Privacy Policy

This policy covers two separate situations: data processed when you visit the sodocrm.com marketing website and our role regarding customer data handled by businesses using Sodo CRM. These involve different legal roles and are explained separately below.

Data controller

Hüseyin Ege Ermiş (Sodo CRM), Şişli Vergi Dairesi
Mehmet Akif Ersoy Mah. Etibank Cad. No:30, Kağıthane / İstanbul
Email: info@sodocrm.com

1. Marketing website visitors

In this section, we are the data controller.

Data we process

Through the demo and contact form, we process your name, email address, phone number, company name, team size and any message you provide. For technical security, your IP address is processed briefly for rate limiting.

Purpose and legal basis

We use this data to respond to your request, assess your needs and plan the proposal and setup process. The legal basis is necessity for steps taken before entering into a contract under Article 5/2(c) of the KVKK and legitimate interest under Article 5/2(f). Rate limiting is based on Article 5/2(f).

Retention period

Demo requests are retained for no more than 24 months from the request date. If a contract is established, the data becomes part of the customer record and is retained for the contract term. Security-related IP records are kept for no more than 30 days.

2. Customer data handled by businesses using Sodo CRM

In this section, the business using the software is the data controller (such as a clinic, agency or other customer). We act as a data processor within the meaning of Article 3/1(ğ) of the KVKK: we host, back up and make the data available under the business's instructions.

The terms of this relationship are governed by a data processing agreement signed with the business. As data controller, the business is responsible for providing required notices and obtaining consent from its own customers.

We access data only when required to respond to a support request or resolve a technical issue, and only to the extent necessary.

3. Where data is stored

Sodo CRM data is hosted on servers located in Istanbul, Türkiye. Databases and files are backed up daily; backups are encrypted on the server before being transferred to a storage provider in the European Union. Only we hold the encryption key, so the storage provider cannot read the backup contents.

This transfer is an international data transfer under Article 9 of the KVKK and is carried out in accordance with the conditions required by applicable law.

4. Third-party service providers

We use the providers below to operate the service. Personal data is never sold or transferred to third parties for marketing purposes.

• Server hosting — Türkiye
• Backup storage — European Union, encrypted
• Meta (Facebook/Instagram) — only for businesses using the lead form integration
• WhatsApp — only for businesses using the WhatsApp integration
• Google — only for businesses with AI reporting enabled
• Apple and Google notification services — only for users who turn on notifications in the mobile app; notification content is transmitted encrypted

5. Security measures

All connections are encrypted with TLS. Passwords are stored using non-reversible hashing. Two-factor authentication is available. Access is role-based and each company's data is isolated from others. Patient photos and message attachments cannot be accessed directly. Backups are encrypted and server access is key-based only.

6. Your rights

Under Article 11 of the KVKK and the GDPR, you may ask whether your data is processed, request information, correction, deletion or transfer, and object to processing.

You can submit your request to info@sodocrm.com. Requests will be completed within 30 days at the latest.

If you are a customer of a business using Sodo CRM, you should first direct your request to that business because it is the data controller. We provide the necessary technical assistance when requested by the business.

7. Cookies

Session and security cookies are used so that the website and the trial sign-up pages work; no consent is required for these. We use Google cookies to measure the results of our Google Ads campaigns (for example, whether a visitor from an ad opens a trial account or makes a purchase) only with your explicit consent. You give or refuse consent in the box shown on your first visit; your choice is kept for 6 months and can be changed by clearing your browser cookies. If you refuse, no cookies are set and Google only receives an aggregate measurement signal that does not identify you. Cookies are not used for ad personalisation or remarketing.

8. Data breaches

If personal data is accessed unlawfully, where we act as data controller we notify the Turkish Personal Data Protection Board as soon as possible and within 72 hours at the latest. Where we act as data processor, we inform the relevant business without delay.

9. Mobile app

The Sodo CRM app for iOS and Android provides access to a business's Sodo CRM account; data shown in the app falls under section 2 above. In addition, the app processes the following:

• Sign-in: Your company code, username and password are sent to our server only when you sign in; your password is never stored on the phone. After sign-in, the phone receives a device-specific key kept in the phone's secure storage. This key becomes invalid when you sign out, change your password or your user is deactivated.
• Notifications: If you turn on notifications, your phone's notification token (issued by Apple or Google) is stored. Notification content is encrypted with a key unique to your phone; Apple and Google cannot read it and only carry the text "You have a new notification".
• Camera, photos and microphone: Used only with your permission when you attach a photo to a lead, send a file in a chat or dictate by voice.
• Face ID, Touch ID and fingerprint: Verification happens entirely on your phone; biometric data never reaches us.
• Account deletion: You can delete your account in the app under Account > Delete my account. Your user account is deleted; customer records belonging to your business remain with the business.

The app contains no advertising, tracking or analytics tools and does not share data with third parties for marketing.

10. Changes

We may update this policy. The current version is always published on this page and the date above is revised accordingly.