1. Identity of the data controller
This notice is issued by Selman Gürbüzer under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation. The Turkish text is the binding version; this English version is provided for convenience. Vicis is run by an individual rather than a company, so there is no trade name or MERSIS number to publish.
| Field | Detail |
|---|---|
| Data controller | Selman Gürbüzer |
| Capacity | Individual acting as data controller |
| Based in | Şanlıurfa, Türkiye |
| Phone | +90 505 020 43 23 |
| hello@vicis.app | |
| Website | vicis.app |
2. Controller and processor roles
Vicis acts in different capacities across different layers of the service, and the distinction determines which obligations fall on which party.
- For data relating to the manager (customer) account, Vicis is the data controller.
- For staff data the manager enters into the roster, the workplace is the data controller and Vicis is the data processor. Vicis processes that data only on the workplace's instructions and only as far as the service requires.
- Staff members should direct requests about their own data to their employer first. If a request reaches us, we route it to the relevant workplace.
3. Categories of personal data processed
| Category | Data |
|---|---|
| Identity | Full name; the title shown on the roster |
| Contact | Email address |
| Customer transaction | Subscription status, plan, subscription id, billing region |
| Transaction security | Session information, authentication records, IP address, access and error logs |
| Personnel / working information | Group, active-inactive status, daily shift assignment, weekly total working hours |
Special categories of personal data under Article 6 of the Law (health, religion, union membership, and so on) are not intended to be entered into the application and are not recommended. If such data is entered into free-text fields, responsibility rests with the workplace that entered it.
4. Purposes of processing
- Creating, saving, and publishing the weekly shift roster,
- Generating share links so staff can see their own working schedule,
- Running membership operations and securing accounts,
- Measuring the free plan limit and operating subscription and billing processes,
- Running information security processes and resolving faults,
- Providing information to authorised persons, institutions, and organisations as required by law.
5. Legal grounds
Your personal data is processed on the following grounds set out in Article 5 of the Law:
| Legal ground | Where it applies |
|---|---|
| Necessary for the conclusion or performance of a contract (Art. 5/2-c) | Opening the account, delivering the roster, subscription and payment processes |
| Compliance with a legal obligation (Art. 5/2-ç) | Retaining invoice and accounting records, responding to requests from authorities |
| Legitimate interests (Art. 5/2-f) | Information security, prevention of abuse, continuity of the service |
| Explicit consent (Art. 5/1) | Transfers and processing that are not required and not covered by a ground above |
6. Method of collection
Personal data is collected electronically, by wholly or partly automated means, through the application's web interface, the authentication provider, and the payment provider. Staff data is obtained not from the data subject directly but by an authorised person at their workplace entering it into the application.
7. Transfer of personal data
Personal data may be transferred, in line with the conditions in Articles 8 and 9 of the Law, to the hosting, database, authentication, and payment providers used to deliver the service, and on request to authorised public institutions and organisations.
| Recipient group | Purpose of transfer |
|---|---|
| Authentication provider (Clerk) | Membership and session management |
| Payment provider (Dodo Payments) | Operating subscription and payment processes |
| Database provider (Turso / libSQL) | Storing roster and publication data |
| Hosting provider (Vercel) | Serving and securing the application |
| Authorised public institutions | Meeting statutory requests for information and documents |
These providers may operate infrastructure outside Türkiye. Cross-border transfers are carried out under Article 9 of the Law, relying on appropriate safeguards such as standard contracts or undertakings where these are in place, and otherwise on your explicit consent.
8. Retention and disposal
Personal data is retained for as long as the purpose of processing requires and for the limitation periods set by applicable law. Once the purpose no longer applies, data is deleted, destroyed, or anonymised.
| Data | Retention period |
|---|---|
| Account and membership data | While the account is active; disposed of within a reasonable period after closure |
| Roster and staff data | Until the workplace deletes it or closes the account |
| Published snapshot | Until unpublished, at which point it is deleted |
| Invoice and subscription records | 10 years under tax and commercial law |
| Access and error logs | The short period needed for security review |
9. Data subject rights (Article 11)
Under Article 11 of the Law you may apply to the data controller to exercise the following rights:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether the data is used in line with that purpose,
- Know the third parties to whom the data is transferred, at home or abroad,
- Request rectification if the data is incomplete or inaccurate,
- Request erasure or destruction under the conditions in Article 7 of the Law,
- Request that rectification, erasure, and destruction be notified to third parties the data was transferred to,
- Object to a result against you produced by analysis solely through automated systems,
- Claim compensation for damage suffered because of unlawful processing.
10. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests by:
- Writing to hello@vicis.app from the email address registered in our system,
- Sending an email signed with a secure electronic signature or mobile signature,
- Requesting the postal address from hello@vicis.app first, if you would rather send a wet-signed petition by post.
Your application should include your full name, a signature for written applications, your Turkish national id number (or nationality and passport number for foreign nationals), an address for service, your email and phone if available, and the subject of your request. Applications are concluded free of charge within thirty days at the latest; where the process carries a separate cost, the fee in the tariff set by the Board may be charged.
If your application is rejected, you find the response insufficient, or no response arrives in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of the application date.
11. Note for workplaces
A workplace using Vicis to plan staff rosters is the data controller for the staff data it enters. Informing its employees, relying on an appropriate legal ground, keeping a retention and disposal policy, and registering with VERBIS where the conditions apply are the workplace's obligations. Vicis processes this data only on the workplace's instructions and only as far as the service requires.
12. Updates
This notice may be updated as legislation or the service changes. The current version is published on this page and the publication date is updated.