Draft prepared for review by Roltek's legal counsel. Not legal advice.
Last updated: [Effective date]
1. Who we are
This privacy policy explains how Roltek A.Ş. (Roltek Teknoloji), Megapol Çarşı Kule, Halkapınar Mah. 1203/11. Sk. No: 5-7, Kat 9, Ofis 98, 35170 Konak, İzmir, Türkiye, MERSİS no. [MERSİS no.] ("Roltek", "we", "us") processes personal data in connection with the Hermetry website, the Hermetry community forum and Hermetry platform accounts. Roltek is the data controller (*veri sorumlusu* under KVKK) for the processing described in this policy.
Contact for privacy matters: info@hermetry.com, or by post to the address above, marked "Personal data". Where Article 27 GDPR requires it, the details of our representative in the European Union are: [EU representative].
A short information notice under Article 10 of Türkiye's Personal Data Protection Law No. 6698 ("KVKK") is available as our KVKK information notice. This policy is the full version.
2. Scope: when we are controller and when we are processor
Roltek as controller. This policy covers personal data we decide to process for our own purposes: visitors to hermetry.com and its pages; people who contact us, ask for a demo or write through the contact form; forum members; the contact persons of customers, prospects, partners and suppliers; and the users of Hermetry platform accounts, for the data we need to run, secure and bill the account (for example sign-in details, billing records and security logs).
Roltek as processor. Customers use the Hermetry platform to collect and process their own data: telemetry and device data, dashboards, rules, alarms, audit records of their own users, and personal data of their staff, contractors and end customers inside their workspace ("Customer Content"). For Customer Content the customer is the controller and Roltek processes it only on the customer's documented instructions under our Data processing addendum. If you are a user of a customer's workspace and want to exercise your rights over Customer Content, please contact that customer first; we will help them answer you.
The same applies to the Hermetry mobile app when a customer pairs a phone as a device: the location, battery and motion signals the phone sends are Customer Content of the customer that operates the device, and each signal is sent only after the person using the phone turns it on.
3. Personal data we process and where it comes from
Categories of personal data
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, business e-mail address, phone number, company, job title | You, your employer, or a colleague who invites you |
| Account and sign-in | User name, hashed password, two-factor settings (authenticator app, e-mail or SMS codes), passkey public keys, single sign-on and social sign-in identifiers (for example from Google, Microsoft or Apple) | You, your organisation's identity provider, or the sign-in provider you choose |
| Customer and contract | Plan, order forms, add-on modules, tenant and region, support tickets | You and your organisation |
| Billing | Billing name and address, tax office and tax number, invoices, payment status. Card data is entered with our payment provider and is not stored by us | You, your organisation and our payment provider |
| Communications | Contact form messages (name, e-mail, company, topic, the page you wrote from, the country derived from your IP address), e-mails, demo requests | You |
| Forum content | Profile, posts, replies, likes, the IP address recorded with each post, AI translations of posts, questions asked to the forum help bot | You and our systems |
| Technical and security | IP address, browser and device details, time stamps, requests and responses, sign-in history, sessions, security signals and the decisions of the AI firewall, audit log entries about account actions | Our systems |
| Preferences | Colour theme, the last announcement bar you closed, monthly or annual pricing view, region choice | Your browser; see the cookie policy |
4. Purposes and legal bases
The table below sets out why we process personal data and the legal basis we rely on under Article 6(1) GDPR and Article 5 KVKK. Where we rely on legitimate interests, we have weighed them against your interests and rights; you may ask us for that assessment.
Purposes and legal bases
| Purpose | Data | GDPR basis | KVKK basis |
|---|---|---|---|
| Running the website and forum, detecting your region, keeping the service stable | Technical, preferences | Art. 6(1)(f): operating a functioning website | Art. 5(2)(f): legitimate interest |
| Answering enquiries and demo requests, preparing offers | Identity and contact, communications | Art. 6(1)(b): steps at your request before a contract; Art. 6(1)(f) for contact persons of companies | Art. 5(2)(c): directly related to the establishment of a contract; Art. 5(2)(f) |
| Opening and running platform accounts, providing support | Identity, account and sign-in, customer and contract | Art. 6(1)(b): contract; Art. 6(1)(f) for users invited by a customer | Art. 5(2)(c); Art. 5(2)(f) |
| Authentication, two-factor sign-in, passkeys, SSO and social sign-in | Account and sign-in, technical | Art. 6(1)(b) and (f): securing access to accounts | Art. 5(2)(c) and (f) |
| Invoicing, collection, tax and accounting | Billing, customer and contract | Art. 6(1)(b); Art. 6(1)(c) where EU or Member State law requires it; otherwise Art. 6(1)(f): complying with Turkish tax and commercial law | Art. 5(2)(ç): legal obligation (TTK, VUK); Art. 5(2)(c) |
| Security, fraud and abuse prevention, the AI firewall, audit logs, logging required of hosting providers | Technical and security | Art. 6(1)(f): protecting the platform, our customers and users; Art. 6(1)(c) where applicable | Art. 5(2)(ç): Law No. 5651 and KVKK Art. 12 security duties; Art. 5(2)(f) |
| Forum membership, moderation, AI translation of posts and the forum help bot | Identity, forum content, technical | Art. 6(1)(b): providing the forum you joined; Art. 6(1)(f): moderation | Art. 5(2)(c) and (f); Art. 5(2)(d) for content you make public yourself |
| Service messages (security alerts, invoices, changes to the service or terms) | Identity and contact, account | Art. 6(1)(b) and (f) | Art. 5(2)(c) and (ç) |
| Marketing e-mails and newsletters | Identity and contact | Art. 6(1)(a): consent; or Art. 6(1)(f) for existing business customers where ePrivacy law allows, with an opt-out in every message | Art. 5(1): explicit consent, and Law No. 6563 consent rules, except where the law allows messages to merchants and tradespeople until they opt out |
| Establishing, exercising or defending legal claims; answering authorities | Any relevant category | Art. 6(1)(f); Art. 6(1)(c) | Art. 5(2)(e): establishment, exercise or protection of a right; Art. 5(2)(ç) |
You must give us the data marked as needed in sign-up, contact and order forms; without it we cannot open an account, answer you or invoice. Everything else is optional.
5. Automated decisions: the AI firewall
Hermetry and its website are protected by an AI firewall. It combines rules, detectors and machine-learning models to evaluate security signals such as request patterns, sign-in failures and known attack signatures. It can automatically slow down, challenge or block traffic, sessions or accounts that look like an attack. Every decision is recorded with the reason for it. On industrial devices the AI firewall never acts by itself: it can only suggest an action for a person to approve.
We use these automated decisions because attacks happen faster than a person can respond. They are made for security only, not to evaluate you as a person, and they do not produce legal effects such as refusing a contract. If you believe an automated decision has affected you, write to info@hermetry.com: a person will review the decision, you can explain your view, and we will tell you the result. This also covers your right under Article 11(1)(g) KVKK to object to an outcome against you that results solely from automated analysis, and your rights under Article 22 GDPR where it applies.
The forum's AI translation and help bot do not make decisions about you. They translate posts and suggest answers from our documentation; a person can always correct them.
6. Who receives personal data
We share personal data only as far as needed for the purposes above, with:
- Service providers acting for us (processors): hosting and infrastructure in each region, e-mail and SMS delivery, payment processing, customer support tools, and Anthropic PBC (Claude), which translates forum posts and powers the forum help bot. Forum posts and questions to the help bot are sent to Anthropic for this purpose only. Each provider is bound by a written contract with confidentiality and security duties. The current list of sub-processors is available on request at info@hermetry.com.
- Sign-in providers you choose, such as Google, Microsoft or Apple, and your organisation's single sign-on provider, which receive the data needed to confirm your sign-in under their own privacy terms.
- The customer that controls your workspace, if you use Hermetry as a user of a customer's tenant (for example your employer can see your account and your actions in its audit log).
- Professional advisers such as lawyers, auditors and accountants, under a duty of confidentiality.
- Public authorities, courts and enforcement offices, where the law requires us to disclose data or where we need to defend our rights.
- A buyer or successor, if all or part of our business is transferred, under the same protections as this policy.
We do not sell personal data and we do not share it for targeted advertising.
7. International transfers
Hermetry runs as separate deployments in the European Union, the United States and Türkiye. Platform account data and Customer Content are stored in the region where the account was created and are not moved to another region for normal operation.
Some processing involves a transfer abroad, in particular: support and engineering access from Türkiye to the EU and US deployments; e-mail, SMS and payment services; and forum translation and the help bot by Anthropic in the United States; and, only while website analytics is switched on and only after you allow it in the cookie banner, Google Analytics 4 (Google Ireland Limited, with processing by Google LLC in the United States). We make such transfers only under one of the following safeguards:
- From Türkiye (KVKK Article 9, as amended by Law No. 7499 in 2024): an adequacy decision of the Personal Data Protection Board where one exists; otherwise the standard contract published by the Board, which we notify to the Personal Data Protection Authority within five business days of signing; or another appropriate safeguard listed in Article 9, or an occasional transfer that meets its conditions.
- From the EU/EEA (GDPR Chapter V): an adequacy decision of the European Commission (for the United States, for recipients certified under the EU-U.S. Data Privacy Framework); otherwise the European Commission's standard contractual clauses (2021/914) with a transfer impact assessment and supplementary measures where needed. Türkiye does not have an EU adequacy decision, so access from Türkiye to EU data relies on standard contractual clauses.
You can ask us for a copy of the safeguard that applies to a transfer at info@hermetry.com (commercial terms may be redacted).
8. How long we keep personal data
We keep personal data only as long as needed for the purpose it was collected for, and then for any period the law requires or the limitation period for possible claims. When the period ends, we delete, destroy or anonymise the data under our retention and destruction policy, at the latest in the next periodic destruction run as provided in the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
Retention periods
| Data | Retention period | Reason |
|---|---|---|
| Account and contract data | For the life of the account, then for the general limitation period for contractual claims (10 years, TBK Art. 146) in a restricted archive | Contract and defence of claims |
| Invoices, accounting records and correspondence relevant to them | 10 years from the end of the financial year (TTK Art. 82); at least 5 years under VUK Art. 253 | Legal obligation |
| Contact form messages and sales correspondence that did not lead to a contract | [2 years] from the last exchange | Follow-up of the enquiry and proof of communication |
| Forum account and posts | Until you delete your account; public posts may remain in anonymised form so that discussions stay readable | Providing the forum |
| Website and platform traffic logs | As required of hosting providers under Law No. 5651 (at least 1 year and at most 2 years) | Legal obligation |
| Security events, AI firewall decisions | [12 months], or longer while an incident or claim is open | Security and investigations |
| Audit log entries of a customer's workspace | For the period set by the customer in its workspace or order form | Customer Content, processed for the customer |
| Marketing consent records | While consent is valid and 3 years after it ends (Regulation on Commercial Communication, Art. 12) | Proof of consent |
| Backups | Overwritten in rotation within [35 days] | Disaster recovery |
9. How we protect personal data
We take the technical and administrative measures required by Article 12 KVKK and Article 32 GDPR, including: separation of each customer's data in the database with row-level security; encryption of data in transit; hashed passwords and device secrets; two-factor authentication, passkeys and single sign-on; role- and attribute-based access control; an append-only audit log per tenant, which also records any support access; continuous monitoring by the AI firewall; and regional hosting. More detail is on our security page. No system is perfectly secure; if a personal data breach affects you, we will inform you and the competent authority as the law requires.
10. Your rights
Under Article 11 KVKK you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of processing and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request its deletion or destruction under Article 7; request that correction, deletion or destruction be notified to the third parties to whom the data was transferred; object to an outcome against you that results solely from automated analysis; and claim compensation for damage caused by unlawful processing.
Under Articles 15 to 22 GDPR, where the GDPR applies, you have the right to: access your data and receive a copy; rectification; erasure; restriction of processing; data portability; object to processing based on legitimate interests (and at any time to direct marketing); and not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. Where processing rests on consent, you may withdraw it at any time without affecting earlier processing.
US state privacy laws. If a US state privacy law applies to you, you may have the right to know, access, correct and delete personal information and to appeal our decision. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics. We will not discriminate against you for using your rights.
11. How to make a request
You can send a request:
- in writing, signed, by post to the address in section 1, marked "KVKK / GDPR request";
- by registered electronic mail (KEP) to [KEP address], or by e-mail signed with a secure electronic signature or mobile signature, to info@hermetry.com;
- by e-mail to info@hermetry.com from the e-mail address you have registered with us.
As required by the Communiqué on the Procedures and Principles of Application to the Data Controller, include your name and surname, signature (for written requests), Turkish ID number (for Turkish citizens) or nationality and passport or ID number (for others), your address, an e-mail address, phone or fax number for notification, and what you are asking for. We may ask for information to confirm your identity.
We answer within 30 days under KVKK and within one month under the GDPR (which we may extend by two months for complex requests, telling you why). Requests are free of charge; where answering involves an extra cost, we may charge only the fee set in the Board's tariff.
12. Complaints
If your request is refused, the answer is unsatisfactory, or we do not answer in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr) within 30 days of our answer and in any case within 60 days of your request (KVKK Article 14). If the GDPR applies, you may also complain to the supervisory authority of your EU or EEA country of residence, place of work or place of the alleged infringement. We would appreciate the chance to resolve your concern first.
13. Children
Hermetry and its forum are business services for adults. They are not directed at anyone under 18, and we do not knowingly collect children's data. If you believe a child has given us personal data, contact us and we will delete it.
14. Links and third-party services
Our pages link to other sites, such as device manufacturers' pages. Their own privacy terms apply when you visit them.
15. Changes to this policy
We update this policy when our processing or the law changes. The date at the top shows the latest version. We tell platform account holders about material changes by e-mail or in the platform before they take effect.
16. Contact
Questions about this policy or your data: info@hermetry.com, or Roltek A.Ş., Megapol Çarşı Kule, Halkapınar Mah. 1203/11. Sk. No: 5-7, Kat 9, Ofis 98, 35170 Konak, İzmir, Türkiye.