Hedefik Mobile App Privacy Policy

Your employer generally determines the purposes of processing employee, payroll, leave, attendance and internal approval records and acts as the data controller for those activities. PIXSELECT acts as a processor to the extent it handles these records on your employer’s behalf and instructions.

PIXSELECT may act as a controller for activities whose purposes and means it independently determines, such as its own support services, service security and legal obligations. Roles depend on the activity and contractual arrangements. Contact your employer’s HR or privacy contact for its identity and detailed employee privacy notice. This policy does not replace your employer’s processing-specific employee notice.

Not every category is collected from every user. The information depends on the feature you use and the records maintained by your employer.

Data is obtained electronically from you, authorized employer users and systems, your device, operating system events and the service infrastructure. Passwords or one-time verification codes are used for authentication and verification. Do not include them in support messages.

Hedefik processes device location during applicable monitoring periods to detect automatic entry into and exit from your employer’s designated workplace areas and support shift/attendance records, including when the app is closed or not in use. This feature requires enabled location services and the necessary foreground/background permissions. Operating system restrictions, force-closing the app and other device limitations may affect event detection.

The feature uses workplace areas and monitoring start/end times configured by your employer. Monitoring may be enabled before a manual check-in to detect automatic arrival. Location use is therefore not limited to the interval between manual check-in and check-out.

In the current geofencing flow, the operating system compares device location with the workplace boundary. A continuous stream of GPS coordinates or a movement route is not transmitted to the server. The transmitted event includes the area and monitoring session identifiers, entry/exit type, timestamps, event identifier and platform information. These events can be linked to you and reveal your presence at a particular workplace.

Events may be queued on the device while offline and delivered when connectivity returns. Events outside a valid monitoring period are not processed for attendance. Monitoring is limited to the areas and periods enabled by the employer and is not used to continuously track routes in your private life.

You may change or revoke location permissions in device settings. Automatic entry/exit detection may then stop working; contact your employer about an alternative attendance method. The sign-out flow closes the device’s monitoring session. Previously recorded events remain subject to retention and deletion rules.

• Camera: Used when you choose to photograph an expense receipt or invoice.
• Photo selection: Images you select are used as expense attachments; your entire photo library is not uploaded. The current document capture flow does not automatically save the photo to your gallery.
• Location: Used for workplace entry/exit detection as described above.
• Notifications: Used to deliver updates about leave, advances, expenses and related workplace activities. Refusing this permission does not prevent access to notifications inside the app.

Permissions can be managed in device settings. Refusal may limit the corresponding feature. Images may contain information about other people or retained metadata such as dates or location; upload only what the process requires. If a health report or other sensitive data is required, your employer must provide the appropriate legal basis and separate notice. Avoid unnecessary sensitive information.

The employee directory is built from company records, rather than bulk collection of your phone’s contacts. The current mobile features do not use microphone recording or advertising-related tracking across apps.

Data is processed to authenticate your corporate account, enforce access permissions, manage employee and request workflows, display attendance and financial records, send notifications, provide support and protect service security.

For processing in Türkiye, applicable grounds under Article 5 of Law No. 6698 on the Protection of Personal Data (“KVKK”) include contractual necessity, legal obligations or express statutory provisions, establishing/exercising/protecting rights, and legitimate interests that do not override your fundamental rights. Where another appropriate ground is unavailable, separate explicit consent is obtained for the relevant activity. Where special-category data is involved, the applicable Article 6 condition and additional safeguards apply.

Your employer’s notice identifies the basis for the specific employee activity. Employment legislation does not automatically require location collection from every employee. The necessity and proportionality of location processing must be assessed for the particular workplace and feature.

Hedefik does not use personal data for sale or targeted advertising. The current mobile version does not integrate an advertising SDK, Google Analytics or Firebase Crashlytics. New purposes will be reflected in this policy and any required notices.

Data may be disclosed to the following recipients to the extent necessary for the relevant purpose:

Personnel records are not made available to other companies outside your employer’s directory or approval authorization. Using a technical SDK does not mean that all personnel, payroll or expense records are sent to its provider.

The notification SDK may process technical installation information needed for its operation independently of operating system notification permission. Identifiers used by Firebase and its deletion processes are described in Firebase’s privacy information.

Main service and database hosting provider and region: Microsoft Azure — servers in European regions.
Update server and backups: Hosted on Microsoft Azure servers in European regions.

Data is retained only for the necessary purpose and the applicable statutory period. The following schedule does not prescribe a single period for all information:

Statutory periods apply to qualifying documents, not as a general justification for keeping all location events or device information for ten years. Data is deleted, destroyed or anonymized once its period expires and no other valid processing ground remains.

A documented dispute or legal retention requirement may justify longer retention of only the necessary records, for the necessary time, with restricted access. Merely awaiting a general employer approval does not justify indefinite retention.

Google states that Firebase installation IDs can take up to 180 days to be removed from live and backup systems after the deletion API call. Deleting a push token does not perform this operation. Firebase’s data processing information.

Signing out, uninstalling the app or disabling account access does not delete all personal data held on servers. Closing access and deleting data are separate actions.

You can submit an account or data deletion request to your employer’s HR/privacy contact or solution.center@pixselect.com.tr. Using the subject “Hedefik — account/data deletion request” and providing your registered email and employer helps route the request. Only information necessary to verify your identity is requested.

PIXSELECT assesses requests for data for which it is controller in accordance with applicable law. For employer-controlled records, it assists in directing the request to the relevant employer. You will be informed about deletable data, records that must be retained, the reasons and the processing timeline. KVKK requests are normally answered within 30 days; this response deadline is not a promise to delete every record unconditionally within 30 days.

Access authorization, secure session management and encrypted communications with production services are among the safeguards used. The mobile app keeps short-lived access tokens in memory and refresh tokens in protected iOS/Android storage. Installation association information and some technical records may be held in local device storage.

The mobile app is not designed around advertising cookies; it uses functional local storage. Clearing device data or uninstalling the app does not delete employer records on servers. No information system provides absolute security. Protect your account and device, do not share passwords, and report suspicious access.

Under Article 11 of the KVKK, you may request information about processing, its purposes and recipients; correction of inaccurate information; deletion/destruction and notification of recipients where the conditions apply; object to adverse results arising solely from automated analysis; and seek compensation for damage caused by unlawful processing. Rights under other applicable laws remain available. See the Turkish authority’s information on individual rights.

Submit requests to the relevant controller using legally recognized methods. For PIXSELECT, you can contact the address above from your registered email or send a written request to its registered address. Requests meeting the legal requirements are answered within 30 days. You may complain to the Turkish Personal Data Protection Board where the applicable conditions are met.

Hedefik is intended for corporate employee users and is not a service directed at children. If unnecessary or mistakenly submitted children’s data is identified, appropriate correction/deletion steps are taken with the relevant controller.

Services opened through external links may have their own privacy policies. Hedefik’s obligations concerning the purposes of any disclosures to those services continue to apply.

When this policy changes, the updated text and revision date will be published. Material changes in data use will also be communicated through the app or another appropriate channel, with separate consent obtained before processing where required.

Questions: PIXSELECT TEKNOLOJİ A.Ş. — solution.center@pixselect.com.tr.