Çiftçi AI — Personal Data Processing Notice (KVKK)

Data controller: HNK Tech

Application: Çiftçi AI (com.ciftciai.app)

Effective date: 14.08.2026 · Version: 1.0

> English translation of the Turkish original (kvkk-aydinlatma.md). In case of

> conflict the Turkish text prevails. Prepared under Article 10 of Turkish Law

> No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the

> Procedures and Principles for Fulfilling the Disclosure Obligation.

1. Identity of the data controller

2. Categories of personal data processed

2.1 For every user: name, surname, phone number, e-mail address, profile

photo, role, language preference, session and login records, IP address.

2.2 Optional profile data: year of birth/age, gender, city, district,

village, years of experience, biography, speciality, hourly rate, main crops,

certificates.

2.3 Location and field data: device location, field boundary polygons, field

name/area/crop, operation logs, soil sampling points, laboratory results,

satellite vegetation indices.

2.4 Images and content: plant disease photos, feedback screenshots,

community posts and replies, group and direct messages, listings, ratings.

2.5 Only for "worker" and "trader" roles: Turkish national ID number and ID

document front/back images (worker role — links timesheet and payment-proof

records to your identity); tax/registration number and company name (trader

role — commercial identity verification).

2.6 Labour and commercial records: work agreements (peer-to-peer arrangements

between a worker and an employer — the app does not match parties, it only

records an arrangement the parties already reached), timesheets, purchase

enquiries, subscription and store purchase events.

2.7 Notification data: device push token, platform, app version, device

model (the last three only when you submit feedback).

2.8 Not processed: special categories under Article 6 (health, biometrics,

religion, ethnicity, trade union membership, criminal record); contacts, call

log, SMS inbox; audio or video recordings; advertising identifiers.

3. Purposes of processing

Creating and operating your account · verifying login by SMS · verifying worker

and trader accounts · providing satellite, weather, irrigation and fire alert

analyses · operating the community, messaging and classified-advert features ·

operating the agricultural labour (timesheet) module · content moderation and

community safety · providing and verifying the Pro subscription · security,

rate limiting and abuse prevention · fulfilling accounting and tax obligations ·

responding to your requests and feedback · establishing and protecting legal

claims.

4. Legal bases (KVKK Articles 5 and 6)

Article 6 (special categories) is not relied upon, because such data is not

processed.

5. Category / purpose / basis / retention

6. Method of collection

Data is collected by partly automated means through the registration and

login screens, onboarding, profile and field screens, in-app messaging,

community and listing screens, device permissions (location, camera, photo

library, motion) and the server's technical logs.

7. Transfers

7.1 Domestic: hosting and infrastructure provider (all service data,

encrypted in transit); SMS provider (phone number and verification message);

competent public authorities where legally required.

7.2 Abroad — under Article 9, on the basis of your explicit consent:

7.3 Visible to other users: name, photo, role, city/district/village,

rating, experience, main crops, and content you publish. Never visible: e-mail,

national ID, tax number, verification documents, exact location, field

boundaries.

7.4 Marketplace. HNKTech is not a party to sales between users, does not

take payment and charges no commission. Data you share directly with the other

party (phone number, address) is outside our control.

8. Automated analysis and AI

AI output (disease detection, irrigation advice, satellite interpretation,

moderation) is advisory. No solely automated decision producing legal

effects is made about you. An automatic filter may block a post; you may appeal

to [email protected] for human review. Account suspension requires human

review. See AI Disclaimer.

9. Security measures

TLS for all traffic · session tokens stored only as SHA-256 digests · SMS codes

bcrypt-hashed, 5-minute lifetime, burned after 5 wrong attempts · national ID

encrypted at the application layer · ID document images served through

a single administrator-only, fully logged endpoint · per-endpoint authorisation ·

rate limiting · access and change logs.

10. Your rights (Article 11)

To learn whether your data is processed; to request information; to learn the

purpose and whether it is used accordingly; to learn the recipients at home and

abroad; to request correction; to request erasure or destruction; to have these

notified to recipients; to object to results produced solely by automated

analysis; and to claim compensation for unlawful processing.

In-app: Profile → Legal → Download my data / My consents;

Profile → Delete My Account.

11. How to apply

Send your request from your registered e-mail address to

[email protected], by secure electronic signature to —, or

in writing to Akyurt / Ankara, Türkiye. We respond within 30 days at the latest. If

your request is refused, the answer is insufficient or no answer is given in

time, you may complain to the Personal Data Protection Board within 30 days of

learning the answer and in any case within 60 days of your application

(Article 14).

12. Children's data

The application is not directed at anyone under 18 and we do not knowingly

process children's data.

13. Changes

When this notice changes, its version number is increased and your consent is

requested again in the app. Previous versions are available on request.

Contact

E-mail: [email protected] · KEP: —

Address: Akyurt / Ankara, Türkiye · VERBİS: kayıt yükümlülüğü bulunmamaktadır

Sürüm 1.2 · Çiftçi AI