Privacy policy
How Touchque processes personal data as a data controller, under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the GDPR.
1. Who we are
The data controller is Touchque. Contact: privacy@touchque.com.
2. Our two roles
- Controller: for the people who run an organization’s account (owners, administrators), people who contact us about sales or support, and visitors of our pages. This policy covers them.
- Processor: for the employees and customers whose sign-ins our customers protect with Touchque. There the customer is the controller and its own privacy notice applies. We process that data under the Data Processing Agreement.
3. Data, purposes and legal grounds
| Data | Purpose | Legal ground (KVKK art. 5/2; GDPR art. 6(1)) |
|---|---|---|
| Name, work email, phone, company, title | Opening and running the account, contacting you | Contract (c; b) |
| Sign-in records: IP address, browser, device, time, second factor used | Securing the account, preventing fraud, audit trail | Legal obligation (ç; c) and legitimate interest (f; f) |
| Support messages and case records | Answering and improving support | Contract (c; b), legitimate interest (f; f) |
| Company title, tax number, address, invoices | Invoicing and accounting | Legal obligation (ç; c) |
We collect this data electronically: through the dashboard, sign-in pages, the API, email and forms. We do not sell personal data, and we do not use advertising or analytics trackers.
4. Who receives it, and transfers abroad
- Our sub-processors, only for the purposes above.
- Authorized public bodies, when the law requires it; our lawyers and accountants under a duty of confidentiality.
- Our servers are in europe-west3 (Frankfurt, Germany), and push notifications pass through Apple and Google in the United States. These are transfers abroad under KVKK art. 9. We make them under the standard contracts set by the Personal Data Protection Board, which we notify to the Authority as required. For the GDPR, data is hosted in the EU.
5. How long we keep it
- Account data: while the account is open, then deleted within the periods in the terms.
- Sign-in records: IP address, browser and location are removed after 90 days, and the record after 400 days. Administrator actions are kept for 730 days.
- Support messages: 2 years after the case is closed.
- Invoices and accounting records: 10 years, as the Turkish Commercial Code and tax laws require.
At the end of these periods the data is deleted, destroyed or anonymized.
6. Cookies and browser storage
We use only what is strictly necessary: a session cookie that keeps you signed in, protection against cross-site request forgery, and your language choice in the browser’s local storage. These need no consent. There are no advertising, analytics or third-party tracking cookies.
7. Your rights
Under KVKK art. 11 and GDPR arts. 15–22 you may ask:
- whether we process your data, for what purpose, and to whom it was transferred;
- that we correct, delete or restrict it, and that we tell the recipients about it;
- a copy in a portable format (GDPR);
- to object to processing based on legitimate interest, or to a result reached only by automated analysis that is against you;
- compensation if you suffer damage from unlawful processing.
8. How to apply
Write to privacy@touchque.com from the email address registered with us, by registered electronic mail (KEP), or in writing to our address. We answer free of charge within 30 days. You may also complain to the Personal Data Protection Board, or, under the GDPR, to the supervisory authority where you live.
9. Security and changes
How we protect data is described in the Trust center. We announce material changes to this policy by email to organization owners, and on this page.