Privacy Notice (KVKK)

Roles: controller and processor

NakliyeHub is a software service. The moving company using the platform is the DATA CONTROLLER for its own customers’ data; NakliyeHub is the DATA PROCESSOR that stores and processes this data on the company’s instructions.

The separation is also enforced technically: every company’s data is isolated at the database level with row-level security (RLS), and one company’s session can never read another company’s rows in any query.

NakliyeHub is a controller only in respect of its own customers — the company representatives who hold accounts (owner, team members).

Personal data processed

• Account data: name, e-mail, phone, company name, subdomain, role.
• Usage data: session records, IP address, browser information, audit logs.
• Customer data entered by the company: name, phone, address, shipment details, proof of delivery (signature, photos). The company is the controller for this data.
• Billing data: plan, period, payment notifications and receipt images.

Purposes and legal grounds

• Performance of a contract (Art. 5/2-c): account creation, service delivery, billing.
• Legal obligation (Art. 5/2-ç): record keeping under tax legislation, requests from competent authorities.
• Legitimate interest (Art. 5/2-f): security logs, abuse prevention, service quality measurement.
• Explicit consent (Art. 5/1): obtained only for commercial electronic messages and withdrawable at any time.

Transfers and cross-border processing

Data is shared with a limited set of sub-processors necessary to deliver the service: the hosting provider, file storage (Cloudflare R2 — EU region), the e-mail relay, and — where the company enables them — WhatsApp and voice assistant providers.

Where a cross-border transfer is required, appropriate safeguards (standard contractual clauses) are applied under Art. 9 of the KVKK and the transfer is stated explicitly in this notice.

Retention periods

• Account and billing data: for the period required by tax legislation after the account is closed.
• Audit logs: 12 months.
• Customer data entered by the company: for the period the company determines; an export is offered when the account closes.
• Payment notification images: 24 months after the relevant period closes.

Your rights

Under Art. 11 of the KVKK you may learn whether your data is processed, request information, request correction or deletion, learn the third parties to whom data was transferred, object to results produced solely by automated analysis, and demand compensation for damages.

If your request concerns data collected by a moving company about its own customers, please address it to that company first; NakliyeHub acts on the company’s instructions as a processor and will forward your request to it.

How to apply

You may submit your request in writing to the contact address on this site. Requests are answered within 30 days at the latest.

Security measures

• Company data is isolated at database level with row-level security (FORCE RLS).
• Session cookies are bound to a single surface (host-only) and cannot be read by JavaScript.
• Customer-facing pages (storefront, quote, tracking) write no cookies at all.
• Super-admin access requires two-factor authentication and every action is written to the audit log.
• Backups are archived continuously and restore drills are performed regularly.