Privacy notice

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Obligation to Inform and, for users in the European Economic Area (EEA), Article 13 of the General Data Protection Regulation (GDPR).

Controller: İbrahim Özgül
Address: Pirimehmet Mah. 1730 Sok. No:16/A, Merkez / Isparta, Türkiye
Email: info@digitalsolardesk.com
Registration: Şahıs işletmesi · Kaymakkapı Vergi Dairesi

• İbrahim Özgül is the controller of the account, subscription and security data of people who create a Digital Solar Desk account, company administrators and team members.
• Installation companies are the controllers of the data they enter for their own business (such as their customers' names, contact details, job addresses, quotes and projects). İbrahim Özgül processes that data only on the company's behalf and instructions, as a processor. The rules are on the Data processing agreement page.
• If you are a customer of an installation company, please exercise your rights with that company first. If you cannot reach it, write to us and we will forward your request.

• Identity and contact: email address; if you enter them, name, company name, phone and address.
• Account security: an irreversible hash of your password (the password itself is not stored), session data, sign-in and password-reset records, an activity log (which user changed which record and when).
• Subscription: plan, period, trial and payment status, customer and subscription IDs sent by Paddle, billing country. Card details never reach us; Paddle processes them.
• Business records: customers and suppliers, prices, quotes, projects, expenses, stock movements; files you upload such as price lists, logos and receipts.
• Technical data: an irreversible shortened hash of your IP address for rate limiting (kept at most 1 hour), request IDs and error codes in error logs.

We do not ask for special categories of data (health, biometrics etc.); please do not enter such data.

• Creating your account, signing you in and providing the service: performance of the contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b).
• Managing the subscription, trial and payments; tax and commercial-law obligations: contract and legal obligation (KVKK Art. 5/2-c, ç; GDPR Art. 6/1-b, c).
• Account security, preventing misuse and unauthorised access, keeping the activity log: legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f).
• Account emails (verification, password reset, team and payment notices): performance of the contract.
• Establishing, exercising and defending legal claims (KVKK Art. 5/2-e; GDPR Art. 6/1-f).

No processing is based on consent and no marketing emails are sent. If this changes, your permission will be asked separately, in a text separate from this notice.

Data is collected electronically and automatically: from forms you or your team fill in, files you upload, payment notifications from Paddle and security records the system creates.

To provide the service we share data only as far as needed with these providers:

• Supabase Inc.: database, sign-in and file storage (region Frankfurt, Germany).
• Hostinger International Ltd.: application server (Vilnius, Lithuania).
• Resend, Inc.: sending account emails (EU region, Ireland).
• Paddle.com Market Ltd.: payments, tax and invoicing as merchant of record (United Kingdom).
• Anthropic PBC: only if a company administrator turns on AI document reading, the price-list pages to be read (USA). Off by default.
• Competent public authorities: only where the law requires it.

Exchange rates are fetched from the Central Bank of the Republic of Türkiye and the European Central Bank; no personal data is sent to them. Your data is not sold or shared for advertising.

Because the infrastructure is outside Türkiye (EU and United Kingdom) and some providers are headquartered in the USA, personal data is transferred abroad. These transfers rely on appropriate safeguards under KVKK Art. 9: the standard contracts published by the Board and the providers' data processing agreements. Standard contracts are notified to the Personal Data Protection Authority within 5 business days of signature. For EEA users, transfers rely on the EU Standard Contractual Clauses and the providers' data processing agreements.

• Account and business records: as long as your account and company exist.
• When a company is deleted: records and files are permanently deleted at the end of the 14-day undo period (see Account deletion).
• Database backups: replaced within at most 7 days.
• Subscription and payment event records: may be kept for the periods required by tax and commercial law.
• Rate-limit records: at most 1 hour. Completed background job records: 30 days.

At the end of a period data is deleted, destroyed or anonymised.

Connections are encrypted (HTTPS/TLS). Each company's data is separated by row-level security rules in the database. Passwords are stored irreversibly and files are kept in private storage. Shared quote links use unguessable keys and can be revoked. Cost and profit figures are hidden from team members without that permission. Secret keys stay on the server. Access is role-based and important actions are recorded in the activity log.

Under KVKK Art. 11 you may learn whether your data is processed and request information, learn the purpose and whether data is used accordingly, know the third parties it is transferred to, request correction of incomplete or inaccurate data, request deletion or destruction where the conditions of KVKK Art. 7 are met, request that these actions be notified to recipients, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.

EEA users also have the rights of access, rectification, erasure, restriction, portability and objection, and may lodge a complaint with their supervisory authority.

You can export your company data and delete your company and account yourself in the application.

Under the Communiqué on the Procedures for Applications to the Data Controller you can send requests:

• from the email address registered on your account to info@digitalsolardesk.com,
• in writing to Pirimehmet Mah. 1730 Sok. No:16/A, Merkez / Isparta, Türkiye, or
• by registered electronic mail (KEP).

Requests are answered free of charge within 30 days at the latest; if the action involves an extra cost, the fee set by the Board may apply. If you are not satisfied with the answer, you may complain to the Personal Data Protection Board.

The service is for businesses and not suitable for people under 18. We do not knowingly collect data of people under 18.

When this notice changes, the date at the top of the page is updated. For important changes we also notify your account email.