Develi Gross — Privacy Policy

This is the English translation of the Turkish privacy notice (gizlilik-politikasi.md), prepared under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"). In case of any discrepancy, the Turkish version prevails.

#0. Who is this app for?

Develi Gross is not a consumer shopping app. It is an internal business application used by Develi Gross employees and its business partners (supplier company representatives, field sales reps, etc.) to carry out company work processes.

• Accounts cannot be created inside the app. Accounts are created only by a company administrator when an employment or business relationship begins.
• A person who downloads the app but has no relationship with Develi Gross cannot sign in, and no personal data about them is processed — apart from the security record described under "Sign-in attempt logs" below.
• The app is a shell that displays the company's live business panel (https://api.develigrossapps.com). Which screens a user can see depends on the permissions the company has assigned to that user. Develi Gross Saha Satış is a native app used only by the field sales representatives the company has assigned to it; it gets its data from the same server (see 2.10).

#1. Data controller

#2. What we collect and why

The table below reflects the actual fields in the source code. Modules you do not have access to do not process data about you.

2.1. Identity and account data

Important: In Develi Gross Çalışan you sign in with your mobile number, and in Develi Gross Supplier with your username. The national ID number is not requested at sign-in, is not written to the sign-in logs and is not stored on your phone.

2.2. Sign-in, session and security data

Sign-in attempt logs are automatically deleted after 30 days (server setting RETENTION_GUN, default 30).

2.2.1. Phone sign-in and recognised device (Develi Gross Çalışan and Develi Gross Saha Satış apps)

The Develi Gross Çalışan and Develi Gross Saha Satış apps never show a list of users. Only field sales representatives assigned by the company can sign in to Saha Satış; no Saha sign-in code is sent to a number that is not assigned. You sign in as follows:

• Phone + one-time code: you enter your mobile number. If it belongs to an employee in the company's personnel records, a 6-digit code is sent only to that registered number via WhatsApp, or by SMS (NetGSM) if WhatsApp is unavailable. The code is valid for 3 minutes and can be used once. The screen shows the same answer whether or not the number is registered.
• Phone + password: you can also sign in with your number and the password issued by the company.
• Manager accounts: on a new device both the password and a code sent to the registered number are required.
• Recognised device: after a successful sign-in the server gives your device a random device key. The key itself stays on your device; the server keeps only its irreversible hash (SHA-256), issue date, last use, device name/platform, and your own name with a masked number. On later launches the screen shows only your name and masked number and asks for your password. "Sign in with another account" deletes the key from the device and revokes it on the server; "sign out of all devices" revokes it too.
• Records: for every code request we store only a masked form and an irreversible keyed hash (HMAC) of the number, the IP address, delivery channel and attempt count; the code itself is never stored (only its hash, for 3 minutes). These records limit abuse (SMS flooding, code guessing) and are deleted after 30 days.
• When employment ends: access is closed. On a recognised device the app shows a "you are no longer Develi Gross staff" screen and clears business data from the device; unsent work records are kept for delivery to headquarters. If you are re-employed, access reopens automatically. This message is shown only to an authenticated person (valid session, device key, correct code or password).

2.2.2. Biometric sign-in — Face ID / Touch ID / fingerprint (Develi Gross Çalışan, Develi Gross Saha Satış and Develi Gross Supplier)

After your first password sign-in the app asks whether you want to sign in on this device with Face ID, Touch ID or Android fingerprint / face unlock. This is optional; if you do not turn it on you keep signing in with your password, and you can turn it off at any time.

• Your biometric data never leaves your device. Face or fingerprint matching is performed by your phone's operating system. The app and our servers never see, receive or store your face image, fingerprint or any template of them; the app only receives a "verified / not verified" result.
• When you turn biometric sign-in on, a random biometric sign-in key is generated. The key itself is kept only in your phone's secure store (iOS Keychain / Android Keystore) and can only be unlocked by biometric verification; it becomes invalid if a new face or fingerprint is enrolled on the device.
• Next to your recognised-device record the server keeps only an irreversible hash (SHA-256) of that key, the time biometric sign-in was turned on, the number of consecutive failed attempts (after 5 failures biometric sign-in is switched off on that device) and the time of your last password sign-in on that device. Manager and supplier accounts must re-enter the password every 30 days.
• The server-side hash is deleted when you turn biometric sign-in off, choose "sign in with another account", when the device key is revoked, or when your employment (or supplier account) is closed.

2.3. Device and notification data

Notification permission is optional. If you decline it, no push token is generated and nothing is sent to the server. On Android, notifications are delivered via Google Firebase Cloud Messaging (FCM). Firebase is used only to deliver notifications; Firebase Analytics, Crashlytics and advertising services are not used.

2.4. Location data

Location in Develi Gross Saha Satış (details in 2.10): when you start and finish a customer visit, your current location is sent to the server and stored with your visit record (your manager can see it); a customer's business location is saved with "Konumu Gir" (Set location) or on the first visit; while a visit is open and the app is in the foreground, your location is checked on the device only every 45 seconds, and when you move about 150 m away from the customer the visit is closed automatically and that location is sent as the visit's end location.

Location rules:

• In Develi Gross Çalışan, before location is read for the first time, an in-app notice explaining these purposes is shown; your phone then shows its own location permission prompt. If you choose "Vazgeç" (Cancel) in the notice, your location is not read. Develi Gross Saha Satış likewise shows its own notice explaining its purposes before reading location for the first time.
• Location is read only at the moment you perform an action or open the related screen (exceptions: while the delivery-route screen stays open, about every 5 minutes; in Saha Satış, while a visit is open and the app is in the foreground, every 45 seconds, on the device only). Location sent for branch detection is not stored in the database; location is stored only in attendance stamps, end-of-day entries, label confirmations, delivery routes and field-sales visit records.
• Location is not collected in the background and there is no continuous tracking. Your location is not monitored while the app is closed or in the background.
• If you decline location permission, the rest of the app keeps working; location-verified attendance stamping is unavailable (a branch QR code can be used instead) and the branch is selected manually on screens.
• This data is never shared with third parties or sold, and never used for advertising, profiling or marketing.

2.5. Camera and microphone

2.6. HR data (only for employees using HR modules)

Through the HR modules the company, acting as employer, may process: attendance records, timesheets and shift plans, leave requests and balances, assigned equipment, announcement read receipts, survey answers, suggestions/complaints, performance evaluations and disciplinary records, and personnel file documents.

Special categories of personal data: Personnel documents may include health reports, disability reports or criminal record certificates. These are special categories under Article 6 of KVKK and are processed only to meet obligations arising from employment, occupational health and safety, and social security legislation, by a limited set of authorised staff. Every download and deletion is separately logged (who, when, from which IP).

Payroll and pay data: Payslip/salary information, advance and bonus payments, wage garnishments (enforcement deductions) and OKS/BES (private pension) deductions are processed. Each employee sees only their own payslips and deductions; bulk payroll, garnishment and pension operations are carried out only by authorised HR/accounting staff. This data is processed to perform the employment contract and to meet tax, social security and enforcement obligations; it is never shared with third parties for marketing.

Work files uploaded by authorised users: Authorised users may upload business documents as part of their job: receipt/invoice and bank statement PDFs, fault and end-of-day photos, advertising videos for the checkout customer display, and music files for the in-store radio. These files are business records and are not expected to contain personal data; if they do, they are processed only for the related business purpose by authorised staff.

2.7. Offline data stored on your device

(For the offline copy and offline sign-in of Develi Gross Saha Satış, see 2.10.)

The Develi Gross Çalışan and Develi Gross Supplier apps have no offline sign-in. These two apps keep no password hash, user/staff list or offline business data on the device; only the session token, the recognised-device key, the biometric sign-in key (if you turned it on — see 2.2.2), the push token and your display preferences are stored. The rest of this section applies only to the older Staff / Manager / Terminal apps.

So these older apps can work without internet, some data is kept on your phone:

• In the device secure store (iOS Keychain / Android Keystore): session token (JWT), device ID, your name and user number, assigned branch, theme preference, push token, offline sign-in PIN.
• Offline sign-in password hash: Your password itself is never stored. Only a salted, 2,000-iteration SHA-256 derivation is written to the secure store and used to verify you when there is no internet. The offline window is 30 days; if you do not sign in online for 30 days, offline sign-in closes.
• In a local database (app-local SQLite, protected by the device's own encryption): product catalogue, stock mirror, stock-count tasks assigned to you and the lines you scanned, goods-receipt / branch-request / expiry-date records, a queue of operations waiting to be uploaded, customer list.

When is this deleted?

• When you uninstall the app.
• When your relationship with the company ends: on the next online request the server closes your account; the app first delivers any unsent work records to head office, then deletes your document and personal data from the device and destroys the offline password hash. (Non-personal data such as the product catalogue may remain.)

2.8. Audit trails

When you create, update or delete records in the panel, the acting user's ID and name, the timestamp and — in some modules — the IP address are recorded, to meet legal obligations and to establish or defend legal claims.

2.9. Supplier portal users (Develi Gross Supplier app)

The Supplier app is for representatives of companies that supply products to Develi Gross. Accounts are opened only by Develi Gross when a business relationship is established; accounts cannot be created in the app.

You only see your own company's data (orders placed with your company, sales and stock of your products, and — if enabled — your account statement). Repeated failed sign-in attempts in a short time are temporarily blocked. You can request account closure or deletion via the Account deletion page or at develigross@gmail.com; commercial records (orders, invoices) are retained for the statutory period (10 years under Turkish commercial and tax law).

2.10. Develi Gross Saha Satış (tr.com.develigross.saha) — field sales representatives

Saha Satış is used by the field sales representatives the company has assigned to it, to handle customer visits, orders, collection records and returns. Sign-in works as described in 2.2.1 and 2.2.2 (phone + code/password, recognised device, optional biometrics). A representative sees only the customers assigned to them.

Data about you (the representative)

Data about customers (third parties)

Customer data is processed to perform the commercial relationship with the customer (KVKK Art. 5/2-c) and for the company's legitimate interests (Art. 5/2-f); where the customer is a natural person (e.g. a sole trader) this information is personal data and is protected in the same way. It is never sold or used for advertising.

Offline copy on your device

So it can work without internet, Saha Satış keeps in the app's database on your phone: the product catalogue (prices and stock quantities), the list of customers assigned to you (name, code, balance, credit limit), customer locations, routes, targets and campaigns, cash/bank account names, and visits, orders, collections, returns and photos created on the device that have not yet been uploaded. The copy is refreshed on each online sync; uploaded records leave the queue.

• Offline sign-in is possible only for the person who last signed in on this device, and only with biometric verification; neither your password nor a hash of it is written to the device. Offline sign-in closes 7 days after your last online sign-in.
• When you choose "sign in with another account", pending records are uploaded first (if they cannot be, the action is blocked); then the customer, route, location and catalogue copy is deleted from the device.
• When your working relationship ends and your access is closed, on the first online launch the app delivers any unsent records to head office, then deletes the customer copy, documents and queue from the device; the recognised-device and biometric sign-in keys are deleted too.
• Uninstalling the app deletes all Saha data on the device.

#3. What we do NOT collect

For the avoidance of doubt, the app:

• Does not collect advertising identifiers (IDFA / GAID).
• Contains no advertising, analytics (Google Analytics, Firebase Analytics, Facebook SDK, etc.) or crash-reporting third-party SDKs.
• Does not sell personal data and does not share it for advertising.
• Does not access your contacts, SMS messages, call history or photo library without your action and permission.
• Uses no cookies of its own. Session data is kept in the device secure store and in the in-app web view's local storage; there are no advertising or tracking cookies.
• Does not track users across apps or websites.
• Does not collect biometric data (face images, fingerprints or their templates); Face ID / Touch ID / fingerprint verification happens entirely on your phone (see 2.2.2).
• Does not collect location in the background (see 2.4).

#4. Legal bases (KVKK Art. 5)

(For EU/UK readers: the app is not directed at the EU/UK market and is distributed for use in Türkiye. Where GDPR nevertheless applies, the equivalent bases are Art. 6(1)(b) contract, (c) legal obligation and (f) legitimate interests, with Art. 9(2)(b) for health-related employment documents.)

#5. Retention periods

At the end of the period data is deleted, destroyed or anonymised.

#6. Data transfers

6.1. Within Türkiye

6.2. Outside Türkiye (KVKK Art. 9)

These transfers are made under KVKK Art. 9, relying on the providers' standard contractual terms and appropriate safeguards, and are limited to the minimum data needed for the service to work. Transferred data is never used for advertising or profiling.

#7. Your rights (KVKK Art. 11)

You have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred in Türkiye or abroad; request rectification if it is incomplete or inaccurate; request erasure or destruction within the conditions of Art. 7; request that rectification/erasure be notified to third-party recipients; object to an adverse outcome produced solely by automated analysis; and claim compensation for damage arising from unlawful processing.

Note: Records that must be kept by law (attendance, personnel files, accounting records) cannot be deleted before their statutory retention period expires. In that case your request will be answered in writing with reasons.

#8. How to contact us / make a request

Under the Turkish Communiqué on Application Procedures to the Data Controller, you may apply:

1. In writing, with identity documents: İbrahim Ağa Mah. İnönü Cad. No:1, 38400 Develi/Kayseri
2. Via registered electronic mail (KEP): selahattin.kolsuz@hs01.kep.tr
3. With a qualified electronic signature / mobile signature, or from the e-mail address already registered in our systems: develigross@gmail.com
4. Online: Account & data deletion page

Requests are answered free of charge within 30 days at the latest. If the process incurs a cost, the tariff set by the Turkish Personal Data Protection Board may apply.

#9. Account and data deletion

Accounts cannot be created in this app; they are created by a company administrator. You may nevertheless request deletion of your account and associated data.

Account deletion request page: Account & data deletion

That page explains which data is deleted, which data is retained because of legal obligations, and how long the process takes. Requests are completed within 30 days at the latest.

#10. Security

• All traffic is encrypted with HTTPS/TLS; server access is routed through a Cloudflare tunnel.
• Passwords are stored server-side as irreversible scrypt hashes.
• Saha Satış visit and signature photos are stored under unguessable file names and open only through a time-limited signed link generated for an authorised person.
• In the older Staff / Manager / Terminal apps, session tokens and sensitive values are kept in the iOS Keychain / Android Keystore on the device. In Develi Gross Çalışan and Supplier, the session token and recognised-device key are kept in the in-app web view's local storage (protected by the device's own encryption), while the biometric sign-in key is kept in the Keychain / Keystore and can only be unlocked by biometric verification.
• Accounts lock automatically after repeated failed passwords; sign-in endpoints are rate-limited per IP and per identity.
• Suspicious IP addresses can be blocked; access can optionally be restricted to Türkiye.
• Access rights are role/template based — users see only the screens assigned to them.
• When a working relationship ends, server-side access is cut immediately and device-side data is wiped.

#11. Not directed at children

The app is not directed at persons under 18 and does not knowingly collect personal data from children. It is available only to Develi Gross employees and business partners, whose accounts are created by an administrator.

#12. Changes

This policy may be updated. The current version is always published at /privacy. Material changes are announced in-app. The "Last updated" date at the top indicates the version in force.

#13. Contact