sandıkGDPR

GDPR Notice — sandık

Effective date: May 11, 2026 Version: 1.0

This document supplements the Privacy Policy and Terms of Service with EU/EEA-specific information required by the General Data Protection Regulation (Regulation (EU) 2016/679).

1. Identity of the Controller

Yasin Çıralı is the controller of your personal data within the meaning of GDPR Article 4(7).

Distribution note. The App is distributed only in Türkiye: its availability on Google Play and the App Store is restricted to the Turkish storefront, and it is not offered or marketed to data subjects in the EU/EEA. On that basis no representative is designated under Art. 27, which applies to controllers offering goods or services to data subjects in the Union. This notice is provided for transparency and for EU/EEA residents who use the App while in Türkiye. If distribution is extended to any EU/EEA country, an Art. 27 representative will be designated beforehand and this section updated.

2. Categories of Personal Data Processed

See Privacy Policy §3 for the detailed inventory.

We do not process special categories of personal data (Art. 9): no health, racial/ethnic origin, political opinions, religious beliefs, biometric, genetic, sexual orientation data.

3. Legal Bases for Processing (Art. 6)

Processing Legal basis
Account creation, authentication, providing core service Art. 6(1)(b) — performance of a contract
Push notifications, marketing emails (if any) Art. 6(1)(a) — consent
Storing disclaimer acceptance log Art. 6(1)(c) — legal obligation
Security measures (rate limiting, abuse detection, error logs) Art. 6(1)(f) — legitimate interests
International transfer (Supabase/Firebase USA) Art. 49(1)(a) — explicit consent + Art. 46(2)(c) SCCs

4. Recipients (Art. 13(1)(e))

See Privacy Policy §5.

All processors are bound by Data Processing Agreements (DPAs) under Art. 28.

5. International Transfers (Art. 44-49)

Data is transferred to the United States via:

Service Mechanism Reference
Supabase Inc. EU-U.S. Data Privacy Framework + Standard Contractual Clauses https://supabase.com/privacy
Google Firebase EU-U.S. Data Privacy Framework + SCCs https://firebase.google.com/support/privacy

Risk assessment: The U.S. is a recipient of the EU-U.S. Data Privacy Framework adequacy decision (10 July 2023). However, due to evolving CJEU jurisprudence, we additionally rely on SCCs and supplementary measures (encryption in transit and at rest, access controls, RLS).

You may request a copy of the SCCs by emailing sandikapp.destek@gmail.com.

6. Retention Periods (Art. 13(2)(a))

See Privacy Policy §7.

7. Your Rights (Art. 15-22)

7.1 Right of Access (Art. 15)

You may request confirmation that we process your data and obtain a copy in a structured, machine-readable format.

7.2 Right to Rectification (Art. 16)

You may correct inaccurate or incomplete data.

7.3 Right to Erasure / "Right to be Forgotten" (Art. 17)

You may request deletion. We will erase your data unless retention is required by law (e.g., disclaimer log under Turkish CO Art. 146).

In-app: Profile → Settings → Delete Account. Web: https://yasincirali.github.io/sandikapp/data-request

7.4 Right to Restriction (Art. 18)

You may ask us to limit processing in specific situations (e.g., contesting accuracy, unlawful processing without erasure request).

7.5 Right to Data Portability (Art. 20)

You may request your data in a structured, commonly used, machine-readable format (JSON). You can also ask us to transmit it directly to another controller, where technically feasible.

In-app: Profile → Settings → Download My Data (JSON export).

7.6 Right to Object (Art. 21)

You may object to processing based on legitimate interest (Art. 6(1)(f)). We will stop processing unless we demonstrate compelling legitimate grounds.

7.7 Automated Decision-Making (Art. 22)

We do not make decisions based solely on automated processing (including profiling) that produce legal effects on you. Technical analysis signals, where shown, are informational and require your manual decision.

7.8 Right to Withdraw Consent (Art. 7(3))

You may withdraw consent at any time. Withdrawal does not affect lawfulness of processing prior to withdrawal.

7.9 Right to Lodge a Complaint (Art. 77)

You may complain to your local Supervisory Authority. Common contacts:

Find yours: https://edpb.europa.eu/about-edpb/about-edpb/members_en

8. How to Exercise Your Rights

Method Address
In-app Profile → Settings (Delete / Download)
Email sandikapp.destek@gmail.com
Web form https://yasincirali.github.io/sandikapp/data-request
Postal mail Istanbul, Türkiye

Identity verification: We may ask you to verify your identity (e.g., confirm via the email associated with your account). If we have reasonable doubts about your identity, we may request additional information (Art. 12(6)).

Response time: Within 1 month of receipt (Art. 12(3)). May be extended by 2 months for complex/numerous requests, with notice within the first month.

Cost: Free, except for manifestly unfounded or excessive requests (Art. 12(5)).

9. Data Breach Notification (Art. 33-34)

If we detect a personal data breach likely to result in a risk to your rights and freedoms:

10. Children (Art. 8)

Our service is not directed to children under 16. We do not knowingly process data of children under 16 without parental consent. If you believe a child has provided data, contact us at sandikapp.destek@gmail.com for immediate deletion.

11. Changes to This Notice

Material changes will be communicated via in-app notification and email at least 30 days in advance. The current version is always available at https://yasincirali.github.io/sandikapp/legal/gdpr.

12. Contact

Role Contact
Controller Yasin Çıralı — sandikapp.destek@gmail.com
Data Protection Officer (if appointed) Not appointed — inquiries to sandikapp.destek@gmail.com
EU Representative (Art. 27) Not designated — distribution limited to Türkiye (see §1)

This document is provided in English. A Turkish version is available at legal/tr/KVKK_AYDINLATMA_METNI.md, which covers Turkish KVKK obligations.