Privacy Policy and KVKK Information Notice
Version 1.3.2
Last Updated: October 3, 2026
Language priority: For the Türkiye region, the Turkish version is the main version. If the English translation differs, the Turkish version controls to the extent permitted by applicable law.
This Privacy Policy explains how NumLock Soft Yazılım Bilişim Ltd. Şti. ("TWS", "we", "our", or "us") processes personal data in the TWS websites, web application, APIs, and related services actually provided in the relevant deployment. It should be read together with the Terms of Service and Product Specification.
This Policy does not govern third-party websites, identity providers, email providers, integrations, or user-published websites. Those parties may provide their own privacy notices. If a feature has a separate notice, that notice supplements this Policy for that feature.
TWS is generally the data controller for account, authentication, security, support, legal-compliance, and platform-operation data that it processes for its own purposes.
When an organization or Board Owner decides what personal data is entered, shared, retained, exported, or published in a Board, that organization or owner will generally be the data controller for that content. TWS will generally process that content as a data processor on the controller's documented instructions to provide the Service. TWS may nevertheless be a separate controller for its own security, abuse prevention, support, legal, and operational activities.
Organizations using TWS for personal data should execute an applicable Data Processing Agreement with TWS. Board Owners and users must provide required notices, establish a lawful basis, configure permissions, and respond to requests concerning people whose data they place in a Board.
TWS does not require special-category personal data. Users and Board Owners should not enter such data unless the processing is necessary, lawful, and protected by appropriate safeguards. User-submitted content may nevertheless contain such data, and TWS does not undertake to inspect every item for its presence.
Personal data is collected through registration and sign-in forms, content uploaded to the Service, cookies, server and security logs, support communications, and enabled identity providers, by automated or partly automated means.
| Processing | Purpose | Legal basis |
|---|---|---|
| Account and authentication data | Register, authenticate, recover, and secure accounts | Contract performance; legitimate interests for security and abuse prevention; legal obligation where specifically applicable |
| Board content and files | Store, display, synchronize, share, export, and provide collaboration features | The applicable KVKK processing condition determined by the Board controller; for TWS, the Data Processing Agreement and documented instructions |
| Security, abuse prevention, and audit logs | Protect users and infrastructure, investigate misuse, and maintain integrity | Legitimate interests for security and abuse prevention; legal obligation where specifically applicable |
| Service messages and support | Verification, password recovery, notifications, support, and incident communication | Contract performance; legitimate interests; consent where required |
| Legal and accounting records | Comply with legal, tax, accounting, and authority requests | The controller's legal obligation; where necessary, establishment, exercise, or protection of a right |
| Optional features or marketing | Provide the requested optional feature or communications | Consent where required, or another applicable legal basis |
The web application uses first-party auth and
username cookies to maintain a signed-in session. These
cookies are set with the Path attribute and SameSite=Lax; the Secure
attribute is added when the application is accessed over HTTPS. They are
deleted when the user signs out or deletes the account. Depending on the
"remember me" choice, the session cookie is configured for approximately
one day or 90 days.
TWS may use other strictly necessary browser storage or security mechanisms for service functionality. No non-essential analytics or advertising technology is described as enabled by this Policy. If such a technology is introduced, TWS will provide the required cookie notice and consent/preferences mechanism before using it where required.
TWS may disclose personal data to the following recipients, limited to the purposes stated below and subject to appropriate contractual and security arrangements:
TWS does not sell personal data. A user-published Public Card Tree or Personal Web Space may, by its nature, be accessible to anyone on the Internet and may be indexed, cached, copied, or archived by third parties.
The current production deployment stores the application, user databases, user files, and backups in AWS's Istanbul Local Zone, Türkiye. These core TWS data are not transferred outside Türkiye for storage. Backups may also be stored, when needed, on company-owned servers located in Türkiye and using encrypted disks. The repository's local development configuration uses the local filesystem; its empty storage settings do not describe the production deployment.
Transactional email through Google Workspace may involve transferring the recipient's email address, message content, and technical delivery data to Google Cloud EMEA Limited outside Türkiye. NumLock Soft Yazılım Bilişim Ltd. Şti. and Google have executed the standard contract under Article 9 of the Turkish Personal Data Protection Law for this transfer. Selecting Google Sign-In may also involve transfers of limited personal data outside Türkiye; an applicable transfer mechanism under Article 9 will be used for those transfers.
Board Owners remain responsible for checking whether the selected deployment, provider, and location satisfy their own regulatory, contractual, or data-residency requirements.
TWS uses measures designed to protect personal data, including password hashing, authenticated and Board-scoped authorization, permission management, two-factor authentication where enabled, signed time-limited file URLs, operational monitoring, and HTTPS/TLS where deployed. No system can guarantee absolute security.
TWS retains data only for the period needed for the purposes described in this Policy, the Service, legal obligations, accounting and tax rules, security and fraud prevention, dispute resolution, or the establishment, exercise, or defense of legal claims. The applicable retention period is determined by the nature of the data and these criteria; when a fixed period is not stated, the shortest reasonable period is used.
A user can request account deletion through the account settings. The current deletion flow deletes the user's database and user file storage and attempts to remove that user from other users' connection data. It cannot automatically remove every historical mention, quotation, screenshot, comment, or file created by another user. If cleanup of an unavailable user database fails, the system records the cleanup issue for operational follow-up.
The production server creates backups on a weekly schedule. When Object Storage is enabled, backup archives are uploaded there; when it is not enabled, the configured local storage backend is used. Production database backups are retained for 30 days and, under ordinary conditions, are deleted on a rolling basis after that period. Backups may temporarily contain data deleted from the live Service; deletion from the live Service does not mean immediate deletion from every backup. Temporary download files are removed after their serving period where supported.
Authenticated users can download a sanitized database copy and, where their permissions allow, download Board, Card, or personal file folders. Exports may contain information about other Board members when that information is within the user's authorized scope. Downloaded exports are no longer protected by TWS's controls; the recipient is responsible for protecting them.
Depending on applicable law, individuals may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent where applicable, and may complain to the competent supervisory authority. Requests may be sent to info@teamworkstation.com or to the postal address in Section 2. TWS may request information reasonably necessary to verify identity and will respond within the period required by applicable law.
Where TWS processes Board content as a processor, the request should normally be directed to the relevant Board Owner or organization first; TWS will assist that controller as required by the applicable agreement and law.
The Service is not directed to individuals who lack the legal capacity to enter into the applicable agreement. If a parent, guardian, or authority believes that a child has provided personal data unlawfully, they may contact TWS using Section 2.
TWS may update this Policy. Material changes will be communicated through appropriate channels where required. The version and effective date above identify the current text.
TWS may maintain audit and activity records containing user identifiers, timestamps, affected resources, API activity, approval actions, permission changes, recovery events, and other operational events needed for security, troubleshooting, collaboration history, compliance, or abuse investigation. If AI-assisted features are introduced, related requests, responses, actions, and metadata may be recorded under a separate feature notice where required. AI features are not represented as currently available by this Policy.