İZTO Mobile App Privacy Policy
This policy explains how the İzmir Chamber of Commerce mobile app (the "App", iOS and Android) processes personal data under the Turkish Personal Data Protection Law No. 6698 ("KVKK"). The Turkish version prevails. For the Chamber's general notice, see izto.org.tr KVKK.
1. Data controller
İzmir Ticaret Odası (İzmir Chamber of Commerce, "İZTO"), Atatürk Caddesi No: 190, 35220 Alsancak / İzmir, Türkiye
E-mail: info@izto.org.tr · Registered e-mail (KEP): izmirticaretodasi@hs01.kep.tr · Phone: +90 232 444 92 92
2. Personal data we process
- Identity: Turkish ID number (e-Devlet sign-in), passport number and nationality (passport sign-in), first and last name. Your identity is verified by the e-Government Gateway (e-Devlet) or by the Chamber's passport verification; your e-Devlet password never reaches the App or İZTO.
- Membership and company: Chamber registry number, company title, trade registry details, tax office and number, professional group and NACE code, Chamber duties. These are read from the Chamber's member records.
- Contact: Mobile phone number (SMS verification and appointments; your number is kept only while it is being verified and is not stored in your guest account), e-mail address (passport verification code, payment receipt, appointments), and the company address entered in an appointment application.
- Transactions: Appointment applications and tracking numbers, membership dues and payments, authorised person records, the digital membership card.
- Payment: Card number, expiry date, security code and cardholder name are passed to the bank's virtual POS for the payment only and are not stored on the App's servers. Payments are completed on the bank's 3D Secure page.
- Linked account: If you link an Apple or Google account to your membership, only the account's unique identifier is stored; your name and e-mail address are not collected.
- Device and session: A device identifier generated by the App, the push notification token, the platform (iOS/Android) and session records.
- Preferences: Notification and language preferences, and your consent to the AI notice.
- Assistant content: Messages you type and voice questions you record in the Online Services assistant (see section 5).
The App does not access your location, contacts or photo library, shows no ads, does not track you across other apps or websites and uses no analytics tools.
3. Device permissions
- Camera: Opens only when you tap "Kartı tara" on the dues payment screen. The card number is read on your device; no image is saved or sent.
- Microphone: Used only when you ask the assistant a question by voice.
- Notifications: Optional; can be turned off in the App's notification preferences or in your phone settings.
- Calendar: "Takvime Ekle" only adds a new event; your calendar is never read.
- Motion: Used to turn the digital card as you tilt the phone. This data is processed only on your phone and is never sent anywhere.
4. Purposes and legal grounds
We process personal data to verify your identity and sign you in, show your membership and company records, carry out appointment, dues, document and e-service transactions, issue and verify the digital membership card, notify you of public tenders that match your company, work out with the assistant which service you need, keep the service secure and meet our legal obligations.
The legal grounds are those listed in Article 5(2) of KVKK: processing expressly provided for by law (Law No. 5174, the Turkish Commercial Code No. 6102 and related legislation), the establishment or performance of a contract, compliance with a legal obligation, and our legitimate interests provided that your fundamental rights are not harmed. Use of the assistant, and the related transfer abroad, is based on the explicit consent you give in the App.
5. AI assistant
To understand your message or voice question and write a reply, the Online Services assistant uses an AI service running on Google Cloud. Before first use, the assistant shows a notice and asks for your consent; if you do not agree, the assistant stays closed and other services are not affected.
- Only the message you type or your voice recording is sent; your name, ID number and company details are not added to the request.
- Messages and recordings are processed only to produce the reply and are not stored or logged on our servers. Google does not use this content to train models.
- Please do not include personal details such as ID or card numbers in your messages.
- The assistant is available to members only.
6. Recipients
- Public authorities: Authorities entitled by law; for identity verification, the e-Government Gateway (Presidency of the Republic of Türkiye, Cyber Security Directorate) and the systems of the Union of Chambers and Commodity Exchanges of Türkiye (TOBB).
- Banks: To collect dues and fee payments.
- Storage location: The App's server and database run on the Chamber's own servers in Türkiye. The App's records (sessions, guest accounts, linked accounts, preferences, notifications and device registrations) are kept only there; they are not saved to any cloud service, in Türkiye or abroad. To recognise you, these records contain your Turkish ID or passport number and your name; your phone number is not stored. Your membership, dues, appointment and registry records stay in the Chamber's own systems.
- Service providers abroad: Your personal data is transferred abroad in the following three cases:
- Notifications are delivered to your phone through Google Firebase Cloud Messaging (and, on iPhones, Apple's notification service). Only your device's notification token, the notification's title and text, and which screen to open when you tap it (for example a tender number) are sent; your ID number and name are not.
- When you use the assistant, the message you type or your voice recording is sent to Google Cloud's AI service to produce the reply (see section 5).
- Sign in with Apple or Google is verified through Google Firebase; the temporary Firebase user record is deleted as soon as sign-in completes.
Transfers abroad are made in accordance with Article 9 of KVKK.
7. Retention
- Session records: Expire 30 days after last use and are then deleted automatically.
- Verification records (SMS and e-mail codes, the phone number entered for verification, sign-in attempts): Deleted automatically after their validity (at most 30 minutes) ends.
- In-app notifications: 60 days.
- Assistant messages and voice recordings: Not stored.
- Card details: Not stored.
- Guest account, linked account, preferences and device registration: Until you delete them or close your account.
- App user record of a member who deleted their account (ID number, full name, deletion date): Marked as deleted and kept to show that the account was deleted and to prevent notifications from being sent to it. If the member signs in again, the account is reopened.
- Membership, dues, appointment and registry records: In the Chamber's systems for the period required by law.
8. Your rights and deleting your data
Under Article 11 of KVKK you may ask whether your personal data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties it is transferred to, request correction of incomplete or inaccurate data, request deletion or destruction when the grounds for processing no longer exist, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.
- In the App: You can delete your account from the menu with "Hesabımı sil" (delete my account, members) or "Misafir kaydımı sil" (delete my guest account, guests): linked accounts, preferences, notifications, device registrations and sessions are deleted and you are signed out on all devices. A guest record is deleted entirely; a member's record is marked as described in section 7. Details: Account deletion. An Apple or Google link can be removed under "Hesap Bağlama", and notifications can be turned off under "Bildirim Tercihleri". Signing out removes the session and the AI consent from the device.
- By request: For any other request, write to info@izto.org.tr, to our registered e-mail address, or to Atatürk Caddesi No: 190, 35220 Alsancak / İzmir. Requests are answered free of charge within 30 days at the latest.
Chamber membership records are kept by the Chamber under Law No. 5174; the App does not create or delete them. Deleting your app account does not affect them.
9. Children
The App is intended for Chamber members, company representatives and people founding a business; it is not designed for anyone under 18.
10. Changes
When this policy is updated, the new version is published on this page with a new effective date. If a matter that depends on your consent changes, the App will ask for your consent again.