KVKK Privacy Notice

Within the scope of this notice, your personal data is processed by CNUTLABS in its capacity as data controller. You may contact us at info@cnutlabs.com.

The business using the Point PDKS service is the data controller for its own employees' personal data, while CNUTLABS acts as the data processor handling that data on the business's behalf.

The following categories of personal data are processed in the course of providing the service:

• Identity data: first name, last name, employee/registration number.
• Contact data: email address, phone number.
• Location data: a momentary location point recorded only at the moment of clock-in/out, solely to verify whether you are within the relevant location's geofence. No continuous location tracking is performed.
• Activity/attendance data: clock-in/out times, lateness, early leave, overtime, leave and shift records.
• Device data: device identifier (for single-device locking), IP address and browser/app information.
• Fake-location attempt records: coordinates, reason, IP and app information, recorded for fraud detection.

Biometric data such as fingerprints or faces is not processed. Point PDKS deliberately operates biometric-free.

• Creating and verifying employee attendance (clock-in/out) records.
• Operating shift, leave and overtime processes.
• Ensuring record reliability through location verification and fake-location detection.
• Maintaining service security, keeping audit logs and preventing misuse.
• Fulfilling legal obligations and responding to requests.

Your personal data is processed on the legal grounds that processing is directly related to the conclusion or performance of a contract, that it is necessary for compliance with the data controller's legal obligations, and that it is necessary for the legitimate interests of the data controller provided that this does not harm your fundamental rights and freedoms.

Your personal data may be shared, only to the extent necessary to provide the service and under contractual confidentiality obligations, with the following parties:

• Hosting infrastructure provider (Vercel) — to publish the website.
• SMS verification provider (NetGSM) — solely to send one-time codes for password reset.

Except where legally required, data is not shared with third parties for marketing purposes and is never sold.

Your personal data is retained for as long as the purpose of processing requires, subject to the statutory limitation periods set out in the relevant legislation. Upon termination of your service subscription, data outside the scope of legal retention obligations is deleted or anonymized within a reasonable time.

The business may request the export or deletion of its data at any time.

Under Article 11 of the KVKK, as a data subject you have the right to:

• Learn whether your personal data is being processed.
• Request information if it has been processed.
• Learn the purpose of processing and whether it is used in line with that purpose.
• Know the third parties to whom it is transferred domestically.
• Request correction if it is incomplete or processed inaccurately.
• Request its erasure or destruction where the relevant conditions are met.
• Object to a result against you arising from the analysis of your data exclusively through automated systems.
• Request compensation if you suffer damage due to unlawful processing.

You may submit requests regarding the rights listed above to info@cnutlabs.com. Depending on the nature of the request, your application is concluded free of charge within thirty days at the latest; where the process incurs an additional cost, a fee may be charged in accordance with the tariff set in the legislation.

Your application must clearly include information verifying your identity and the nature of your request.