1. Data controller and roles
The data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) for the prientehub.com website, Priente Push Relay and customer relations (sales, billing and support correspondence) is PRIENTE SOFTWARE YAZILIM ANONİM ŞİRKETİ, a joint-stock company incorporated in Türkiye. Priente Hub is a brand and product of Priente Software; in this policy, "Priente", "we" and "us" refer to this company.
- Legal name: PRIENTE SOFTWARE YAZILIM ANONİM ŞİRKETİ
- Address: Ahi Evran OSB Mah. Erkunt Cad. Teknopark No: 3 İç Kapı No: 4, Sincan / Ankara, Türkiye
- Trade registry: Ankara Trade Registry (Ankara Chamber of Commerce / Ankara Ticaret Odası), Trade Registry No: 511729 (Chamber Registration No: 2073597)
- MERSİS No (Central Registration System number): 0733122921400001
- Issued share capital: TRY 13,210,000.00
- Email: [email protected]
Priente Hub is an organisational workspace, and accounts are created by organisations (your employer, your school or an organisation of which you are a member). Accordingly:
- On Priente Cloud: your organisation is the data controller for the content and account data of its users; Priente is a data processor acting under its contract with your organisation and on your organisation's instructions.
- In on-premise and internet-isolated (air-gapped) installations: Priente Hub runs on your organisation's own servers and your organisation is the sole data controller. Priente does not access or process this data.
If your account is managed by an organisation, we recommend that you first direct any requests concerning your data to your organisation's system administrator. We forward requests we receive to the relevant organisation and provide it with the necessary support.
2. Data we process
We process the data necessary to provide the service:
- Account and identity information: first name, surname, email address, username, job title, department, profile photo, password hash (the password itself is not stored), two-factor authentication and passkey information, and roles and permissions within the organisation.
- Content you create: emails and attachments, chat messages, files, calendar events, contacts, tasks, notes, and form and approval workflow records. This content is processed solely to provide the service to you and to the people you share it with.
- Meeting and call data: audio, video and screen sharing are processed in real time during transmission and are not recorded. Recording or AI transcription takes place only when your organisation enables this feature, and with a notice shown to meeting participants.
- Device and notification information: device type, operating system and app version, notification tokens (push tokens) issued by Apple (APNs) and Google (Firebase Cloud Messaging), and your notification preferences.
- Logs: sign-in time, IP address, browser or app information, security events and audit logs. These logs are kept for security, troubleshooting and legal compliance purposes.
- Crash information: our apps do not contain any third-party crash reporting or analytics SDK. If you have chosen to share this on your device, Apple or Google may send us anonymous crash reports via the App Store and Google Play.
- Support and communication: when you write to us, your email address, your name and the content of the correspondence.
The mobile app requests camera, microphone, photo library, notification and local network permissions only when you use the relevant feature (video calls, voice messages, adding attachments, scanning QR codes, connecting to an on-premise server). Face ID / fingerprint authentication takes place entirely on your device; we do not have access to biometric data.
Our website does not use cookies. We store only your selected language in your browser's local storage.
3. Purposes of processing
- To create your account, verify your identity and provide secure access to the service.
- To operate email, chat, meetings, calendar, files, tasks and approval workflows, and to deliver and synchronise messages.
- To send notifications for events such as new messages, calls and meetings.
- To keep the service secure, and to detect and prevent abuse, unauthorised access, spam and malware.
- To fix errors, plan capacity and ensure continuity of the service (backup and disaster recovery).
- To respond to your support requests and to send notices arising from the contract.
- To comply with legal obligations and to respond to lawful requests from competent authorities.
We do not use your data for advertising, profiling or marketing purposes, and we do not use it to train artificial intelligence models.
4. Legal bases
We process your data under KVKK Art. 5 and GDPR Art. 6 on the following legal bases:
- Conclusion and performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)): providing the service, account management, notifications.
- Legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)): retention of logs, requests from competent authorities.
- Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)): security, prevention of abuse and improvement of the service, provided that this does not harm your fundamental rights and freedoms.
- Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)).
- Explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)): only where none of the above applies; you may withdraw your consent at any time.
For data processed on Priente Cloud on behalf of your organisation, the legal basis is determined by your organisation.
5. Push notifications
Mobile notifications are delivered via the Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM). Your organisation's Priente Hub server sends the notification to Priente Push Relay, and the Relay forwards it to Apple or Google.
- Notification content (sender, subject, message preview) is end-to-end encrypted: it is decrypted on your device, using a key held only on your device. Priente Push Relay, Apple and Google cannot read this content.
- The Relay processes only the technical data required for delivery: the notification token, the identity of the organisation's server, the platform and a timestamp. This data is not used for any purpose other than delivering notifications and preventing abuse.
- Your organisation may choose content-free notifications or may not use the Relay at all.
You can turn off notifications at any time in your device settings or in the notification preferences within the app.
7. International transfers
Priente Cloud data is hosted in data centres selected by Priente. Some service providers, such as those providing notification delivery (Apple, Google) and network security services, may be located abroad.
Where an international transfer is required, we apply the safeguards provided for under KVKK Art. 9 and Chapter V of the GDPR (adequacy decisions, standard contracts and the required notifications). Because notification content is end-to-end encrypted, it is not transferred to these providers.
In on-premise and air-gapped installations, data remains in the location determined by your organisation.
8. Retention periods
- Account and content data: retained for as long as your account is active and in accordance with your organisation's retention policies.
- After account deletion: data is deleted from live systems within 30 days at the latest, and permanently removed from encrypted backups within the backup cycle, within 90 days at the latest.
- Security and access logs: for the period required by law (e.g. for traffic logs under Law No. 5651) and for no longer than 2 years.
- Notification tokens: deleted when you sign out, uninstall the app or the token becomes invalid.
- Support correspondence and contract/invoice records: for the applicable statutory retention periods (e.g. up to 10 years under tax legislation).
Data whose retention period has expired is deleted, destroyed or anonymised.
9. Security
We apply appropriate technical and organisational measures to protect your data:
- TLS encryption in transit; envelope encryption at rest and encrypted backups.
- Optional end-to-end encryption for emails with S/MIME and OpenPGP; end-to-end encrypted notifications.
- Two-factor authentication, passkeys, number-matching sign-in approval and session management.
- Role-based access, the principle of least privilege, audit logs and confidentiality obligations for staff.
- Regular updates, security testing, monitoring and regular restore drills.
No system is entirely free of risk. In the event of a data breach, we will notify the relevant organisation, the competent authority and, where required, you, within the time limits laid down by KVKK and the GDPR.
10. Children
Priente Hub is designed for organisational use and is not directed at children. We do not knowingly collect data from persons under the age of 16. Where organisations such as educational institutions create accounts for minors, the organisation, as data controller, is responsible for obtaining the necessary permissions.
11. Your rights
Under KVKK Art. 11, you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties in Türkiye or abroad to whom it has been transferred; request rectification if it has been processed incompletely or inaccurately; request its erasure or destruction within the framework of KVKK Art. 7; request that these actions be notified to the third parties to whom the data has been transferred; object to an outcome against you resulting from analysis exclusively by automated systems; and claim compensation for damage suffered as a result of unlawful processing.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent (GDPR Arts. 15–22).
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your requests under KVKK Art. 11 in writing, together with information that allows us to verify your identity, to PRIENTE SOFTWARE YAZILIM ANONİM ŞİRKETİ, Ahi Evran OSB Mah. Erkunt Cad. Teknopark No: 3 İç Kapı No: 4, Sincan / Ankara, Türkiye, by hand or by post, or by email to [email protected] from the email address registered to your account or previously provided to us. Please state your name, surname, contact details and the subject of your request. We respond to requests free of charge within 30 days at the latest. We may ask for additional information to verify your identity.
If you are not satisfied with our response, you may lodge a complaint with the Turkish Personal Data Protection Board or with the data protection authority in your country.
12. Contact
For any questions about this policy or your personal data: PRIENTE SOFTWARE YAZILIM ANONİM ŞİRKETİ, Ahi Evran OSB Mah. Erkunt Cad. Teknopark No: 3 İç Kapı No: 4, Sincan / Ankara, Türkiye; email: [email protected].
For account deletion requests, see the Account & data deletion page: prientehub.com/en/data-deletion/
13. Changes
We may update this policy to reflect changes to the service or to the law. The current version is always published on this page, and the date at the top of the page changes accordingly. We will also announce significant changes separately within the app or by email.