Createch Yazılım Danışmanlık ve Bilgi Teknolojileri Sanayi ve Ticaret Ltd. Şti.
Referred to in this notice as “Createch”. The Crealog and Tractech brands belong to Createch.
Company · KVKK
Privacy and personal data protection
This is the privacy notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). It explains how your personal data is processed when you visit www.createch.com.tr, use the platform sign-in form on the home page, or contact us by email or phone.
The site uses no visitor analytics, advertising, tracking cookies, newsletter sign-up or contact form. The data processed is limited to running the site, platform sign-in and answering your request.
- KVKK 6698
- No Tracking Cookies
- No Visitor Analytics
- ISO 27001
LAST UPDATED ·
01 DATA CONTROLLER
Who is responsible
Who is responsible
for your data?
Under KVKK, the data controller is Createch, whose details are given below.
Ulamış Mah. 75. Yıl Cumhuriyet Cad. No:19/3 Seferihisar / İzmir, Türkiye
Written requests can be sent to this address; see section 07 for details.
info@createch.com.tr
Phone: +90 850 441 27 32
www.createch.com.tr and the platform sign-in form
Vehicle, location, camera and sensor data processed inside the Crealog platform and its mobile app is outside the scope of this notice; that data is processed under the contract with the organisation using the platform and that organisation's own privacy notice.
02 DATA PROCESSED
Which data, for what purpose
Which data, for what purpose
and on what legal basis
Your personal data is processed only through the three channels below and only for the purposes listed.
| Channel | Data processed | Purpose | Legal basis |
|---|---|---|---|
| Visiting the site | IP address, date and time of access, requested page, browser and operating system, referring page (server access logs) | Running the site, keeping it secure, detecting errors and misuse | Compliance with a legal obligation (ç); legitimate interest (f) |
| Platform sign-in form | Username, password, company code; on successful sign-in, the session key and the user's name | Authentication and access to the Crealog platform | Formation or performance of a contract (c); legitimate interest (f) |
| Email and phone | Name, email address, phone number, organisation and any other information you share in your message | Answering your request; handling quotes, projects and support | Formation or performance of a contract (c); legitimate interest (f) |
How data is collected. Server access logs are created automatically when you open the site. Sign-in details are collected electronically when you fill in the form; contact details through the emails you send us and phone calls.
What we do not collect. The site uses no advertising, retargeting or visitor analytics tools (e.g. Google Analytics); no visitor profiles are built and no special categories of personal data are requested.
03 COOKIES AND LOCAL STORAGE
Data stored
Data stored
in your browser
Our site sets no cookies of its own. Only during platform sign-in are the records below written to your browser's local storage, where they stay on your device.
| Record name | Location | Contents | When and for how long |
|---|---|---|---|
crealogRememberLite |
localStorage | Username and company code; no password | Written on successful sign-in while “Remember me” is ticked; kept until you untick it or clear your browser data |
firma |
localStorage | Company code | Written for the platform's use while “Remember me” is ticked |
crealogHandoff |
localStorage | Session key, your name, company code and a timestamp | Single-use hand-over to the panel after sign-in; the panel deletes it as soon as it reads it, and it is valid for at most 30 seconds |
session sessionStart firmaKodu name |
sessionStorage | Session key, session start time, company code and your name | For the duration of the platform session; deleted by the browser when you close the tab |
Your password is not stored. “Remember me” remembers only your username and company code; your password is sent only for authentication and is not kept in the browser. These records stay on your device and are never sent to Createch servers.
An earlier version of the site also stored the password in encrypted form (crealogRemember, crealogKeyStore). If such a record exists, it is deleted automatically the first time you open the site; only the username and company code are carried over to the new record.
You can remove all of these records at any time by clearing this site's data in your browser settings.
SHARED DEVICES
Do not tick “Remember me” on a computer that other people also use; your username and company code are visible to anyone who opens the same browser.
If your browser offers to save your password, that is the browser's own password manager and is outside the site's control. Do not accept that offer on shared devices.
04 TRANSFERS
Transfers and
Transfers and
third-party services
Your personal data is never sold, rented or shared for marketing purposes.
Google Fonts
The typefaces on our pages are loaded from Google LLC servers (fonts.googleapis.com, fonts.gstatic.com). In doing so, your browser sends your IP address and browser details to Google; these servers may be located outside Türkiye.
YouTube introduction film
The cover image of the film on the home page is loaded from YouTube's image server (i.ytimg.com), so your IP address is sent to Google when you open the home page. The player itself opens only when you press play, through YouTube's privacy-enhanced mode (youtube-nocookie.com); YouTube may then use its own cookies or similar technologies. The player is removed from the page when you close the window.
Platform servers
Depending on the company code you enter, your sign-in details are sent over HTTPS either to Createch's platform server or to a platform server hosted on your organisation's own infrastructure.
WHO DATA MAY BE SHARED WITH (KVKK ART. 8 AND 9)
- Service providers. Suppliers we use for hosting the site and for IT infrastructure, only to the extent the service requires.
- Your organisation. Platform sign-in details go to the platform server of the organisation your company code belongs to, for authentication.
- Competent public authorities. Courts and authorised public bodies, where required by law and upon request.
- Abroad. The Google Fonts and YouTube connections described above are made directly between your browser and Google's servers. For Google's practices, see the Google Privacy Policy.
EXTERNAL LINKS
Links on this site may take you to other sites (e.g. wiki.createch.com.tr or YouTube). Those sites' privacy practices are governed by their own notices.
05 RETENTION AND SECURITY
How long is data kept,
How long is data kept,
and how is it protected?
Data is kept only as long as its purpose requires; after that it is deleted, destroyed or anonymised.
Your personal data is kept for as long as the purpose of processing requires and for the retention periods set by the applicable legislation. When these periods end, the data is deleted, destroyed or anonymised in accordance with Article 7 of KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
The retention periods of the records kept in your browser are listed in the table in section 03; you are fully in control of them.
- Encrypted connection. Connections to the platform servers are made over HTTPS.
- Passwords are not stored. The site never stores your password; “Remember me” remembers only the username and company code.
- Sessions are not written to the address bar. After sign-in, the session is handed to the panel through a single-use record, so it does not appear in any link you share.
- Information security management. Our processes run under an ISO 27001 Information Security Management System; see our Information Security Policy for details.
06 YOUR RIGHTS
Your rights under
Your rights under
KVKK Article 11
By applying to Createch, you can exercise the following rights regarding your personal data.
EVERY DATA SUBJECT HAS THE RIGHT TO
- learn whether their personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom the data is transferred,
- request correction if the data is incomplete or inaccurate,
- request deletion or destruction of the data under the conditions of KVKK Article 7,
- request that third parties to whom the data was transferred be notified of any correction, deletion or destruction,
- object to a result against them that arises from analysis of the data exclusively by automated systems,
- claim compensation for damage suffered due to unlawful processing.
07 REQUESTS
How can you
How can you
exercise your rights?
Requests can be made through the channels set out in the Communiqué on the Procedures and Principles of Application to the Data Controller.
Written request
You can hand-deliver your request bearing your wet signature, or send it via a notary, to Ulamış Mah. 75. Yıl Cumhuriyet Cad. No:19/3 Seferihisar / İzmir, Türkiye.
Electronic request
You can send a request signed with a secure electronic signature or mobile signature, or one written from an email address you have previously given us and that is registered in our systems, to info@createch.com.tr.
Response
Your request is concluded free of charge as soon as possible depending on its nature, and within thirty days at the latest. If the action requires an additional cost, the fee set by the Personal Data Protection Board's tariff may be charged.
YOUR REQUEST SHOULD INCLUDE
- Name, surname and, for written requests, signature,
- Turkish ID number for Turkish citizens; nationality and passport or ID number for foreign nationals,
- Residential or business address for notifications,
- Email address, phone and fax number for notifications, if any,
- The subject of the request and any related information and documents.
COMPLAINTS AND UPDATES TO THIS NOTICE
If your request is rejected, you find the response insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board under KVKK Article 14.
This notice may be updated following changes in legislation or on the site. The current version is always published on this page with its last updated date. If the English and Turkish versions differ, the Turkish version prevails.
08 CONTACT
Questions about your personal data
For any question or request about this notice or the processing of your personal data, you can reach us by email or phone.
Sending formal KVKK requests through the channels described in section 07 lets us verify your identity and conclude your request quickly.