Privacy notice

Scope

Desktik is a ticketing and help desk service in which companies track the support requests of their customers (bugs, suggestions, feature work, complaints) against SLA targets. This notice covers:

• the desktik.com website,
• the app.desktik.com web portal (customer portal and support team panel),
• the Desktik mobile app (Android and iOS; package name com.albiferro.ticket).

Data controller and data processor

Albiferro Software & System Limited Company (Albiferro Yazılım ve Sistem Limited Şirketi, “Albiferro”), Atakent Mah. 1472. Cad. No: 5 D: 3, Elvankent, Etimesgut / Ankara, Türkiye. Tax office Etimesgut, Ankara, tax number 0501474977, MERSİS number 0050147497700001. Registered e-mail (KEP): albiferroyazilim@hs01.kep.tr. E-mail: contact@albiferro.com.

Desktik is a business service: your account is opened by the company that gives you support or adds you to its team. The roles are therefore:

• A company that uses Desktik to support its own customers (the company you get service from or work for) is the data controller for its users’ data and tickets. Albiferro processes that data only on the company’s behalf and instructions, to provide the service; for that data Albiferro is a data processor.
• Albiferro is the data controller for the desktik.com website, its subscription and billing relationship with companies, the security of the service, and where it uses Desktik to support its own products.

If you are a user of a company, you can address your rights to that company first; if you write to us, we forward your request to the company and answer it together.

What data is processed

• Identity and contact: name, e-mail address, phone number, the company and product you belong to, your role and language. For customer users these come from the company’s own product through single sign-on (SSO); support team members are set up by the company’s administrator.
• Account and security: user ID; for team members a password (only an irreversible hash) and a two-factor (TOTP) key (encrypted); one-time sign-in codes sent by e-mail or SMS (only a hash); session keys (only a hash); the IP address and device/browser details of a session; last sign-in time.
• Ticket content: ticket title and description, replies and internal notes, priority and status, tags, people copied on a ticket (e-mail), ticket ratings (score and comment), and for tickets opened by e-mail the sender address and message.
• Attachments: photos and files you add to a ticket (up to 10 MB each). The app opens the camera or photo library only when you choose to add an attachment, with your permission, and uploads only the file you pick; it does not scan your library.
• Device push token: the token Firebase Cloud Messaging gives the app, and the platform (Android/iOS), used to send push notifications.
• Notification preferences and records: your e-mail/SMS/push preferences, and which notification was sent on which channel with what result.
• Payments and invoices: the amount and status of payments for billable work and the company details needed for the invoice. Card details are entered on PayTR’s secure payment page and never reach Desktik or Albiferro.

What we do not collect:

• No location data; the app never asks for location permission.
• No contacts, calendar, microphone or advertising ID.
• No ads, no cross-app tracking, and no analytics or crash-reporting SDKs. Your data is never sold.
• Face ID / fingerprint lock is handled entirely by your device’s operating system; no biometric data is sent to us.
• The desktik.com website only uses strictly necessary cookies (your cookie choice and Cloudflare security cookies; see the Cookie Policy) and runs no analytics; fonts are served by the site itself.

Purposes and legal grounds

• Opening your account, signing you in, receiving, assigning and answering tickets and tracking SLA targets: performance of a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
• Sending ticket updates by e-mail, SMS and push: performance of a contract. You can turn channels off in your notification preferences.
• Account security and preventing abuse and unauthorised access (sign-in limits, session records): legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)) and the duty of data security (KVKK art. 12).
• Payment, invoicing and accounting records: legal obligation (KVKK art. 5/2-ç; GDPR art. 6(1)(c)) and performance of a contract.
• Lawful requests from authorities: legal obligation.

Your data is not used for marketing, profiling or any automated decision that affects you. Smart assignment only suggests who should handle a ticket; the support team decides.

Who receives the data

Your data is shared only as far as needed to provide the service, with the following providers, who process it on our behalf under contract:

• netcup GmbH (Germany, EU): server hosting; the database, attachments and backups are kept on servers in the EU.
• Cloudflare, Inc.: domain name service (DNS), TLS encryption and attack protection; site and portal traffic passes through Cloudflare’s network.
• Google LLC (Firebase Cloud Messaging) and, on iOS, the Apple Push Notification service: push notifications; the device token and the notification’s title and short text (e.g. ticket number and title).
• Twilio SendGrid (USA): sending e-mail (sign-in codes, ticket notifications) and receiving tickets sent by e-mail.
• İleti Merkezi (Türkiye): sending SMS (sign-in codes and notifications); the phone number and message text.
• Slack: the support team’s notification channel; ticket number, title and status.
• PayTR (Türkiye): collecting payments for billable work. Paraşüt (Türkiye): issuing e-invoices.
• The company your account belongs to: its support team sees your tickets and messages.
• Competent public authorities: only where the law requires it.

Some providers (Google, Apple, Cloudflare, SendGrid, Slack) may process data outside Türkiye; such transfers are made with safeguards under KVKK art. 9. All transfers are encrypted with TLS.

How long data is kept

• Sign-in codes: valid for 10 minutes; deleted once used or expired.
• Sessions: in the web portal a customer session lasts 24 hours and a team session 12 hours; in the app an unused session ends after 90 days for customers and 30 days for team members. Expired session records (with IP and device details) are deleted regularly; signing out deletes the session at once.
• Device push token: deleted when you sign out, when the device moves to another account, or when the token becomes invalid.
• Incoming e-mails that do not become tickets are deleted after 30 days; the raw content of e-mails that do is cleared after 30 days (the ticket text stays on the ticket).
• Account details, tickets, replies, attachments and ratings: kept while your account and the company’s Desktik subscription last. The company can delete them; when the subscription ends they are deleted or anonymised after the period set in the contract. Deletion from backups happens within the normal backup rotation.
• Payment and invoice records: kept for the period required by tax and commercial law (usually 10 years).

Security

• All connections are encrypted with TLS.
• Each company’s data is kept apart from other companies’ in the database with row-level security (PostgreSQL RLS).
• Passwords, sign-in codes and session keys are stored only as hashes; two-factor keys are encrypted. Two-factor authentication is mandatory for the support team.
• The app keeps its session key in the device’s secure storage (Android Keystore / iOS Keychain).

Your rights (KVKK art. 11)

Under article 11 of the KVKK you have the right to:

• learn whether your personal data is processed,
• request information about it if it is,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties in Türkiye or abroad it is transferred to,
• have it corrected if it is incomplete or wrong,
• have it deleted or destroyed under the conditions of KVKK art. 7,
• have third parties it was transferred to informed of a correction, deletion or destruction,
• object to an outcome against you that results solely from automated analysis,
• claim compensation for damage caused by unlawful processing.

Send your request to contact@albiferro.com from the e-mail address registered on your account, by registered e-mail (KEP) to albiferroyazilim@hs01.kep.tr, or in writing to Atakent Mah. 1472. Cad. No: 5 D: 3, Elvankent, Etimesgut / Ankara, Türkiye. Requests are answered free of charge within 30 days at the latest. If you are in the EU, you can exercise your GDPR rights (access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority) the same way.

Deleting your account and data

Desktik has no self sign-up: accounts are opened and closed by the administrator of the company you belong to. To have your account or data deleted:

• ask your company’s administrator to close your account and delete your data, or
• send an e-mail with the subject “Desktik account deletion” to contact@albiferro.com from the e-mail address registered on your account. Once we have verified your identity, we close your account and delete or anonymise your personal data; where your company is the data controller, we carry out the request together with it.

Deleted: your name, e-mail, phone, sign-in and session records, device push tokens and notification preferences. Ticket correspondence, which is a business record of the company, is deleted or kept with your name removed as the company instructs; payment and invoice records are kept for the legal period.

Signing out of the app deletes the device push token from the server; uninstalling the app also deletes the session details on the device.

Children

Desktik is for business use and is not directed at anyone under 16; we do not knowingly process children’s data.

Changes

We update this notice as the service changes; the latest version is always on this page and the date above changes. We tell companies separately about significant changes.