Privacy Policy — Tam İK
Last updated: 28 September 2026 · The Turkish text prevails in case of conflict.
1. Scope
This policy explains how personal data is processed in Tam İK, the human-resources service provided by Codron — the iOS/Android mobile app ("App") and the web panel at https://ik.codron.co ("Panel"), together the "Service" — in line with the Turkish Personal Data Protection Law No. 6698 ("KVKK").
The Service is used by company administrators (who register and manage a company) and employees (whose records and accounts are created by their company).
2. Who is the data controller?
| Data | Data controller | Codron's role |
|---|---|---|
| All employee data: personnel records, attendance, leave, pay, payslips, information requests and documents ("Customer Data") | The employee's employer (the company) | Data processor — processes the data only on the company's instructions and to provide the Service |
| Company administrator account data (name, e-mail, password hash given at sign-up), company registration, Service security, support correspondence | Codron | Data controller |
Employees: please send requests about your personnel data (access, correction, deletion, etc.) to your employer first; your employer is the controller and decides retention periods under the law. Requests sent to Codron are forwarded to the employer and handled on its instructions.
Codron contact (as controller):
- Legal name: CODRON CO – Mehmet Emin İnci (sole proprietorship)
- Address: Kuruköprü Mah. Sefa Özler Cad. Özden İş Merkezi Kat:6 Daire:65, 01250 Seyhan/Adana, Türkiye
- Tax office: 5 Ocak Vergi Dairesi
- VERBİS: exempt from VERBİS registration
- E-mail: kvkk@codron.co
3. Personal data we process
Which fields are filled in is decided by the employer. Categories the Service can process:
- Identity: name, surname, Turkish ID number, date of birth, profile photo
- Contact: work and personal e-mail, mobile and company phone, address, city
- Employment: department, position, start/termination date, working hours, status, driving licence class, termination reason and settlement
- Attendance: clock-in/out times, channel (app button / kiosk QR), late-arrival reasons, daily timesheet statuses and notes
- Leave: requests, type (annual, unpaid, sick, marriage, bereavement, other), dates, notes, balances
- Financial: salary, travel/meal allowance, bonuses, earnings, payslips, advance/account movements, IBAN, social security (SGK) number and settings
- Emergency contact: name and phone of the person to call in an emergency
- Special category (health): blood type; "sick leave" status. No other special-category field exists in the Service.
- Information and document requests: your answers and uploaded documents (e.g. a copy of an ID, a diploma photo or PDF)
- Account and security: user ID, sign-in identifier (e-mail / Turkish ID / phone), one-way password hash (the password itself is never stored), session tokens, app installation ID, push notification device token, IP address and user agent recorded with clock-in/out, IP/device allow lists defined by the company
- Company administrator: name, e-mail, company name, tax and contact details, addresses, logo
We do not collect location (GPS) data — the App never asks for location permission. We do not access your contacts, microphone or photo library directly. We do not use advertising identifiers, do not track you across apps or websites, and use no third-party analytics or advertising SDKs.
Security: Turkish ID numbers, phone numbers, IBANs, SGK numbers, addresses and emergency contact phone numbers are stored encrypted in the database. All traffic uses HTTPS. The App keeps your session in the device's secure storage (iOS Keychain / Android Keystore).
4. Purposes and legal bases
| Purpose | Legal basis (KVKK) |
|---|---|
| Running the employment relationship: timesheets, attendance, leave, pay and payroll preparation, termination settlements | Art. 5/2(c) performance of the employment contract; Art. 5/2(ç) legal obligations under labour, social security and tax law |
| Health data (blood type, sick leave) | Art. 6/3 — legal obligations in employment, occupational health and safety and social security; otherwise explicit consent (obtained by the employer) |
| Information and document requests (completing personnel files) | Art. 5/2(c), (ç); otherwise the basis set by the employer |
| Account creation, authentication, session management | Art. 5/2(c) performance of the Service agreement |
| Verifying clock-ins, preventing unauthorised access and false attendance records (IP/device allow lists, session logs, rate limits) | Art. 5/2(f) legitimate interest; Art. 5/2(ç) data security obligation |
| Notifications (e-mail and push): new information request, deadline reminder | Art. 5/2(c) |
| Answering support requests | Art. 5/2(c), (f) |
| Establishing, exercising or defending legal claims | Art. 5/2(e) |
Your data is never used for advertising, profiling or sale.
5. Recipients
- Your employer / company administrators, within the permissions granted to them in the Service.
- Hosting provider (the Netherlands (EU)): our servers are hosted by Hostinger in the Netherlands (EU); your data is stored and processed there. This cross-border transfer relies on the safeguards required by KVKK Art. 9 (as amended in 2024) — e.g. the standard contractual clauses published by the Board.
- Google Firebase Cloud Messaging (Google LLC / Google Ireland): only the device token and the notification content (title "Yönetiminiz sizden bilgi istiyor", body: request title) are processed to deliver push notifications; data may be transferred to servers outside Türkiye including the USA under KVKK Art. 9 safeguards. You can turn notifications off in your device settings at any time; the Service keeps working.
- E-mail delivery provider: notification e-mails are sent through Hostinger, from the Netherlands; the same KVKK Art. 9 safeguards apply.
- Apple and Google (app stores): downloading the App is subject to the store operator's own privacy policy.
- Public authorities, when legally required.
Codron does not transfer your personal data to any third party beyond those listed above, and does not sell or rent Customer Data to anyone.
6. Retention
| Data | Period |
|---|---|
| Customer Data | While the employer uses the Service and for the period the employer determines; employers must keep personnel and attendance records for the periods required by law. Records of former employees are kept until the employer deletes them or deletes the company account. |
| When a company account is deleted | All company data, user accounts belonging only to that company, session and device tokens and uploaded files are deleted from the live system immediately and permanently. Copies in backups are removed through the backup rotation within at most 30 days. |
| Session tokens | Until sign-out or revocation |
| Push device token | Deleted on sign-out or when the token is reported invalid |
| Clock session logs (IP, user agent) | Together with the personnel record |
| System / server logs | At most 12 months |
| Data Codron controls (administrator account, support, billing) | For the life of the account; commercial records tied to the subscription are kept for 10 years under Turkish Commercial Code Art. 82 and the Tax Procedure Law, others are deleted sooner where no legal retention applies |
7. Account and data deletion
- Company administrators: in the App go to Daha fazla (More) → Şirket bilgileri (Company info) → Şirketi sil (Delete company), enter your password and the company name. The company account and all its data are deleted permanently. This cannot be undone. See Account Deletion for details.
- Employees: your account is created and managed by your employer. Ask your employer to close your account or delete your data. You may also send the request to kvkk@codron.co or via the support page; Codron forwards it to your employer and acts on its instructions. Data your employer is legally required to keep may not be deleted before that period ends.
8. Your rights under KVKK Art. 11
You may ask the data controller to: (a) learn whether your data is processed; (b) request information about it; (c) learn the purpose and whether it is used accordingly; (d) know the third parties it is transferred to in Türkiye or abroad; (e) have incomplete or inaccurate data corrected; (f) have it erased or destroyed under Art. 7; (g) have third parties notified of (e) and (f); (h) object to a result against you arising solely from automated analysis; (i) claim compensation for damage caused by unlawful processing.
How to apply: for employee data, contact your employer; for data Codron controls, write from your registered e-mail to kvkk@codron.co. Requests are answered free of charge within 30 days. If your request is rejected or not answered in time, you may complain to the Personal Data Protection Board (KVKK).
9. Children
The Service is for businesses and is not directed to children.
10. App permissions
| Permission | Why |
|---|---|
| Camera | Scanning the kiosk QR code to clock in/out and photographing documents your employer requests. Opens only when you tap the button. |
| Files | Choosing a requested document on your device to upload. |
| Notifications | New information requests and deadline reminders. |
You can revoke permissions in the device settings at any time.
11. Cookies (web panel)
The Panel uses only strictly necessary cookies for the session and security (CSRF). No analytics or advertising cookies. See the Çerez Politikası (Turkish) for the full list.
12. Changes
We may update this policy and will announce material changes in the Service or by e-mail. The current version is always at https://ik.codron.co/gizlilik.