Relteco ID

← Legal

Privacy Notice on the Processing of Personal Data

Version 1.4 · Effective October 28, 2026

This Privacy Notice has been prepared by Relteco Teknoloji Sanayi ve Ticaret Limited Şirketi, in its capacity as data controller, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, in respect of your personal data processed in connection with the Relteco ID service. Each application you sign in to with Relteco ID provides its own privacy notice for the personal data additionally processed in that application. This Notice is provided in Turkish and English; in the event of any inconsistency, the Turkish version shall prevail.

1. Data Controller

  • Name: Relteco Teknoloji Sanayi ve Ticaret Limited Şirketi ("Relteco")
  • Address: Maltepe Mah. Gazi Mustafa Kemal Bulvarı, Tolluoğlu No:71 İç Kapı No:48, Çankaya/Ankara, Türkiye
  • MERSIS: 0734274063100001 · Trade Registry No: Ankara 507352 · Tax Office/No: Maltepe / 7342740631
  • E-mail: info@relteco.com · Registered e-mail (KEP): relteco@hs01.kep.tr · Telephone: +90 312 232 14 81

2. Categories of Personal Data Processed

  • Identity: first name, last name; the permanent account identifier assigned to your account.
  • Contact: mobile telephone number, e-mail address.
  • Visual record: Profile picture (if you add one): the photo you upload from the Relteco ID mobile application. The photo is recreated in a square format on our servers; metadata in the file such as location, device and capture details are not kept. The profile picture is not processed for facial recognition or by biometric means.
  • Customer transaction: the Relteco applications to which your account is linked; the date the account was created; records of the acceptance of the Terms of Use (version accepted, date and time, IP address, browser information, application through which it was recorded); the verification status of the e-mail address and records of verification links; telephone number change requests together with the previous and new numbers; account deletion requests, the scheduled deletion date and the outcome of the deletion process.
  • Transaction security: IP address; sign-in, failed sign-in and session records (date, time, application signed in to); session and device information; hash values of verification codes; counters of code deliveries and attempts kept to prevent misuse; where you add them, data on your second verification methods (the public key of passkeys, the secret key of the authenticator application, hash values of recovery codes, the names of these methods and the dates they were added) and hash values of the random values used to recognise devices you verified with a second method; records of account recovery requests (the telephone number given and the new number, the e-mail address the link was sent to, IP address, date and time).
  • Business account data (only for users who open a business account or join a business team): business name, trade name, type of enterprise, tax office, tax identification number, MERSIS number, invoicing address and invoicing e-mail address; your role in the team; records of invitations, joining, role changes, leaving and transfers of ownership; records of the acceptance of the Business Account Terms on behalf of the business (version accepted, date and time, IP address, browser information). For sole proprietorships and self-employed professionals, these data constitute personal data of the natural person who owns the business.

Relteco ID does not process Turkish identity numbers, dates of birth, gender, location, passwords or special categories of personal data.

3. Purposes of Processing

  • creating the Relteco ID account, verifying the telephone number and providing secure access to the account;
  • recording and proving the acceptance of the Terms of Use;
  • verifying that the e-mail address belongs to you;
  • enabling sign-in to Relteco applications with a common account and conveying identity information to the applications;
  • carrying out telephone number changes, account deletion and application-specific account deletion, and notifying the linked applications of these processes;
  • creating business accounts, managing team memberships, roles and invitations, and conveying this information to the applications;
  • conducting information security processes; preventing unauthorised access, fraud and misuse of verification code deliveries;
  • notifying you of security-relevant changes to your account (for example, a telephone number change);
  • fulfilling legal obligations, responding to requests from competent public authorities and protecting rights in potential disputes.

4. Method and Legal Grounds of Collection

Your personal data are collected electronically and by automated means, by being entered by you on the Relteco ID sign-in and account screens at id.relteco.com and within the applications, and by being generated by our systems during your use of the service. The telephone number of a person invited to a business team is provided by the inviting user.

Your personal data are processed on the following legal grounds set out in Article 5(2) of KVKK:

  • Processing is directly related to the conclusion or performance of a contract (Art. 5(2)(c)): creation, verification and use of the account; verification of the e-mail address; sign-in to the applications; telephone number change, account deletion and business account processes.
  • Processing is necessary for compliance with a legal obligation of the data controller (Art. 5(2)(ç)): the data security obligation under Article 12 of KVKK and requests from competent authorities.
  • Processing is necessary for the establishment, exercise or protection of a right (Art. 5(2)(e)): retention of records of the acceptance of the Terms of Use and of deletion, telephone number change and business operations as evidence in potential disputes.
  • Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5(2)(f)): keeping security records, preventing misuse, sending security notices and delivering an invitation to a person invited to a business team.

No processing based on explicit consent is carried out in connection with Relteco ID, and no commercial electronic messages are sent.

5. Transfer of Personal Data

  • Relteco applications: when you sign in, your account identifier, first name, last name, e-mail address, telephone number, the address of your profile picture if you added one, and your business memberships and roles are conveyed to the Relteco applications you sign in to with Relteco ID. In the account deletion and telephone number change processes, your account identifier and telephone number (and, in the case of a number change, your previous number) are notified to the linked applications. These applications process your data in accordance with their own privacy notices.
  • Business team members: when you are a member of a business team, your first and last name are visible to the team members and your telephone number to the owner and administrators of the business. In a business invitation, the short message sent to the invitee contains the name of the inviting user.
  • Service providers (domestic): your telephone number and the message content are transferred to the SMS service provider (Netgsm) for the delivery of verification codes, invitations and security notices as short messages, and to a hosting provider established in Türkiye for the provision of the server infrastructure. E-mails are sent through Relteco's own e-mail server.
  • Competent public authorities: upon request by legally authorised authorities and to the extent required by legislation.

Personal data processed in connection with Relteco ID are not transferred abroad.

6. Retention Periods

  • Account data (first name, last name, telephone number, e-mail address, profile picture, linked applications) are processed for as long as your account exists; you may remove your profile picture at any time, and a removed picture is deleted at once; upon a deletion request they are deleted at the end of the thirty (30) day waiting period.
  • Verification codes are kept only as hash values and become unusable at the end of their validity period (5 minutes for sign-in codes, 10 minutes for number change codes). Counters of code deliveries and attempts kept to prevent misuse are deleted after one (1) hour.
  • Browser sessions end after at most ten (10) hours; application sessions end when unused for thirty (30) days and in any case after at most one hundred and eighty (180) days.
  • Sign-in and security event records are retained for ninety (90) days.
  • Second verification methods and records of verified devices are retained until you remove them or your account is deleted; at most twenty (20) devices are kept per account, older ones being deleted.
  • Account recovery requests that match no account or are not completed are retained for two (2) days; requests that proceed are retained for ten (10) years from the date of the operation, for use as evidence in possible disputes.
  • Records of the acceptance of the Terms of Use are retained for ten (10) years after the end of the contractual relationship, for use as evidence in potential disputes.
  • Records of e-mail verification links are deleted within thirty (30) days after the link's validity period (7 days) ends.
  • Records of telephone number changes, account deletions and the notification of these operations to the applications are retained for ten (10) years from the date of the operation, for use as evidence in potential disputes.
  • Business account records, their history and records of the acceptance of the Business Account Terms are retained for as long as the business account is open and for ten (10) years after it is closed.

Personal data whose retention period has expired are deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

7. Rights of the Data Subject

Under Article 11 of KVKK, you have the right to learn whether your personal data are processed; to request information if they have been processed; to learn the purpose of processing and whether they are used in accordance with that purpose; to know the third parties to whom they are transferred domestically or abroad; to request their rectification if they are incomplete or inaccurate; to request their erasure or destruction under the conditions set out in Article 7 of KVKK; to request that rectification, erasure and destruction be notified to third parties to whom the data were transferred; to object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems; and to claim compensation for damage suffered as a result of unlawful processing.

You may change your telephone number, request a new e-mail verification link and delete your account directly on id.relteco.com. You may submit your other requests, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the address above, to the registered e-mail address relteco@hs01.kep.tr, with a secure electronic signature or mobile signature, or from the e-mail address registered on your Relteco ID account to info@relteco.com. Your application must contain your first and last name, your signature if the application is in writing, your Turkish identity number (for foreign nationals, nationality and passport or identity number), your address for notification, your e-mail address for notification (if any), your telephone number and the subject of your request. Applications must be submitted in Turkish. Applications are concluded free of charge as soon as possible according to the nature of the request and at the latest within thirty (30) days; where the operation requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.