Data Processing
You own your records; we process them on your behalf
For the customer, employee and supplier data you enter into the platform, your company is the data controller; Müşavir is the party that processes it on your instructions only. This page explains which data each module processes, for what purpose and for how long.
Send a requestWe have two different roles
| Where we act as processor | Where we act as controller |
|---|---|
| The tenant's customer, lead and supplier records | The subscribing company's account and billing details |
| Personnel, leave, attendance and payroll data of the tenant's employees | Sign-in and session records of panel users |
| Inbox conversations, files, proposal and reconciliation counterparties | Marketing site visitors and contact form requests |
Data categories per module
The list shows the categories each module is designed to handle. You decide which fields you fill in.
| Module | Data categories | Purpose |
|---|---|---|
| CRM | Identity, contact details, source, notes, appointments | Managing customer and lead relationships |
| Proposals and sales | Contact details, line items, amounts, signature status | Quoting, tracking contracts and sales |
| Bookkeeping | Company name, tax ID, invoices, payments, bank transactions | Record keeping, collections and reporting |
| E-reconciliation | Counterparty name, email, balance, uploaded statement | Confirming current-account balances with the other side |
| HR | Identity, contact, personnel file, leave, attendance, pay, bank account; may include special categories such as sick notes | Personnel management, leave and payroll preparation |
| Inbox | Conversation metadata, preview, ad source signals | Tracking messages in one list, opening lead records |
| Files | Contents of documents you upload | Storing and sharing documents inside the company |
| AI | Records relevant to the question, content of documents read | Answers, drafts, document reading |
Why roles matter
KVKK and GDPR hold every party that handles data responsible according to its role. When you enter a customer record into the platform, you decide why and how it is processed, so you are the data controller. Müşavir stores, displays and processes that record on your behalf, so it is the data processor. Informing data subjects, obtaining explicit consent where needed and choosing the legal basis are the controller’s tasks.
For our own subscribers’ account details, panel session records and requests that reach our marketing site, Müşavir is the controller. That data is described in our privacy policy.
Processing on your instructions
- We process tenant data only to provide the service, answer your support requests, keep the platform secure and meet legal obligations.
- We do not sell tenant data, use it for ad targeting or give it to AI model training.
- We bind subprocessors to obligations at the same level; the list is on the subprocessors page.
Retention approach
- During the subscription: Records are kept until you delete them. Deletion is done from the panel, subject to permissions. Statutory retention periods for accounting records are your responsibility; the platform keeps those records unless you delete them.
- When the subscription ends: You get time to export, after which data is deleted from the live system. Copies in backups expire on their own when the backup retention cycle completes.
- Security and operational logs: Kept for a limited period for troubleshooting and security.
Data processing agreement
We sign a data processing agreement on request. It covers the subject and duration of processing, data categories, technical and organizational measures, subprocessor approval, cross-border transfer safeguards, breach notification, and return and deletion at the end of the contract. Send your request through the contact page.
Frequently asked questions
Do you sign a data processing agreement?
Yes. We sign a data processing agreement on request. It covers the subject and duration of processing, security measures, subprocessors, cross-border transfer, and return and deletion of data at the end of the contract. Send your request through the contact page.
What if I upload my employees' sick notes?
Health data is a special category of personal data under KVKK. As the controller you provide the legal basis and the privacy notice. We recommend restricting such documents so that only people with HR permissions can see them.
What happens to my data when the subscription ends?
When the contract ends you get time to export your data. After that period it is deleted from the live system; copies in backups disappear as the backup cycle completes.
Do you use my data for your own purposes?
No. We process tenant data only to provide the service, on your instructions. We do not use it to train AI models or for marketing.
Related
Trust Center →
Security, KVKK and GDPR, subprocessors, backups and the compliance roadmap in one place.
KVKK and GDPR →
Data subject rights, how to apply, cross-border transfer and AI processing.
Subprocessors →
Service providers, their purpose, the data they process and location; 30-day notice.
Backup →
A 6-hour database backup target, RPO and RTO targets, data export.
Human Resources →
Personnel, leave, attendance, shifts and payroll in one panel, posted to the ledger.
Request a data processing agreement
Send us your company details and we will send you the draft agreement.
Send a request