Privacy Policy & Notice - Pass

Data Controller: Cengel ID ("Platform", "We")

At Cengel ID, we respect your privacy. This Privacy Policy explains how we collect, use, and protect your personal data when you create a Cengel ID account and use our services.

This policy has been prepared in compliance with the Law on the Protection of Personal Data No. 6698 (KVKK - Turkey) and the General Data Protection Regulation (GDPR - European Union) standards.

1. Data We Collect

We collect the following categories of data to provide our services:

A. Information You Provide to Us

Account Information: Name, E-mail address, Username, and Password (stored in encrypted form) required for registration.
Profile Information (Optional): Date of birth, location information, biography (about text), website, social media links, language, and time zone preferences.

B. Information Collected Automatically

Session and Device Data: For security purposes, we collect IP address, browser type, operating system, device information, and login/logout timestamps.
Cookies: Technical cookies required for the operation of our site and functional cookies that remember your preferences. (Please refer to our Cookie Policy for details).

2. Purposes of Processing and Legal Bases

We process your data for the purposes listed below, based on the specified legal grounds (KVKK Art. 5 and GDPR Art. 6):

Purpose	Legal Basis
Service Provision: Account creation, identity verification, centralized session management (SSO).	Performance of a Contract (Essential to provide the service to you).
Security: Detecting suspicious logins, session monitoring, preventing cyber attacks.	Legitimate Interest (To ensure the security of the Platform and your account).
Legal Compliance: Keeping traffic logs, crime prevention.	Legal Obligation (Compliance with relevant country laws).
Personalization: Birthday messages, language/region settings.	Explicit Consent (Managed via your profile settings).

3. Data Sharing and Transfer

Your personal data is not sold or shared with third parties for marketing purposes. Data sharing occurs only under the following circumstances:

Connected Applications (SSO): When you wish to log in to a 3rd party application using your Cengel ID account, the data you approve on the "Permission Screen" (e.g., Name and E-mail only) is transferred to that application.
Service Providers: Your data is stored on secure cloud infrastructure providers located in Frankfurt, Germany (Contabo).
Legal Requests: Data may be shared with authorized authorities within the scope of court orders or valid legal processes.

4. Data Retention and Deletion

Retention Period: We retain your data as long as your account is active.
Account Deletion: You can permanently delete your account from your user panel. When you delete your account, your data is immediately removed from live systems.
Backup Policy: To ensure data integrity and for disaster recovery scenarios, deleted data continues to be stored in our encrypted backups for 30 days. At the end of the 30th day, it is automatically deleted from backups as well.

5. Your Global Rights (KVKK & GDPR)

Regardless of where you live, Cengel ID grants the following rights to all its users:

Right of Access: Request a copy of your data.
Right to Rectification: Update incorrect or incomplete information.
Right to Erasure (Right to be Forgotten): Request deletion of your account and data.
Data Portability (Export): Download all account data in a machine-readable format (JSON, etc.).
Right to Object: Object to our data processing activities.

To exercise these rights, you can contact us at [[email protected]].

6. Children's Privacy

Our platform is not designed for children under the age of 16 (or the digital age of consent in your local jurisdiction). We do not knowingly collect data from children. If you are a parent and believe your child has provided us with data, please contact us.

7. Changes

We may update this policy from time to time. We will notify you via email or through the platform when significant changes occur.