Last updated: 15 October 2026
1. Data controller and processor
For data relating to employees of an organisation using HibritİK (“Customer Organisation”), the Customer Organisation is the data controller; Sotech Bilgi Teknolojileri (“Sotech”) is the data processor acting on its behalf and instructions.
For visitors of this website, people submitting contact or trial requests, and the commercial relationship with organisation administrators, Sotech is the data controller (address: Barbaros Mah. Lale Sok. Ağaoğlu My Office No:2/13, Ataşehir / İstanbul; e-mail: [email protected]).
2. Personal data processed
Identity and contact: first and last name, e-mail, phone, profile photo.
Professional information: organisation, department, title, manager, employment status and, depending on the modules used by the Customer Organisation, records such as tasks, projects, leave, overtime, vehicle requests, training, performance evaluations and payslips.
User content: task descriptions, comments, messages (stored encrypted on the server), uploaded files, photos, videos and audio recordings.
Transaction security: session and login records, IP address, device and app version, push notification device token, mobile app crash reports (device model, OS version, error log).
Website: name, e-mail, company, phone and message entered in the contact form.
3. Purposes and legal grounds
Data is processed to provide the service and perform the subscription agreement, manage user accounts, send notifications, ensure information security, respond to support requests and fulfil legal obligations.
Legal grounds under Article 5(2) KVKK: establishment or performance of a contract (c), compliance with a legal obligation (ç), establishment, exercise or protection of a right (e), and legitimate interest provided it does not harm the data subject’s fundamental rights (f). For data of Customer Organisation employees, determining the legal ground is the responsibility of the Customer Organisation as data controller.
4. Mobile app permissions
Camera, microphone and photo library permissions are used only when the user chooses to attach a file, photo, video or audio recording to a task, message or request, and with the user’s consent. Notification permission is used to deliver task and approval notifications. Location data is not collected. Permissions can be revoked at any time in the device settings.
5. Storage and transfers
Data is stored on servers hosted in a data centre in Istanbul, Türkiye, on encrypted disks, and is backed up.
Data is shared, only to the extent necessary, with hosting and infrastructure providers (cloud servers, e-mail delivery), with Google Firebase (Cloud Messaging, Crashlytics) and Apple Push Notification services to deliver mobile notifications and fix app errors, and with competent public authorities where required by law. As these services are located abroad, notification content, device tokens and crash reports may be transferred abroad; such transfers are made in accordance with Article 9 KVKK.
AI features such as the task creation assistant run on Sotech’s own servers; data is not sent to third-party AI services.
6. Retention and security
Data is retained for the subscription term and thereafter for the periods required by law; it is then deleted, destroyed or anonymised. The Customer Organisation can delete user accounts and data itself during the subscription term.
Sotech applies technical and organisational measures such as access authorisation, encrypted connections (TLS), encrypted storage, logging and regular backups, and operates under an ISO 27001 information security management system.
7. Your rights
Under Article 11 KVKK you have the right to learn whether your personal data is processed, request information if it is, learn the purpose of processing and whether it is used accordingly, know the third parties to whom it is transferred, request rectification if it is incomplete or inaccurate, request erasure or destruction, request that such operations be notified to third parties, object to an outcome against you resulting from analysis by automated systems, and claim compensation for damages arising from unlawful processing.
For your data in your organisation’s HibritİK account, please contact your organisation (the data controller) first. Requests addressed to Sotech may be sent by e-mail to [email protected] or in writing to Barbaros Mah. Lale Sok. Ağaoğlu My Office No:2/13, Ataşehir / İstanbul. Requests are answered free of charge within 30 days at the latest.
8. Cookies and changes
This website uses only a strictly necessary cookie to remember your language preference; no advertising or tracking cookies are used. The web application uses strictly necessary security cookies to maintain your session.
This notice may be updated; the current version is published on this page.