Privacy Policy

1. Scope

The policy applies in two places: the website (home page, the Turkish and English pages, the legal pages) and the application (Red Şantiye as you use it after logging in, served under /app).

2. Controller and contact

Controller for the website and for account administration: Red Şantiye. Its trade name, registry number and address will be published on this page once the company is formally set up.

For any question about these pages or about your personal data, use the "Request a demo" form on the home page; your message goes straight to the platform administrator.

For data about a customer company's own employees, subcontractor staff and other users, that company is the controller; Red Şantiye acts as the processor on the company's behalf and uses the data only on its instructions and to provide the service.

3. Data processed on the website

• While browsing: the site has no cookies, advertising, tracking or third-party analytics. Fonts and images are served from our own server.
• Demo request form: if you fill it in, your name, company, phone number, role, number of sites and note reach us. They are used only to contact you and plan the demo. Filling in the form is optional.
• Server logs: like any web server, the time of the request, the IP address and browser information are kept briefly (30 days) for security and operations.

4. Data processed in the application

• Account details: first and last name, username, e-mail and/or phone number, role, and an irreversible hash of your password (your password is never stored in plain text).
• Work records: sites, work progress, defects, daily reports, subcontractors, payments, purchasing, safety and similar records; photos and files attached to them; the user who made the entry and when.
• Security records: sign-in attempts, the history of changes (who changed what and when) and technical request logs.

5. What we use the data for

• Opening and managing your account and providing the service (performance of the contract).
• Keeping the service secure, preventing abuse and finding faults (legitimate interest).
• Meeting legal obligations.
• Answering your demo request (at your request).

6. Sharing

We do not sell your personal data and do not share it for advertising. It is shared only with the infrastructure providers needed to run the service, and with authorities where the law requires it:

• Hosting: our servers are in a cloud data centre in Germany (Frankfurt), operated by Amazon Web Services.
• Network and security: a content-delivery and security service (Cloudflare) may sit in front of the domain, and traffic passes through it.
• Other users of the same company: who sees a record in the application is set by the company's administrator and by role permissions.

7. Transfer abroad

Because the servers are outside Türkiye (in Germany), the data you enter in the application is hosted abroad. This transfer is necessary to provide the service and is carried out in line with the relevant provisions of Law No. 6698 on the Protection of Personal Data (KVKK). Details are in the KVKK Notice.

8. Security

• Data in transit is encrypted (HTTPS). Passwords are stored only as hashes; two-step verification can be switched on.
• Each company's data is isolated from the others at database level; one company cannot see another's records.
• Permissions are checked on the server by role; field roles see only the sites they are members of.
• The history of changes is kept with before-and-after values; approval records are kept in a chain that cannot be altered.
• The database is backed up every day, and backups are kept in daily, weekly and monthly generations.

9. Retention

Account and project data is kept for the duration of the service agreement and for as long as legal retention obligations require, then deleted or anonymised. Server logs are kept for 30 days and session-renewal keys for at most 14 days. Demo requests are kept until the conversation concludes and a reasonable time after. Detailed periods are in the KVKK Notice.

10. Your rights

Under Article 11 of Law No. 6698 you may learn whether your data is processed, request information, ask for correction, deletion or destruction, learn to whom it has been transferred, object, and claim compensation for damage. Send your request through the contact route above; after verifying your identity we reply within 30 days at the latest.

11. Children

The service is for construction sites and companies and is not aimed at anyone under 18.

12. Changes

When this policy changes, the new version is published on this page and the "Last updated" date at the top changes.