Privacy Policy

Pre-Content: Legal Side Nav

Data We Collect

We collect three categories of personal data:

• Account data: name, email, company, role, password hash
• Usage data: log-in times, pages visited, features used, IP region (anonymised)
• Communications: support tickets, demo requests, sales emails

DPPskop's product analytics is privacy-first: no cookies, no IP storage, no cross-site tracking. See the Analytics page for technical details.

How We Use Data

• Service delivery: Provide the DPPskop platform under our customer contract
• Support: Respond to questions, troubleshoot issues
• Improvement: Analyse aggregate usage to improve features (no individual profiling)
• Security: Detect and prevent unauthorised access
• Communication: Service notifications, security alerts, contractual updates
• Marketing: Only with explicit opt-in; one-click unsubscribe
• Compliance: Meet our own ESPR, GDPR, KVKK obligations

Your Rights (GDPR + KVKK)

Under GDPR and KVKK, you have the following rights regarding your personal data:

• Access (GDPR Art. 15 / KVKK Art. 11): Request a copy of your data
• Rectification (Art. 16): Correct inaccurate data
• Erasure / Right to be Forgotten (Art. 17): Request deletion
• Restriction (Art. 18): Limit processing
• Portability (Art. 20): Export your data in machine-readable format
• Objection (Art. 21): Opt out of legitimate-interest processing
• Automated decision-making (Art. 22): Right to human review
• Withdraw consent: Where consent is the basis, withdraw at any time
• Lodge a complaint: With your supervisory authority (e.g., your country's DPA)

To exercise any of these rights, contact our DPO at [email protected]. We respond within 30 days.

Data Retention & Sharing

We retain personal data only as long as necessary:

• Active accounts: For the duration of the customer relationship
• After termination: Deletion within 30 days, with cryptographic verification
• Audit logs: 7 years (compliance requirement)
• Backups: Encrypted, 90-day rolling retention

We do not sell or rent personal data. We share data only with:

• Sub-processors necessary for service delivery (AWS, Stripe, SendGrid) — all GDPR-compliant
• Authorities, only when legally required (court order, regulatory request)