Service Providers and Data Retention

This page complements the Personal Data Processing Notice; the purposes, legal grounds, recipients and rights are in the main text.

1. Services

AWS is used for the application, the database, file storage, CloudFront, AWS WAF and Amazon SES. The services are obtained through AWS Turkey; for transfers abroad, the Personal Data Protection Board's SS-2 standard contract has been signed with Amazon Web Services, Inc. The application, the database, file storage and SES are in Frankfurt; CloudFront edge locations may also be outside Türkiye and the EU. AWS WAF rules are managed from the global management region in the United States; a sample of the requests of the last 3 hours is kept.

Google Workspace is used for email and Google Cloud reCAPTCHA for bot checks; the Board's standard contract has been signed for Google. When sign-in with Google or LinkedIn is chosen, the name, email address, the email verification information and the account identifier at the provider are received from that provider and used to open the account, link it and sign in; the profile photo and the ID, access and refresh tokens are not stored.

Card collection is made through the Garanti BBVA virtual POS with 3D Secure. Card details go to the bank; Gloyd does not store the full card number or the security code. For a saved card, only the bank reference and the masked number are kept; the card can be removed in the panel. Gloyd issues e-documents through QNB eSolutions. The details are on the payments and documents page.

2. Retention periods

Record	Period and starting point
Contracts, orders, invoices and mandatory commercial records; the necessary acceptance and pre-information date, IP and browser data, and evidence of sending and delivering notices	10 years from the end of the calendar year concerned.
Production files and working copies	2 years from the closing of the order; the day of cancellation is the closing day. A mandatory document, or a necessary part of a concrete claim, is also kept for as long as that reason requires.
Message attachments of finished orders	Deleted within 30 days of the workspace, or the account of its last authorised member, being closed.
Account profile and personal file library	For as long as the service is used; deleted or destroyed in active systems within 30 days of the account being closed. Active sessions end on closing.
The organisation's shared file library	While the workspace is open; deleted or destroyed in active systems within 30 days of the workspace or its last authorised member being closed.
Guest session	Ends 72 hours after the last activity.
Support correspondence	3 years from the request being closed.
Security and access records; operators' access to customer identity data	2 years from creation.
Application, web server and, if enabled, CloudFront logs	30 days from creation.
Visit measurement	13 months from creation; backups for a further 30 days.
Audit of operator actions	10 years together with the records it proves; IP addresses are deleted after 2 years.
Keyed IP digest of a guest session	Deleted within 48 hours of the last activity at the latest.
Rate counters	Deleted within 48 hours of the time window closing at the latest.
KVKK applications and replies	2 years from the reply.
Records of deletion, destruction and anonymisation	At least 3 years from the operation; any longer statutory obligation is reserved.
Database restore copies	7 days.
Final copy from the previous database	Kept in AWS's restricted-access object storage in Frankfurt until 18.01.2027, then deleted.
Gloyd's sending and delivery records of the emails we send (other than the mandatory evidence of notices above)	2 years from creation.

Records needed for a concrete dispute or an ongoing statutory obligation may be kept only for that purpose and period. When the processing conditions end, they are deleted, destroyed or anonymised. Backups are not for ordinary use; on a restore, records that should have been deleted are deleted before being put back into use.

The profile and sign-in data of a closed account enter the closing process even if other members' accounts stay open. Shared order documents may be kept because of statutory retention and authorised access. The records of a supplier, bank, e-document provider or carrier acting as an independent data controller are subject to their own statutory obligations; this does not remove Gloyd's responsibility.

3. Measurement and security

Umami runs on Gloyd's server at AWS in Frankfurt; the script is loaded from stats.gloyd.com. It uses no cookies, writes nothing to the device and no raw IP address to the measurement records, and does not track users across other websites. The records are not shared beyond hosting.

Information measured: the page path with the query string removed and codes replaced by placeholders; the referring site; on the first view, if the visitor came from an allow-listed link, that link's source tag; country, region, city, language, screen, device, operating system and browser; page performance values (LCP, INP, CLS, FCP, TTFB); a one-way digest of IP and browser information renewed daily. Sign-in, registration and other account-step pages, the customer panel, administration and station pages, and browsers sending "Do Not Track" are not measured.

Data is encrypted in transit; access is limited to the people who need it for their task. Two-step verification is mandatory for operator accounts; actions and access to customer identity data are recorded. The database is protected by the provider's restore facilities.

When a personal data breach becomes known, it is notified to the Board without delay and within 72 hours at the latest, and to the people affected within the shortest reasonable time once they are identified.