a workspace to the customer you work for or receive services from. If your application reaches us, we forward it to the customer within 5 business days and let you know; the customer, as the data controller, responds to your application.
Your rights and how to apply
Under Article 11 of the KVKK, you have the right to learn whether your data is processed; to request information; to learn the purpose of processing and whether the data is used in line with that purpose; to know the persons to whom it is transferred; to request its correction, deletion, or destruction and the notification of this to the persons to whom it was transferred; to object to a result against you arising from analysis carried out exclusively by automated systems; and to request compensation for any damage you suffer. How to apply and the response period are explained on the Data subject requests page.
You can apply in three ways. The first is a written application bearing your wet-ink signature, which you can deliver to our head office address by hand, by mail, or through a notary public. The second is an email signed with a secure electronic signature or a mobile signature. The third is an email sent from an email address that you have previously provided to Firmanet and that is in our records. For the last two methods, you send the email to [email protected]. We record your application and respond in writing or electronically within 30 days at the latest. If your application is rejected, if you find our response insufficient, or if we do not respond in time, you may file a complaint with the Board within 30 days from the date you learn of the response and, in any event, within 60 days from the date of your application.
Changes
Before processing your data for a new purpose not stated in this notice, we update this notice; processing for the new purpose does not begin before the updated notice is published. Our general approach to personal data and our other documents are on the Privacy Policy page.
The version and the date of the last update are shown at the top of the page. When we change this notice, we publish the new version at this address; the change applies from the date it is published.