The Turkish version of this text is the legally binding version.
1. Data controller
Bella Binary Yazılım (MERSİS: 0163111961900001, Tax ID: 1631119619) — İvedikosb Mah. 2224 Cad. No: 1 İç Kapı No: 116, Yenimahalle / Ankara (Teknopark Ankara), Türkiye. Email: info@bellabinary.com
2. Our role: data controller or data processor?
- Website, contact form and our own customer relationships: Bella Binary is the data controller. Details are in the Privacy Notice (KVKK).
- Products that organizations use for their own employees, students or customers (Spoud, ServisX, Bella KYS, Bella SCADA and others): the organization using the product is the data controller. If the system runs on the organization's own server, the data never reaches us. If it runs on a server we operate, we process the data on the organization's behalf and instructions, as a data processor; in that case please address your request to the organization first.
- Apps we offer directly to individual users (VefaLink): Bella Binary is the data controller.
3. Spoud (field operations app)
- Data controller: the employer using the app for its employees.
- Data processed: the employee's identity and contact details, task and visit records, task photos and customer signatures, location, device status (model, operating system, battery, network, permission states). If the employer turns them on, call log (numbers shown masked) and SMS metadata; SMS content needs a separate permission and is off by default.
- Location: collected only within the working-hours profile defined by the employer; no location is tracked for an employee with no profile. A persistent notification is shown while tracking; the device status signal sent while the app is open also carries the last known location.
- Visibility and retention: live location, location history and export are separate permissions. The employer sets retention per data type; data accumulated on the phone is cleared within 30 days.
- Employee control: the "Your data" screen in the app shows what is on; employees can export their own data and submit access, correction or deletion requests from the app.
- Third parties: Google Play services for location; OpenStreetMap map tiles for the map in the management panel.
4. ServisX (school and staff shuttle app)
- Data controller: the organization running the service (school or transport company).
- Student data: school number, name, class, pickup address and location, daily attendance records. No student photos or health information are stored. Students have no account of their own; the data is entered by the organization and the parent.
- Parent data: name, phone, app account, "not using the bus today" and temporary address notices.
- Driver data: identity and contact details and the documents the organization requires (driving licence, SRC, psychotechnical report, health report, criminal record). Health reports and criminal records are special categories of personal data under Article 6 of the KVKK; the organization processes them on the conditions set out in the relevant legislation.
- Location: the driver's location is sent only while a trip is open; parents see the vehicle only while their child's route has an open trip and cannot access past routes.
- Third parties: Firebase Cloud Messaging (Google, outside Türkiye) for push notifications; CARTO map tiles for maps.
5. VefaLink (check-in app)
- Data controller: Bella Binary.
- Data processed: email address, display name, role (guardian or dependent), language and platform, notification token; scheduled check-in times, check-in status and who responded; pairing records and when pairing consent was withdrawn; subscription details.
- Location: VefaLink does not collect location data and does not ask for location permission.
- Third parties: Google Firebase (servers in the USA) for authentication, database, notifications and server functions; Google Sign-In; Google Play Billing to verify subscriptions.
- Export and deletion: users can export their data from the app. When an account is deleted, account details and pairings are deleted; deletion of check-in history is requested through the Account and Data Deletion page.
6. Children's data
Our apps do not open accounts for children and do not collect data directly from children. Student data processed in ServisX is processed on behalf of and under the responsibility of the organization running the service, and is entered by the organization and the parent.
7. Transfers abroad
- Website, contact form and our customer relationship system: GoDaddy servers outside Türkiye.
- Corporate email: Google Workspace (Google).
- VefaLink: Google Firebase (USA).
- ServisX push notifications: Firebase Cloud Messaging (Google).
These transfers fall under Article 9 of the KVKK and are made on the basis of the standard contract announced by the Personal Data Protection Board. For products running on an organization's own server, the data stays where the organization decides.
8. Security
Measures such as role and permission separation, optional two-step sign-in, change logs, encrypted connections and rate limiting are described, with product differences, on our Security page. Your data is not sold or shared for advertising; our website uses no ad network.
9. Retention and your rights
Retention periods for website data and all your rights under Article 11 of the KVKK are listed in the Privacy Notice (KVKK). For products used by organizations, the controller organization sets retention. For account and data deletion requests, see the Account and Data Rights page or write to info@bellabinary.com; requests are resolved within 30 days at the latest.
10. Changes
This policy is updated when our products or processing activities change; the current version is published on this page with its date.