SignyFix
Ücretsiz Başla

Legal · GDPR

GDPR Uyum Beyanı

AB Genel Veri Koruma Tüzüğü (Regulation (EU) 2016/679) kapsamındaki taahhütlerimiz.

Son güncelleme: 4 Haziran 2026

1. Controller & Processor Roles

SignyFix is operated by Ginza Sistem. We act as a data controller for our account holders' data and as a data processor for the end-user (personnel) data our customers manage through the platform. A Data Processing Agreement (DPA) is available on request.

2. Lawful Basis (Art. 6)

  • Performance of a contract (providing the service you signed up for),
  • Legitimate interests (security, fraud prevention, service improvement),
  • Legal obligation, and
  • Consent where required (e.g. certain communications).

3. Data We Process

Account data (name, email, role, tenant), authentication data, Microsoft 365 / Entra ID directory attributes synced upon connection, encrypted OAuth tokens, and operational logs (IP, request id, audit trail).

4. Data Subject Rights (Art. 15–22)

  • Right of access, rectification and erasure ('right to be forgotten'),
  • Right to restriction of processing and to object,
  • Right to data portability,
  • Right to withdraw consent at any time, and to lodge a complaint with a supervisory authority.

To exercise your rights, contact us via our contact page. We respond within one month (Art. 12).

5. Security & Data Location (Art. 32)

  • Tenant isolation enforced at the database layer via PostgreSQL Row-Level Security.
  • OAuth tokens encrypted with AES-256-GCM; passwords hashed with bcrypt.
  • Encryption in transit (TLS) and a Cloudflare WAF + rate limiting at the edge.
  • Data hosted in EU data centres (Azure West/North Europe). International transfers, where necessary, rely on appropriate safeguards (SCCs).

6. Sub-processors & Breach Notification

We use vetted sub-processors (Azure, Cloudflare, our email delivery provider) under appropriate agreements. In the event of a personal data breach, we notify the relevant supervisory authority and affected data subjects in line with Art. 33–34 without undue delay.

7. Türkiye / KVKK

For users in Türkiye, see our KVKK Aydınlatma Metni. Our Privacy Policy applies to all users.