Privacy Policy
Pilot release. Mizar runs in Dubai as a pilot with partner companies. Accounts and trade records are real and persistent; verification codes, payments, credit packs, e-signature certification and licence lookups are simulated and labelled Demo. No card number is stored and no real money moves.
1. Who we are and how to reach us
The data controller is Erway Yazılım ("Erway", "we"), Türkiye. E-mail: iletisim@erway.com.tr. Postal address: TODO(Ali): registered address.
Mizar is a business application. Your employer (the buyer, seller or wholesaler company that invited you) decides which of its staff use the app and in which role; for the data your company enters about itself and its staff, the company is the controller and Erway processes it on the company's behalf.
2. Data we process, and why
| Data | Why | Legal basis |
|---|---|---|
| Account: phone number, name, job title, role (buyer, seller, field staff, Mizar team), language | Sign-in with a one-time code, showing who sent a request, an offer or a signature | Performance of the contract; KVKK art. 5/2(c) |
| Company: name, country, sector, trade licence number and licence document photo, address, users | Seller verification before a profile is shown to buyers; delivery addresses | Contract; legal obligation for licence checks |
| Trade records: requests, offers, orders, e-signatures (drawn signature image, PDF summary, hash, time and IP of signing), deliveries, invoices, credits, disputes and dispute messages | The service itself: a record both sides and the Mizar team can rely on | Contract; legitimate interest in keeping evidence of a deal |
| Field work (field staff only): shift start and end, planned route, visits, visit notes and photos, day note, loyalty points, working score | The seller plans and follows its field team's day | Employer's contract with Erway; employment relationship between you and your employer |
| Location (field staff only): position about once a minute, only while your own shift switch is on and the app is open | Live map and route for your manager; stop-time summaries | Written consent collected by your employer and the switch you control; see section 3 |
| Photos: visit proof, delivery proof, dispute evidence, trade licence | Evidence attached to a visit, a delivery or a dispute | Contract |
| Device: install identifier, push notification token, app and system version, IP address in server logs | Keeping you signed in on this device, sending notifications, security and abuse prevention | Legitimate interest; contract |
We do not process: e-mail addresses, contacts, microphone, calendar, health data, card numbers (the demo card form sends only the result and the last four digits), advertising identifiers, browsing history, background location.
3. Location of field staff
- Location is requested only in the field staff role, only when you turn your shift switch on, and only with the "While Using the App" permission. There is no background tracking: when the app is not open, nothing is sent.
- Your position is visible to the managers of your own employer in the app (live map, route, stop summaries) and to the Mizar team for support. It is never shown to buyers or other companies.
- Turn the switch off at any time; sharing stops at once. Denying the permission keeps everything else in the app working.
- Your employer collects your written consent before enabling the field role. Summaries use neutral wording ("Stopped 25 min, no visit recorded").
- Location points are kept for 90 days, then deleted; day summaries (durations, distance) stay with the day note.
4. Providers that process data for us
| Provider | What for | Where |
|---|---|---|
| Our own server (Erway) | The Mizar service and database; daily backups | Türkiye |
| Expo Push Service (Expo, Inc.) | Delivering push notifications to Apple and Google | United States |
| Apple Maps (iOS), Google Maps (Android) | Map tiles on map screens; the map area you view | Apple / Google |
No advertising, analytics or crash-reporting service is used in this release. Payments, SMS codes and licence lookups are simulated locally; no payment or SMS provider receives data. When the service goes live, a licensed payment service provider will process payments and this policy will be updated before the change.
5. International transfers
Data is stored in Türkiye. If you use Mizar from the United Arab Emirates or another country, your data is transferred to Türkiye; push notifications pass through Expo in the United States. We rely on your explicit consent given at sign-up (KVKK art. 9) and, for the UAE, on the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) rules on transfers with adequate safeguards and consent.
6. Retention
- Account and company data: while the account exists; 30 days after deletion the account is anonymised (section 8).
- Trade records (orders, invoices, signatures): while the account exists and, where law requires, for the statutory period in anonymised form.
- Location points: 90 days. Photos: with the visit, delivery or dispute they belong to. Server logs: 14 days. Backups: 30 days.
- During the pilot the Mizar team may reset demo data; your own records are not reset without notice.
7. Your rights
You can ask what we hold about you, correct it, have it deleted, object to processing or ask for a copy. Under KVKK art. 11 and the UAE PDPL you also have the right to complain to the supervisory authority (Türkiye: KVKK Board; UAE: the UAE Data Office). Write to iletisim@erway.com.tr from the phone number on your account or with your account phone number; we answer within 30 days. Data your company entered about itself is handled through your company.
8. Deleting your account
Account → Delete account, or by e-mail. Sessions end at once; after 30 days the account is permanently anonymised. Orders, invoices and signatures that a company needs as evidence stay with the company's records without your name. Details: Delete your account.
9. Children
Mizar is for business users aged 18 or over. We do not knowingly process data of anyone under 18.
10. Security
All traffic uses HTTPS. Sessions use short-lived tokens bound to the device. The server is access-restricted and backed up daily. Only the Mizar team can read licence documents and dispute evidence, and only to do its work.
11. Changes
We will post changes on this page with a new effective date and, for material changes, tell you in the app before they apply.
12. KVKK notice (summary)
Under the Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is Erway Yazılım. Data listed in section 2 is processed for the purposes and on the legal bases stated there, collected through the app and transferred to the providers in section 4; cross-border transfers rely on your explicit consent (art. 9). You may exercise your rights under art. 11 by writing to iletisim@erway.com.tr. The same rights are honoured for users in the UAE under the PDPL.