Gizlilik Politikası

Scope

This document applies to the Bordrola web application and the Bordrola mobile application (iOS/Android).

It has been prepared in accordance with Apple App Store Guidelines 5.1.1 / 5.1.2 and the Turkish Personal Data Protection Law No. 6698 (KVKK).

Effective date: 19 August 2026. Last updated: 19 August 2026.

1. Data controller

Bordrola is a human resources, payroll distribution and time & attendance (PDKS) software operated by Pixs Yazılım ve Ticaret A.Ş.

• Data controller: Pixs Yazılım ve Ticaret A.Ş.
• Contact / data protection requests: [email protected]
• Address: Pelitli Mah. Rize Cad. Toki İş Yerleri B Blok No: 26K, Ortahisar / Trabzon, Türkiye

Bordrola provides its service to corporate customers (employers). In most cases the employer is the data controller and Bordrola acts as a data processor on the employer's behalf.

2. What data do we collect?

Depending on the modules in use and the actions you take in the app, the following categories of data may be processed:

• Account and identity data: Full name, national ID number, phone number, email address, username, password (stored encrypted), job title, department, branch.
• Employment and payroll data: Salary and payroll line items (gross/net amounts, deductions, tax base, social security contributions), leave and absence records, work calendar, personnel records, bank IBAN details.
• Time & attendance (PDKS) data: Clock-in/clock-out records, working hours; location data at the moment of clock-in/clock-out only, device information and an optional verification photo.
• Documents and images: Uploaded employment documents, medical reports and expense/receipt images (from the camera or gallery, chosen by the user).
• Device and technical data: Device model, operating system version, app version, device identifier (used for trusted-device pairing), IP address, push notification token.
• Usage and analytics data: In-app usage statistics (feature usage, error logs).

Usage and analytics data is not used for advertising or cross-app tracking.

Data is collected from the information you submit directly through the app, forms or support channels; from the payroll and personnel records your employer (our corporate customer) uploads to the system; and from technical records generated automatically while the service is delivered.

3. How and why do we process data?

The purpose, scope and legal basis under KVKK for each processing activity are as follows:

4. AI-assisted features (Bordi)

Bordrola offers AI-assisted features that we call "Bordi" in order to simplify the user experience. This section explains what data these features process, how it is processed, and who it is shared with.

4.1 What data is processed?

The AI features process only the following data, and only when you choose to use the relevant feature:

• Payroll Summary: The payroll data of the requesting employee for the relevant month (gross/net amounts and deduction line items). The employee's name and identity fields are pseudonymized before processing; the name never leaves our servers for this operation.
• Receipt/Expense Reading (OCR): A receipt or invoice image that the user chooses to upload, processed in order to read the fields it contains.

4.2 Who is the data sent to?

This data is sent only to Bordrola servers, and processing is carried out on Bordrola infrastructure. Where AI computation is required, the following third-party AI infrastructure providers are used solely as data processors (sub-processors), under data processing agreements that require an equal level of protection:

• OpenAI (OpenAI, L.L.C.) — language model and image reading (receipt/expense) services
• OpenRouter (OpenRouter, Inc.) — language model access infrastructure

These providers do not use the data for their own purposes and do not retain it for model training. Zero data retention is enabled, so the data is not stored by these providers.

The employee's name and identity fields are never transmitted to these providers; they are pseudonymized on our servers before processing.

4.3 Explicit consent

The AI features run only after the user has given explicit consent. Before the relevant feature is used for the first time, a consent screen is shown that explains what data will be processed and where it will be sent. No data is transmitted for AI processing until the user accepts.

Consent can be withdrawn at any time from the Settings section of the app; once withdrawn, the AI features are disabled while all other features continue to work.

The employer's administrator can also view and reset employees' AI consent from the management panel.

4.4 Retention

The generated payroll summary text is stored encrypted and linked to the account in order to avoid repeated processing, and can be viewed only by the relevant employee and authorized HR personnel.

5. Device permissions and why we request them

The permissions below are requested only when the relevant feature is used, through the operating system's own permission dialog. You can continue to use the other parts of the app even if you decline them.

• Location: Used only during a clock-in/clock-out action, to verify that you are at the correct branch location. Bordrola does not track your location continuously in the background.
• Camera: Used only to photograph an expense/receipt and for the optional attendance verification selfie.
• Photos / Gallery: Used only to upload an expense or document image selected by the user.
• Notifications: Used for payroll publication, approval and reminder notifications.

Bordrola does not perform advertising tracking and does not carry out cross-app tracking under App Tracking Transparency (ATT).

6. Who do we share data with? (Sub-processors)

Bordrola does not sell your data. In order to deliver the service, the following service providers are used as data processors, limited to what is necessary:

All providers are contractually bound to provide an equal level of data protection. Data may be shared with competent public authorities where legally required.

7. Data retention and security

Data is retained for as long as the service requires and for the periods prescribed by applicable legislation; once those periods expire it is deleted or anonymized.

Bordrola applies technical and administrative measures such as encryption, access authorization, audit logging, secure file links and device verification. Payslips are protected with a one-time code (OTP) and a time stamp.

8. Your rights under KVKK

Under Article 11 of Law No. 6698 you have the right to learn whether your data is being processed, to request information about it, to request its correction or deletion, to object to the processing, and to claim compensation for damages.

You can submit your requests to [email protected]. (If you are an employee, your employer may be the data controller for some of your requests.)

9. Children's privacy

Bordrola is a corporate employee application and is not intended for users under the age of 18.

10. Changes

This policy may be updated from time to time. Material changes will be announced in the app and on this page. The current version is always published at this address.

11. Contact

For questions: [email protected] — https://bordrola.com.tr