Your data and privacy
Privacy policy
The information we process, access boundaries and the scope of account deletion.
Last updated: 13 October 2026
1. Service provider and scope
ERK is software for managing construction site, excavation, vehicle and business records on a company-by-company basis.
Service provider and data controller for ERK account/subscription services: Ercan Kılınç
Address: 75.Yıl Osb Mahallesi Teknoloji Bulvarı İş ve Ticaret Merkezi Caddesi No:6 Odunpazarı Eskişehir
Contact: destek@kilinchafriyat.com · 0555 210 33 66
Each company’s own data controller responsibilities and obligations to inform individuals also apply when it enters employee, customer, subcontractor and business records into the application. ERK enables these records to be stored as part of the software service and processed by authorised users.
2. Information processed
Account: Full name, email address, telephone number, user identifier, verification and password management information.
Permissions and invitations: Company, project, subcontractor, duty and vehicle assignments; user invitations and contact information.
Business records: Day-end records, trips, kilometres, engine hours, fuel, maintenance, income, expenses and progress-payment data; information about the person who entered or changed a record.
Information entered by the company: Personnel and business contact information, business name, tax, address or bank details.
Optional photos: Photos added to a business record using the camera or file selection.
Device and notifications: Device and platform information, session and installation identifiers, notification tokens, permission preferences and delivery logs.
Audit and local records: Transaction history, cached business data on the device, pending offline records and temporary photos.
Do not send passwords or service keys to support staff. Do not attach unnecessary personal documents or photos of unrelated people to business records.
3. Purposes, methods and conditions for processing
Information is collected electronically through account/record forms in the application, invitation/assignment actions by authorised users, optional photo selection and technical session/transaction logs.
Account verification, session, password and invitation management.
Enforcing company, project, subcontractor and vehicle access.
Field records and operation, cost, income and progress-payment reports.
Transaction tracking, security, support and error investigation.
Notifications, invitations, password recovery or report emails where those services are enabled.
Synchronising offline records when a connection becomes available.
Appropriate conditions for processing are assessed, such as entering into or performing a contract to establish/provide the service; legal obligations for actions required by law; and legitimate interests for security and error investigation, provided the individual’s rights are not harmed. A separate action requiring explicit consent is not carried out on the assumption that other conditions replace that consent.
4. Access and service providers
Each customer’s company data has a separate permission scope. Main company representatives can view their own company and linked subcontractor records within their permissions; subcontractor and field users are limited to their assigned project/vehicle scopes. The ERK platform administration account is for sales/subscriptions; it does not grant access to customer operation and finance screens.
Supabase is used for authentication, databases and photo storage; Firebase and Apple notification services for mobile notification infrastructure; and Yandex for configured email delivery. These providers may process information required for the relevant service. Information may be disclosed to competent authorities where required by law.
Cloud services may involve processing information outside Türkiye. We do not claim that data is kept only in Türkiye or that no service provider processes data. International transfer requirements and provider agreements form a separate part of the service’s legal/technical assessment.
5. Photo and notification permissions
Adding photos is optional. Camera access is used to take a photo; you can create a record without granting camera permission. File selection is also optional.
Notification permission is not required to sign in and can be changed in device settings. A feature being available in the application does not mean that automatic notifications/emails are enabled for every account or that delivery is guaranteed.
6. Retention and account deletion
In the new version, Account and Session → Delete my account asks you to give explicit confirmation by entering your own email address. If an older version shows “Request account deletion”, platform administration can complete your request with the same scope; you can also contact the support address.
Account deletion removes the sign-in account and password/verification information, the full name/telephone number in the account profile, membership links, session/device/notification information and personal attachments belonging only to that account. The sign-in account is actually deleted; this is not merely disabling access or banning it. Personal account information is detached from the relevant audit records.
The company’s business records, such as trips, fuel, expenses, collections and progress payments, are retained. The personal user link to the deleted sign-in account is removed, and the relevant record attribution is displayed as “Deleted user”. Business photos are retained as company business evidence. Account deletion is not a request to delete all company business data or independent personnel cards; requests concerning those records are assessed separately with the relevant company.
Ownership must be transferred before the last company owner’s account is removed; contact support if you cannot do this. An incomplete process is not shown as completed deletion, and platform administration can complete the same request. Company records are retained to the extent needed for business processes, applicable legal obligations or the protection of rights; the reason for retaining unnecessary personal information is assessed separately.
When deletion is successfully completed, cached data, unsent records and temporary photos for that account on this device are cleared. First synchronise any records you want to send. Providers’ backups and operational/security logs may have separate retention periods; deletion from the live system does not mean backups are deleted at the same time.
7. Your rights and requests
You have rights such as learning whether your personal data is processed, requesting information, learning the purpose of processing and whether the data is used in line with that purpose, knowing the third parties to whom it is transferred, requesting correction of incomplete/incorrect information and requesting deletion/destruction when the applicable conditions are met. Requests to notify third parties of corrections/deletion, objections to adverse results arising exclusively from automated analysis, and claims for compensation for damage caused by unlawful processing are also assessed under applicable legislation.
You can contact destek@kilinchafriyat.com. You may also send legal requests to the address above. Information necessary for secure identity verification may be requested; passwords or verification codes are not requested.
For employee/business records entered by your company, also contact the relevant company representative. This text does not replace companies’ own obligations to inform individuals or their data processing/transfer agreements.