Privacy Policy

Version 2026-10-v2 · Updated October 20, 2026

This English translation is provided for convenience. The Turkish text is the governing version.

What this policy covers

This policy explains how the following company approaches personal data:

Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”), Büyükkayacık OSB Mahallesi, 101. Cadde, InnoPark Konya TGB, B Blok, No:4/105, 42160 Selçuklu / Konya. Phone: +90 (312) 439 3940. Email: [email protected]

In this policy, Firmanet refers to itself as “we”. The policy covers the following:

The iwb.com.tr website and the demo and quote request forms on the site; contacting us by phone and email.
The IWB application: cloud deployment (app.iwb.com.tr and customer-specific addresses in the format companyname.iwb.com.tr) and deployment on your own server.
IWB AI: the artificial intelligence features in the IWB application.

This policy is a framework; it does not replace the privacy notices. The privacy notice that applies to you explains which of your data we process, for what purpose, on what legal basis, and for how long. The “Which document applies to you” section below tells you which document that is.

The policy also sets out the privacy rules we apply under Article 3(1)(d) of Electronic Commerce Law No. 6563 (ETK). Processing relating to Firmanet employees is outside the scope of this policy.

Our roles

Law No. 6698 on the Protection of Personal Data (KVKK) defines two roles. The data controller decides for what purpose and by what means the data is processed. The data processor processes data on behalf of the data controller and on its instructions. We determine our role not by how a contract names it but by who actually makes these decisions. For the same data, we may act in both roles at once for different purposes.

Processing for which we are the data controller

Server access logs for visits to iwb.com.tr and records kept to prevent abuse of the forms.
Demo and quote request forms; requests received by phone and email.
Marketing emails you have consented to.
Our dealings with representatives of customers, business partners, and suppliers concerning quotes, contracts, installation, training, invoicing, and collections; subscription, plan, and contract records.
Account and sign-in security of IWB users: sign-in, two-step verification, account lockout, device limit, session records, and account emails (invitation, password reset, verification code).
Support requests: the requester’s name, email address, workspace and company name, page and browser information, and description.
Usage counts for plan limits and billing: number of users and IWB AI usage volume.
Operational information sent by the optional update agent in deployments on your own server.
Job applications from candidates, and applications from data subjects.

The customer also sees account and session records in order to manage its own users. For that use, the customer is the data controller and we are the data processor.

Processing for which we are the data processor

We carry out the following processing on behalf of the customer and on the customer’s instructions:

In cloud deployment, all business data in the workspace: contact, employee, document, email, file, service, location, and similar records.
Business data in screenshots and files attached to support requests.
Actions our team takes on behalf of the customer from the admin panel: creating users, lifting account locks, resetting passwords, and anonymization.
Transmission to services the customer connects with its own account (e-document integrator, SMS, WhatsApp, bank account transaction feed, mailbox).
IWB AI and IWB AI conversation records.
In deployments on your own server, access for installation, data migration, customization, and support with the customer’s permission.
Migration of legacy ERP data to IWB.
Daily usage counters kept per workspace for the Tasks module.

For this data, the customer is the data controller. The customer decides for what purpose and on what legal basis the data is processed, and the customer informs its own employees, customers, and other data subjects. We do not issue privacy notices in Firmanet’s name for this data. We forward applications we receive to the customer.

In deployments on your own server, customer data resides on the customer’s server. We access this data only for work the customer has authorized and only by the method the customer provides.

Which document applies to you

You	Document that applies to you
You visited the website, filled in a demo or quote request form, or contacted us by phone or email	KVKK Privacy Notice: website and request forms
You are a representative of one of our customers, an IWB user, or a representative of one of our business partners or suppliers	Privacy Notice: customers, product users, business partners, and suppliers
You applied to us for a job	Privacy Notice: job candidates
You have consented to marketing emails or are considering doing so	Commercial electronic message consent and explicit consent text
Your data is in the IWB workspace of one of our customers (you are an employee, customer, or supplier of that company)	That company is the data controller, and that company provides the privacy notice. The rules between us and our customers: Data Processing Agreement
You want to know about cookies and browser storage	Cookie Policy
You want to know how long data is retained	Personal Data Retention and Destruction Policy
You want to exercise one of your rights	Data subject requests
You are looking for the website’s terms of use	Website Terms of Use

Website

The iwb.com.tr website does not use cookies, local storage, or similar browser storage. It does not load analytics, advertising, map, video, or chat tools; fonts are served from the site’s own server. External addresses such as the map, LinkedIn, and the status page open only when you click the link; the page that opens is governed by that service’s own rules.

Access log

Every request to the site is written to the server access log: IP address, date and time, the requested address (including any campaign parameters in the address), the referring address, and browser information. We keep this log for the secure operation of the site and to detect abuse, and we retain it for 6 months.

Request forms

The information you enter in the demo and quote request forms is transferred from the request service on the server to Firmanet’s own IWB workspace. The access key used for this transfer is not sent to your browser. Our sales team gets back to you about your request by phone or email.

If a request cannot be saved to the workspace, it waits in a temporary file of the request service. This file is deleted after the transfer, and within 7 days at the latest.
The request service’s own logs do not contain names, email addresses, or phone numbers.
To understand which page and campaign a request came from, we record the page on the site you viewed before reaching the form and the campaign parameters in the address. If you came from another site, we record only the name of that site.
The forms use three measures to identify automated submissions: a hidden field; a signed timestamp obtained when the form is first used and not stored in the browser; and a submission limit per IP address. For the submission limit, your IP address is held in memory only, for 10 minutes.
The marketing email checkbox is unchecked by default and is not a condition of the request.
We do not process the request records in our own workspace with IWB AI.

Details are in the KVKK Privacy Notice: website and request forms and the Cookie Policy.

IWB application

Cloud deployment

In cloud deployment, we process the business data in the customer’s workspace on the customer’s behalf, as a data processor. The rules of this relationship are set out in the Data Processing Agreement. The servers are with a hosting provider in Turkey; the provider’s legal name is disclosed in writing in the subscription agreement.

To fulfill its obligations as data controller, the customer uses the KVKK tools in the application: anonymization of users, contacts who are natural persons, and contact persons; anonymization of HR personnel file data through an HR action once its period has expired; and a sensitive data flag for custom fields.

For services the customer connects with its own account (e-document integrator, SMS, WhatsApp, bank account transaction feed, Google or Microsoft mailbox), the customer holds the contract with the provider. We transmit data to these services on the customer’s instructions.

Account and platform security

To protect user accounts and the application, we keep the following records as data controller: name, email address, password hash, two-step verification key and recovery codes, number of failed sign-in attempts, device ID cookie, browser and operating system label, IP address with the last segment masked, and last seen time. Session records are deleted after 90 days. The application server’s access log is retained for 1 year.

We send invitation, password reset, and verification code emails through Resend; this sending is a transfer abroad (see the Transfers abroad section). For plan limits and billing, we process the number of users and IWB AI usage volume in aggregate, without linking them to individuals.

The application uses first-party cookies only for sessions and security; no third-party cookies or measurement tools run. The name, purpose, and duration of each cookie are in the Cookie Policy.

Details are in the Privacy Notice: customers, product users, business partners, and suppliers.

Support and admin panel

You can reach us for support by email or phone. Support requests you open with the “Report a bug” button in the application are recorded in our support ticketing system. Screenshots and files you attach to a request are deleted 6 months after the request is closed; we process the business data they contain on the customer’s behalf.

Our team uses the admin panel for support and operations. Changes made from the panel are written to the customer’s own security log with the label “Panel”.

Deployment on your own server

Data resides on the customer’s server. No connection from outside is opened for administration; the license is validated without an internet connection.

We access the customer’s server for installation, data migration, customization, and support only with the customer’s permission and by the method the customer provides. In this access, we are the data processor.
External services that run on Firmanet’s account, such as IWB AI and support tickets, are disabled unless they are enabled in the installation. If they are enabled, the rules for cloud deployment apply.
The update agent is optional. If installed, it sends us only operational information: version, health, disk and backup status, and the server’s IP address. As data controller, we retain this information for 1 year for updates and operations.

Data migration, closure, and end of contract

Migration dumps used when moving data from your old system to IWB are deleted 90 days after the migration is completed.
A closed workspace can be restored within 30 days; after that, it is permanently deleted. If there are financial documents whose retention period has not expired, the workspace is not deleted automatically.
When the contract ends, if the customer requests it, we deliver its data in a machine-readable format within 30 days.

IWB AI

IWB AI is the name of the artificial intelligence features in the IWB application: chat, tender document reading, receipt reading, service suggestions, and natural language filters. When you use IWB AI, you are interacting with an artificial intelligence; its answers are generated by an artificial intelligence model.

We process data in IWB AI on the customer’s behalf, as a data processor. OpenAI provides the model service as a sub-processor.

Data sent to the model

Your question or request; the text you type in a natural language filter.
The most recent messages in the conversation.
Records read with your permissions. IWB AI works only with data you are able to see.
Images you upload, such as a photo of a receipt.
In tender document reading, only the document text you provide.

Data not sent to the model

Fields that are hidden or masked for your role: they are removed before anything is sent to the model.
Records you are not authorized to see.
In tender document reading, personal documents in the system such as resumes and diplomas.
Your voice: with voice input, no audio reaches IWB, only text.

Provider, transfer abroad, and training

OpenAI is used for IWB AI; in the process, the data listed above is transferred to the United States. Since there is no adequacy decision of the Personal Data Protection Board (the Board) for the country of transfer, the transfer is made by signing the standard contract announced by the Board and notifying the Personal Data Protection Authority (the Authority) (KVKK Article 9(4)(c) and Article 9(5)).

Data sent to IWB AI is not used to train artificial intelligence models. We do not use it for training, and the provider does not use it either, under its contract and account settings.

You stay in control

For every action that changes a record, IWB AI first asks for your approval. No record changes until you approve.
Records written by IWB AI carry a label showing that they were written by artificial intelligence.
The customer can turn off IWB AI at the workspace level. The artificial intelligence features of the Field Service and Tender Tracking modules are off by default.
When a user is anonymized, that user’s IWB AI conversations are also deleted. Conversations you delete are permanently deleted within 30 days.

Check the results

Artificial intelligence answers may be wrong or incomplete. Check the results yourself, especially before making a decision about a candidate, employee, or customer. Your right to object to a result against you arising from analysis carried out exclusively by automated systems also applies to data processed with IWB AI. Because the data in IWB AI is in the customer’s workspace, we forward your application concerning this data to the customer.

Security

The measures we currently apply are the following:

Each customer’s data is protected separately in the application and in the database.
Permissions are granted at the role and field level. Hidden and masked fields are concealed on screen, in exports, in reports, and in what is sent to IWB AI.
User passwords are stored hashed; integration passwords and connection keys are stored encrypted.
The application is accessed over an encrypted connection.
Passwords are at least 8 characters long and contain uppercase and lowercase letters and a number. After 5 failed attempts, the account is locked for 5 minutes.
Two-step verification is available. Users can turn it on themselves; it can also be made mandatory across the installation.
In session records, the last segment of the IP address is masked, and no browser fingerprint is kept. The records are deleted after 90 days.
The security log records permission changes, access denials, the trail of reads of special categories of personal data, downloads of files containing personal data, and changes made from the admin panel (with the label “Panel”).
The request forms have measures to identify automated submissions (see the Website section).
Our staff give a confidentiality undertaking. Access to customer data is limited to what their duties require.
Backups are not kept for longer than 30 days.

Product security is described in detail on the Security page.

Transfers abroad

We transfer personal data abroad for the following three services:

Service	Provider	Data transferred abroad	Country
Corporate email ([email protected] and staff email)	Microsoft	Correspondence on requests, support, job candidates, customers, and applications, with attachments	Country stated in the standard contract
IWB AI artificial intelligence model	OpenAI	The data listed in the IWB AI section	United States
Sending account and transactional emails	Resend	Invitation, password reset, and verification code emails; if the customer has not connected its own mailbox, document emails such as invoices and quotes: the recipient’s email address, the content of the email, and its attachments	Country stated in the standard contract

The providers named in the table are used for these services; in the process, the data listed in the table is transferred abroad. Since there is no adequacy decision of the Personal Data Protection Board for the country of transfer, the transfer is made by signing the standard contract announced by the Board and notifying the Authority (KVKK Article 9(4)(c) and Article 9(5)).

The servers for the site and for cloud deployment are with a hosting provider in Turkey.
Our staff access customer data only from Turkey.
The sub-processors we use for data we process on behalf of customers are listed in the Data Processing Agreement.
For services the customer connects with its own account, the customer holds the contract with the provider; the customer provides the legal basis for transfers to these services.
If a new service requires a transfer abroad, we will update this policy and the relevant privacy notices before the transfer begins.

Data breaches

When we become aware of a breach involving data for which we are the data controller, we notify the Board without delay and within 72 hours at the latest. Once we have identified the persons affected, we also notify them as soon as possible: directly if we have your contact details, otherwise by an appropriate means such as a notice on the website. The notification includes:

when the breach occurred,
the categories of data affected,
the possible consequences of the breach,
the measures we have taken and the measures you can take,
the contact channel through which you can obtain information.

For data we process on the customer’s behalf, we notify the customer within 24 hours of becoming aware of the breach. Notifying the Board and the data subjects is the customer’s obligation; we provide the customer with the information needed for this.

If we do not yet have all the information required for the notification, we provide it in stages; if a notification is delayed, we explain the reason to the Board. We record each breach, its effects, and the measures we have taken in our breach register. We review our data breach response plan regularly.

Retention

We retain personal data only for as long as necessary for the purpose for which it is processed and for the period prescribed by law; when that period ends, we delete, destroy, or anonymize it. The retention period for each record is in the privacy notice that applies to you, and the full table is in the Personal Data Retention and Destruction Policy.

We carry out periodic destruction every six months, in January and July, and record it in written minutes. We complete your deletion request within 30 days without waiting for periodic destruction. The customer sets the retention period for data we process on its behalf; in-product retention periods and deletion at the end of the contract are covered in the Data Processing Agreement.

Your rights

Under Article 11 of the KVKK, you have the right to learn whether your data is processed; to request information; to learn the purpose of processing and whether the data is used in line with that purpose; to know the persons to whom it is transferred; to request its correction, deletion, or destruction and the notification of this to the persons to whom it was transferred; to object to a result against you arising from analysis carried out exclusively by automated systems; and to request compensation for your damage. How to apply and the response period are explained on the Data subject requests page.

We respond to your application in writing or electronically within 30 days at the latest. If your data is in the IWB workspace of one of our customers, that customer is the data controller; we forward your application to the customer within 5 business days and inform you. If your application is rejected, if you find our response insufficient, or if we do not respond in time, you may file a complaint with the Board.

Children

IWB is intended for businesses. The iwb.com.tr website, the IWB application, and IWB AI are not intended for persons under the age of 18. If a customer’s workspace contains data relating to persons under the age of 18, the customer is the data controller for that data.

Changes

We update this policy when our product, the services we use, or the legislation changes. We publish significant changes, such as a new recipient or a new transfer abroad, on this page before we start applying them. We also notify our customers of changes that affect how customer data is processed, following the procedure in the Data Processing Agreement.

This policy is for information purposes; it does not impose any obligation on you. The original language of the policy is Turkish; versions in other languages are provided for information.

The version and update date are shown at the top of the page. When we change the text, we publish the new version at this address; changes apply from the date they are published.