Privacy Notice on the Processing of Personal Data

Under article 10 of the Personal Data Protection Law no. 6698 ("KVKK"), the information below concerns the personal data processed while you use the KEYCOVAULT service.

1. Data controller

DUMERK ELEKTRONİK SANAYİ VE TİCARET LİMİTED ŞİRKETİ (provides the service under the KEYCOVAULT brand).

• Address: Fulya Mah. Büyükdere Cad. Osmanbey Apt. No: 52 İç Kapı No: 17 Şişli / İstanbul
• MERSIS No: 0314-1207-4570-0001
• Trade registry: İstanbul Ticaret Odası, Sicil No: 206257-5
• Tax office: Mecidiyeköy Vergi Dairesi
• Contact: info@keycovault.com

2. Data we process

• Identity and contact: first name, last name, email address, (optional) phone number.
• Account and security: password hash (your password itself is not stored), session records, a hash of the IP address, activity records.
• The documents you upload and the details extracted from them and saved with your approval (e.g. policy number, expiry date, plate, amount, insured name).
• If you sign in with Google, the name, surname and verified email address received from Google.
• If you use the transfer plan feature: the information you put in the vault (passwords, codes etc.; stored encrypted) and the name, email address and (optional) phone of the person you name as an authorized person. You are responsible for informing the authorized person and for the sharing of their data; only verification and access emails are sent to the authorized person. Documents you mark to share with your authorized person can be downloaded when the authorized person opens the vault; documents you do not mark are not shared and you can remove the mark at any time. The authorized person's passphrase is not stored on the server. If you turn on the inactivity trigger, your last activity time is recorded; if you turn on the death certificate requirement for access, the document uploaded by the authorized person (which may contain third-party data) is virus-scanned, stored encrypted and shown only to you.

3. Purposes of processing and legal bases

• Creating your account, storing your documents and sending expiry reminders (establishment and performance of the contract — KVKK art. 5/2-c).
• Transfer plan: delivering your information to the authorized person you designate, with the waiting period and your right to object preserved (your explicit consent — art. 5/1).
• Ensuring service security, preventing abuse, fulfilling legal obligations (art. 5/2-ç, art. 5/2-f).

Information extracted automatically from documents is only a suggestion; it is not final and no reminder is set until you confirm it.

4. Where data is stored and transfers

Your documents and profile data are stored on servers in Türkiye, encrypted with keys specific to you. Email notifications are sent through domestic email infrastructure. If you share a document with another user, the invitation email goes to that person's address; once they accept, they see the document's confirmed information and file read-only and can receive expiry reminders if they wish; you can remove the sharing at any time. If you use forwarding documents by email, the email and attachments you forward arrive in our domestic email provider's mailbox; after processing they are deleted from the mailbox and the documents are stored encrypted like your other documents. If you enable the SMS feature, your phone number and the message text (verification code or reminder) are passed to a domestic SMS service provider and mobile operators to deliver the message; no advertising is sent by SMS. If you sign in with Google you are redirected to Google for authentication; your documents and profile data are not sent to Google. Your data is not shared with third parties for advertising. For the cookies used, see the Cookie Policy.

5. Retention period

Your data is kept as long as your account is open. When you delete your account it closes immediately; your documents and encryption key are permanently deleted within about 7 days. Statutory retention obligations are reserved.

6. Your rights (KVKK art. 11)

You have the right to learn whether your data is processed, request information, ask for correction or deletion, object, and claim compensation for damages. You can download your data in the app (Settings → Download my data), edit your profile and delete your account. You can send your other requests in writing, together with information that identifies you, to info@keycovault.com or the address above; your requests are concluded within thirty days at the latest.