Privacy Policy and Personal Data Protection Notice
Last Effective / Update Date: October 19, 2026
IMPORTANT LEGAL STATUS AND DATA CONTROLLER / DATA PROCESSOR NOTICE:
This Privacy Policy and Disclosure Text has been executed in full compliance with Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and international personal data protection standards (including the EU GDPR). ParcelRec Platform / Ali Bingöl ("Service Provider", "ParcelRec", "We") acts as the "Data Controller" regarding user registration, corporate account management, subscription administration, invoicing, customer relations, and technical support processes for the Client ("Customer/User").
Conversely, with respect to third-party recipient, order, and delivery details retrieved via third-party Marketplace APIs (Trendyol, etc.) integrated by the Customer within their own commercial operations, as well as operational video recordings captured via device cameras at packing stations containing personal data belonging to employees, customers, or third parties; the Customer who exclusively determines the purposes and technical means of data processing is the sole "Data Controller". ParcelRec acts strictly as an independent "Data Processor" providing software, bridge, and technical execution pursuant to the express automated instructions of the Customer.
1. Identity of the Data Controller and Contact Information
Pursuant to statutory disclosure mandates, the identity and contact details of the Data Controller are as follows:
- Data Controller / Service Provider: ParcelRec Platform / Ali Bingöl
- Registered Address: Kocatepe Mah. 1. Sok. Bayrampasa / Istanbul, Turkey
- Official Privacy & Legal Inquiry Email: parcelrecord@gmail.com
2. Categories of Processed Personal Data
Depending on the concrete operational activities and features utilized across the ParcelRec platform, the following categories of personal data are processed:
- Identity Data: Full name, national identity number (for sole proprietorships), and authorized signatory information.
- Contact Data: Corporate email address, telephone number, legal registered address, and billing address.
- Customer Transaction & Financial Data: Subscription tier, license history, billing records, tax office, Tax Identification Number (VKN), payment history, and transfer receipts. (Raw credit/debit card credentials are never stored on our servers; they are processed via PCI-DSS compliant licensed payment gateways).
- Operational Security & System Audit Logs: Username, cryptographic password hashes, static/dynamic IP addresses, session logs, browser User-Agent strings, network traffic logs retained under Law No. 5651, and unique device identifiers.
- Operational Metadata: E-commerce order numbers, carrier tracking numbers, parcel barcodes, SKU details, packaging timestamps, station IDs, and operator handles/identifiers.
- Cryptographic Integrity Data (SHA-256): 256-bit cryptographic summary digest values (hashes) generated at the completion of packaging to mathematically verify video file integrity.
- Marketplace API Credentials: Seller ID (Supplier ID), API Key, API Secret, and OAuth tokens provided voluntarily by the Customer.
- Google Drive Metadata: OAuth 2.0 authorization tokens, targeted folder identifiers, generated file names, file sizes, and synchronization status logs.
- Visual and Audio Recordings (Camera Footage): Video recordings captured via device cameras concerning Customer's personnel, parcel boxes, products, and packing stations.
- Communication & Support Records: Inquiries, correspondences, support tickets, and logs transmitted via customer service channels (Email, WhatsApp).
- Website Analytics Data: Anonymized browser, session, device, page navigation, and interaction metrics gathered via Google Analytics 4.
3. Legal Bases and Purposes of Processing
The personal data listed above are processed under the legal grounds stipulated in data protection laws (including KVKK Art. 5/2 and GDPR Art. 6/1) for the following purposes:
- Performance of Contract (KVKK Art. 5/2-c / GDPR Art. 6/1-b): Provisioning B2B SaaS accounts, matching barcodes with video recordings, synchronizing offline queues, and delivering software technical support.
- Compliance with Legal Obligations (KVKK Art. 5/2-ç / GDPR Art. 6/1-c): Complying with internet traffic logging mandates (Law No. 5651), maintaining statutory tax and commercial accounting books, and fulfilling legal orders from courts or administrative authorities.
- Legitimate Interests (KVKK Art. 5/2-f / GDPR Art. 6/1-f): Protecting the software infrastructure against cyberattacks, preventing fraud, investigating operational crashes, optimizing software speed, and preserving evidence for potential legal disputes.
4. Camera Recordings, Google Drive Bridge, and Customer's Responsibility
Zero Permanent Cloud Archive Architecture: ParcelRec functions exclusively as a transient bridge between your capture device and your authorized Google Drive storage. Video files pass through temporary memory buffers during synchronization; ParcelRec servers never store or retain a permanent video archive. The ultimate preservation of footage rests entirely with the Customer.
The act of recording employees or third parties at packaging stations falls exclusively under the Customer's capacity as Data Controller. Customer unconditionally covenants and agrees to:
- Post visible, clear physical and digital notification signs at recording stations and provide mandatory workplace privacy disclosures to staff and visitors.
- Anchor the processing activity to appropriate legal bases under labor and data protection laws (e.g., occupational safety, legitimate interest, or explicit consent where legally required).
- Strictly control and limit access rights to video playback and ensure third-party sharing (with buyers, couriers, or platforms) is conducted strictly on a need-to-know basis.
5. Marketplace API Integrations (Read / Write / Push Operations)
ParcelRec supports two-way API integrations with platforms such as Trendyol. API credentials (Seller ID, API Key, API Secret) provided by the Customer are utilized within the following technical boundaries:
API Operations Architecture:
- Read Operations: Pulling open order lists, recipient tracking codes, order line items, and package barcodes from the marketplace into the ParcelRec interface.
- Write / Push Operations: Automatically or manually transmitting order fulfillment status updates (e.g., "Packed", "Ready for Shipment") or carrier tracking updates to the marketplace API pursuant to Customer commands.
Customer authorizes ParcelRec to perform these operations. API credentials are encrypted at rest using industry-grade cryptography (AES) and are used solely to run Customer automations. When Customer deletes the integration from the panel, these credentials are purged instantly and permanently from our databases.
6. Google Drive Integration & Limited Use Disclosure
ParcelRec synchronizes operational packaging videos directly with the Customer's authorized Google Drive account.
Google API Services User Data Policy (Limited Use Disclosure):
ParcelRec's use and transfer to any other app of information received from Google APIs will adhere to the
Google API Services User Data Policy, including the Limited Use requirements.
Explicit In-App Guarantees:
- Our software requests only the minimum OAuth scopes necessary to create and upload video recordings to the designated application folder.
- ParcelRec cannot and does not read, access, download, modify, or delete any personal documents, photos, or files in your Google Drive.
- Data obtained via Google APIs is never transferred or sold to third parties for advertising, data brokering, or training artificial intelligence / machine learning models.
7. Domestic and International Data Transfers
Personal data is transferred strictly in line with data minimization principles to the following recipient categories:
- Domestic Transfers: Licensed payment service providers (PayTR, Iyzico, etc.), electronic invoicing integrators, certified public accountants, legal counsels, local cloud hosting vendors, and legally authorized judicial/public institutions.
- International Transfers: Due to the global infrastructure of Google Drive, cloud hosting networks (AWS, Cloudflare), Google Analytics 4, and international marketplace APIs, data may be transferred to overseas servers. Such cross-border transfers are conducted pursuant to Standard Contractual Clauses (SCCs), adequacy decisions, or statutory safeguard mechanisms under applicable privacy laws.
8. Google Analytics 4, Cookies, and Tracking Technologies
ParcelRec uses two categories of cookies on its website:
- Strictly Necessary Technical Cookies: Essential for secure account login, maintaining active user sessions, CSRF token security, and server load balancing. These cannot be disabled.
- Analytics Cookies (GA4): First-party analytical cookies utilized to measure visitor traffic, software errors, and performance metrics. IP masking/anonymization is enabled; direct personal identifiers (name, email) are never transmitted to Google Analytics.
9. Data Retention, Archival, and Disposal Schedule
Personal data is retained only for the statutory durations mandated by applicable laws or for the period necessary to fulfill the processing purpose, after which it is securely erased, destroyed, or anonymized:
| Data Category |
Statutory Retention Period |
Disposal Method |
| Account & Contact Data |
Active subscription duration + 2 years post-termination pursuant to commercial/contractual limitation periods. |
Permanent cryptographic database purge. |
| Financial & Tax Records |
10 years pursuant to the Tax Procedure Code and Commercial Code. |
Secure deletion upon statutory expiry. |
| Traffic & Access Logs |
2 years from creation pursuant to internet traffic logging legislation. |
Automated cryptographic purge. |
| Marketplace API Keys & Secrets |
Retained while integration is active; wiped instantly upon removal. |
Instant database erasure. |
| SHA-256 Hashes |
Retained during the subscription to resolve dispute claims. |
Deleted upon account termination. |
| Packaging Video Footage |
Not retained on ParcelRec servers. Retention and deletion are entirely governed by Customer's Google Drive policies and quota. |
Exclusively managed by Customer. |
10. Technical and Organizational Security Measures
ParcelRec implements robust technical and administrative safeguards to prevent unlawful data processing and unauthorized access:
- All network communication is protected via industry-standard SSL/TLS 256-bit cryptographic encryption protocols.
- User passwords are stored using one-way cryptographic hashing algorithms (bcrypt/argon2).
- Marketplace API keys and secret tokens are symmetrically encrypted at rest.
- Regular penetration testing, vulnerability patching, and access audit logging are performed.
- Server access is strictly isolated using Role-Based Access Controls (RBAC) and IP whitelisting.
11. Personal Data Breach Notifications
Despite all reasonable technical and administrative precautions, should an unauthorized security breach occur resulting in the compromise of personal data, ParcelRec shall notify the competent Data Protection Authorities and affected Clients within statutory timelines upon becoming aware of the incident.
12. Customer Fault and Full Indemnification
INDEMNITY AND LEGAL RECOURSE CLAUSE:
In the event that ParcelRec is subjected to any administrative fines, regulatory penalties, court judgments, or legal claims arising from Customer's failure to provide mandatory workplace privacy disclosures to its employees, unlawful marketplace API misuse, third-party privacy infringements, or breach of statutory Data Controller duties; all such fines, damages, court expenses, statutory interest, and reasonable attorney fees shall be indemnified in full by the Customer. Customer irrevocably agrees to pay such amounts to Service Provider upon first written demand.
13. Rights of the Data Subject
Under applicable personal data protection laws, individuals maintain the right to:
- Learn whether their personal data is being processed,
- Request information if their personal data has been processed,
- Learn the purpose of the processing and whether data is used in accordance with its purpose,
- Know the third parties to whom personal data is transferred domestically or abroad,
- Request rectification of incomplete or inaccurate data,
- Request erasure or destruction of personal data under statutory conditions,
- Request notification of rectification or deletion to third parties to whom data has been transferred,
- Object to the processing of data exclusively through automated systems resulting in an adverse outcome,
- Claim compensation for damages arising from unlawful processing.
Application Procedure: Inquiries must be submitted in writing via the email registered with your account to parcelrecord@gmail.com. Requests will be evaluated and concluded free of charge within a maximum of thirty (30) days.
14. Enforceability and Policy Amendments
This Policy takes effect immediately upon publication on our web platform. ParcelRec reserves the right to amend this text to reflect technological updates, statutory changes, or new integrations. Material changes will be communicated to registered subscribers through appropriate digital channels.