Personal Data Protection Privacy Notice and Privacy Policy

1. Data controller

Digital Bridge Teknoloji LTD. ŞTİ.
Tax ID: 2951276256 — Tax Office: Ziyapaşa
Address: Cemalpaşa Mah. 63008 Sok. M. Karabucak İş Merkezi Bina No: 4, 1. Asma Kat No: 105, Seyhan/ADANA, Türkiye
Email: [email protected]

2. Personal data we process

• Contact form: name, company, email, phone, message content; IP address and browser information for security purposes.
• Registration form: the organization and administrator details you enter during registration; the IP address and browser information of registration attempts, to prevent abuse. Details of a registration whose payment is not completed are held without an account being created.
• Purchase and customer record: full name or company title, email, phone, invoice address, tax ID/national ID number (for invoicing), order and payment status. Your card details are processed by the payment provider; they do not reach us and are not stored.
• Account users: username, full name, email, password hash (the password itself is not stored), role and permissions, session and sign-in logs (date, IP, device), activity logs.
• Product content: emails and attachments in SmartMail, files in SmartFiles, chats with our customer's website visitors in SmartOperator, and our customer's access control and staff attendance records in SmartPass (details below). For this content, our customer (your organization, the owner of the site you visit, or the organization where you work or that you visit) is the data controller, and we act on its behalf as the data processor; we process the content only to provide the service.
• SmartOperator visitors: chat messages; the page the visitor is on and the pages browsed during the conversation (payment pages are not recorded); IP address and the country derived from it; browser and device information (browser ID, language, screen size, time zone) and the address from which the site was reached; the full name, phone and email the visitor leaves for follow-up; if the site identifies the visitor as a signed-in user, the display name or email the site passes on. Information entered in form fields (such as passwords, cards, ID numbers) and keystrokes are not read.
• SmartPass people (our customer's staff, subcontractor employees and visitors): full name, employee number, department and company; title, email, phone, hire date and date of birth, vehicle plate, emergency contact, address, note and photo, if optionally entered by our customer; an organization-specific, irreversible hash of the card number (the raw card number is not stored); access events (time, access point, decision); shift and timesheet records; visit records (planned time, host, purpose of visit, entry and exit time); canteen usage. SmartPass does not process biometric data such as fingerprints or face data.
• Partners (reseller and distributor organizations): the organization's title, tax ID, address and bank account (IBAN, for commission payments); the full name, email, role, two-step verification and sign-in logs of the organization's employees; commission, bonus, invoice and payment records.
• Site usage: technical access logs (IP, time, requested address). If you consent, statistics on how the site is used (see Section 7). We do not use advertising cookies.

3. Purposes of processing and legal bases

• Establishment and performance of the contract: account creation, provision of the service, support (KVKK Art. 5/2-c).
• Legal obligations: invoicing, accounting and statutory retention; requests from competent authorities (Art. 5/2-ç).
• Legitimate interest: service security, prevention of abuse and attacks, bot protection, error and performance monitoring (Art. 5/2-f).
• Responding to your enquiries (Art. 5/2-c and 5/2-f).
• Performance of the partnership agreement: calculation of commission and bonus, commission payments (Art. 5/2-c); tax and accounting records (Art. 5/2-ç).
• Site usage statistics: only with your explicit consent (Art. 5/1). You can withdraw your consent at any time via the "Cookie preferences" link at the bottom of the page.

4. Transfers

Your personal data may be transferred only to the extent necessary to provide the service and for the following purposes:

• Payment provider: to collect payment.
• Public authorities: the Revenue Administration's e-Invoice system, for issuing e-Invoices; and authorised public authorities where required by law.
• Our partner: if one of our partners (a reseller or distributor) sold you the service, that partner and the parent organisations it is affiliated with can see your customer record (organisation name, contact details) and a summary of your orders, so that they can provide you with sales and support (Art. 5/2-c). They cannot access your product content (email, files, chat).
• On our customer's instructions: timesheets locked in SmartPass are transferred to our customer's own ERP system; visit notifications are sent to the email address of the responsible staff member.
• Technology providers: providers from whom we obtain services for domain name resolution, content delivery and bot protection.
• AI: to operate AI-powered features (document summaries, email analysis, chat and SmartOperator's conversations with visitors), content is sent to the models of AI service providers, limited to what the relevant feature needs to work (the document, email or chat text being processed). SmartPass does not use AI; SmartPass data is not sent to AI models.
• Analytics provider: for website usage statistics, only if you give your consent.

Some of these providers are located abroad; transfers are made in accordance with Article 9 of the KVKK.

5. Collection method

Your data is collected automatically by electronic means, through the forms on our websites, the checkout screen, the products themselves (web and mobile apps), the chat window that SmartOperator adds to our customers' websites, SmartPass card readers and terminals, and server logs.

6. Retention periods

• Order, invoice and payment records: for the period required by the applicable tax and commercial legislation (10 years).
• Contact form messages: 2 years.
• Registration form details and registration attempt records (including registrations where payment was not completed): 2 years.
• Login and access logs: 2 years.
• Partner commission, bonus, invoice and payment records: for the period required by the applicable tax and commercial legislation (10 years). Accounts of partner employees: until they are removed from the organisation.
• Your cookie preference: 12 months in your browser; you will be asked again when it expires.
• SmartOperator chats and visitor information: the period chosen by our customer who owns the website (between 7 days and 10 years); expired records, together with their notes and callback requests, are deleted automatically every day.
• SmartPass access, canteen and visit records: at the end of the period chosen by our customer, the personal fields in the records are anonymised (counts are retained); for a person whose period has expired and who has no active relationship remaining, additional information and the photo are deleted.
• Product content: for the duration of the contract; permanently deleted once the service ends and the account is deleted. Copies on the mail server are deleted after a set period according to your organisation's settings; the archive copy is retained for as long as your account continues.

7. Cookies and browser storage

Essential cookies do not require consent: your session information, preferences such as theme and language, your cookie preference itself, and the signed cookie that lets the SmartOperator chat window recognise a visitor.

Analytics cookies are loaded only if you select "Accept" in the banner that appears on our websites; if you decline, they are never loaded and any previously written ones are deleted. You can change your preference at any time using the "Cookie preferences" link at the bottom of every page. We do not use advertising or targeting cookies.

8. Mobile apps (SmartMail, SmartFiles, SmartPass mobile terminal)

Our mobile apps use the same account and the same servers as the web dashboards; we do not collect any additional data for mobile. The data the apps process:

• Account information: your DBLinx account (email address, name) for signing in. The session key is kept in the device's secure storage.
• Content: the emails in your mailbox and your SmartFiles files are processed on our servers; a temporary cache may be kept on the device for faster loading; the cache is also deleted when you uninstall the app.
• Notification token: the device's notification token (belonging to the Android and iOS notification services) is stored solely to be able to send notifications.
• Files you select: files, photos or documents you scan with the camera are uploaded only at your request. The camera and gallery are accessed only when you start an action.

SmartPass mobile terminal: an enterprise app that turns an NFC-enabled Android phone authorised by organisations into an access point, and is provided directly to organisations as an installation file (APK). The phone applies with a DBLinx account and the organisation administrator approves it; a digest of the scanned card and access events are sent to the organisation's SmartPass records.

The apps contain no third-party analytics, advertising or error-logging tools: none; your data is not sold or shared for advertising purposes. All transfers are encrypted with HTTPS.

Account and data deletion: you can request the deletion of your account and data using the deletion request on the support page or by writing to [email protected] . For company accounts, your company's administrator can also carry out the deletion from the DBLinx organisation dashboard (how to); your name, contact details and password in your DBLinx account are deleted and your account is closed across all products, your person details in SmartPass are anonymised and your card is cancelled, your AI chats in SmartFiles are deleted and your sharing links are closed (the organisation's files remain with the organisation); security and invoice records are retained under an anonymous identity for the legally required period.

9. Your rights

Under Article 11 of the KVKK, you have the right to: find out whether your data is being processed; request information if it has been processed; learn the purpose of processing and whether it is used in line with that purpose; know the third parties to whom it has been transferred; request correction if it is incomplete or inaccurate; request deletion or destruction where the conditions are met, and have these actions notified to the parties to whom the data was transferred; object to an outcome against you resulting from analysis exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.

You can submit your request [email protected] in writing to or to the address above. We will conclude your request free of charge within 30 days at the latest.

Last updated: 13.10.2026. When we change this text, we will publish the current version on this page.