Privacy policy

This policy explains which personal data is processed when you visit the santral.la website (this site) and when you use the santral.la web panel, web phone or apps. Its second part, the personal data notice, sets out the legal bases, the recipients, the retention periods and your rights under the Turkish Personal Data Protection Law (KVKK) and the GDPR. The Turkish texts are the gizlilik politikası and the KVKK aydınlatma metni.

1. Controller

[ŞİRKET ÜNVANI] (“santral.la”), MERSIS: [MERSIS NO], address: [ADDRESS], registered e-mail (KEP): [KEP ADDRESS], e-mail: [KVKK E-POSTASI].

2. This website: cookies and trackers

• This website sets no cookies and stores nothing in your browser.
• It uses no analytics, advertising, retargeting or social media plug-ins.
• Fonts, icons and all other files are loaded from the website’s own server; no request goes to a third party’s server while a page loads.

3. This website: server logs

When you visit the website, the web server keeps a technical log: IP address, date and time, the page requested, the response code, browser details and the referring page, if any. The log is used only to keep the website secure, to fix errors and to prevent abuse (KVKK art. 5(2)(f), GDPR art. 6(1)(f): legitimate interest) and is deleted after [RETENTION PERIOD].

4. When you write to us

The contact form on the website (in Turkish) sends nothing at present: it only prepares the text of an e-mail, and what you enter does not leave your browser. Once the form is switched on, your name, your e-mail address, your message and, if you enter them, your phone number and company name will be passed on to our contact address as one e-mail and will not be stored on the server otherwise.

When you send us an e-mail, your name, your e-mail address and what you write are processed to answer your request (KVKK art. 5(2)(c), GDPR art. 6(1)(b): steps before a contract) and deleted after [RETENTION PERIOD].

5. Web panel, web phone and apps

santral.la accounts are opened by the company that uses the service, for its staff. For the call records, call recordings, voicemail, directory and user list in a company’s PBX that company is the controller; santral.la processes this data on the company’s instructions.

Data processed

• Account: your name, your e-mail address, your account ID, your role and your extensions.
• Calls and directory: the phone numbers of callers and of the numbers called, the date, duration, direction and result of a call; the directory records you add or edit; the reason and note you write after a call.
• Audio: voicemail left for you; call recordings only where the company turned recording on. Recording is done by the PBX, the app never records your voice; the audio of a live call is only relayed and not kept.
• Device: an ID the app generates for this installation, the device’s model and name, the operating system and app version, the push token, the public half of the device key; on Android also where the app was installed from (the installer category) and the hash of its signing certificate. No advertising ID and no hardware serial number.
• Sign-in address, country and network: the IP address you sign in from; the country derived from it and the network the address belongs to (the AS number (ASN) and name of the access provider’s, mobile operator’s or data centre’s network). Country and network are read from tables on our own server; no third party is asked, and no GPS, no city and no location permission is used.
• Online status and working time: when the app or the web phone is connected, and your last sign-in; for the company’s live board and reports.
• Device security signals and call quality: yes/no signals the app sends at sign-in and when the session is renewed (a rooted or jailbroken device, an emulator, a debugger, a hooking framework, a debug build) and the call quality figures the PBX measures for your calls. No crash reports and no usage analytics are collected.
• Diagnostics you send: only when you choose to send diagnostics in the app, never in the background. It is the app’s log around a problem (connection and call states, error codes, times); e-mail and SIP addresses, phone numbers, server names, IP addresses and session keys are taken out on the device and again on the server. It is kept encrypted for 30 days and can be read only by your company’s administrators.

Push notifications

To announce an incoming call while the app is closed (once this feature is switched on), Apple’s and Google’s push services are used. They receive the device’s push token and an encrypted message about the call: a random reference of the call, a time limit, the ID of a key and a sealed part. The caller’s number and name are only inside the sealed part; it is opened with a key the app received from our server at sign-in and that Apple and Google never see.

App permissions

The microphone is used only to transmit your voice during a call; the app does not record your voice itself (call recording, if the company turned it on, happens on the server). The camera is used only to scan the setup QR code, Bluetooth only for headsets, notifications only to show incoming and missed calls. The apps do not access your contacts, your location or the advertising ID, and they contain no advertising, no user tracking and no analytics or crash-reporting tool added by us.

The one exception is the component that scans the QR code in the Android app (Google ML Kit): it reads the image on the device and the image never leaves it, but the component sends Google its own usage and performance measurements and a per-installation identifier it generates itself.

What your company can see

Your company can see this account's online status, working time reports, the devices signed in, the IP address and the approximate country derived from it, and the call records, and can end the session; calls may be recorded depending on the company's settings. The app does not collect your GPS location, your phone's contacts or your activity in other apps. The apps show this notice at the first sign-in.

Next to the IP address the name of the network the address belongs to is shown; a company that switched the display of IP addresses off is shown neither the address, the country nor the network. Diagnostics you send can be read only by your company’s administrators, and every view is recorded; santral.la staff can read them only for a support request your company can see.

Cookies and what is stored on the device

The web panel and the web phone use only the cookies and browser storage needed for the session and for your preferences; they are listed in the Cookie Policy. The apps use no cookies; session data is kept in the device’s secure storage.

Retention and deletion

• Call records, call recordings, voicemail and directory: for the retention period your company sets.
• IP address, country and network in the sign-in history: 180 days; then the address and the network are removed from the record.
• Online-time records: 90 days by default (the company’s setting).
• Device record and device security signals: until the device is removed or the account is deleted.
• Diagnostics you send: 30 days; earlier if your account or the device record is deleted.

The other retention periods are in the personal data notice below. How to have your account and your data deleted is explained on the support page.

6. Personal data notice (KVKK art. 10, GDPR arts. 13 and 14)

What this notice covers

Covered (santral.la is the controller):

• the santral.la website, its contact form and its contact channels,
• the santral.la web panel and web phone,
• the santral.la mobile and desktop apps (once they are published) and their store listings,
• customer accounts, orders, billing and support.

Not covered (santral.la is a processor): the calls, call records, recordings, voicemail, directory and user directory of the companies that use santral.la (the “customer”). The controller of this data is the company concerned. If you called a company or a company called you, please send requests about your personal data to that company; requests of this kind that reach us are passed on to it.

Personal data, purposes and legal bases

How data is collected

Electronically and partly automatically, through the website, its contact form and e-mail, the web panel and the apps, the billing system and the support channels.

Recipients

Within Türkiye: accountants, legal advisers, hosting and data centre services, the payment institution and, on request, the competent public authorities and courts; limited to the purpose. The website’s server logs and e-mails are held only by the providers of our hosting and e-mail services ([HOSTING PROVIDER], [E-MAIL PROVIDER]). Your data is not sold and is not shared with third parties for marketing.

Abroad (KVKK art. 9): for the services below, under the standard contract published by the Turkish Personal Data Protection Board:

• Push notifications: Apple Inc. (APNs) and Google LLC (Firebase Cloud Messaging); the device’s push token and the encrypted call notification. The caller’s number and name are only in the sealed part of the notification, which the app alone can open; Apple and Google cannot.
• QR scanner component (Android app only): Google LLC (ML Kit); the component’s usage and performance measurements and the installation identifier it generates itself. The camera image never leaves the device.
• Transactional e-mail: [E-MAIL PROVIDER]; e-mail address and e-mail content.
• Operations alerts: [ALERTING PROVIDER]; service number, the company’s short name, a masked user ID, the kind of event and counts. No name of a person or a company, no e-mail address, phone number or IP address is sent.
• DNS and security check: [DNS / SECURITY PROVIDER]; IP address and browser details.

The current list of sub-processors will be published with the service documents.

Retention

Data whose retention period has ended is deleted, destroyed or anonymised.

Your rights under KVKK (art. 11)

You have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of the processing and whether the data is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to have incomplete or inaccurate data corrected; to have data erased or destroyed under KVKK art. 7 and to have recipients told of these actions; to object to a result against you that arises solely from analysis by automated systems; and to claim compensation for damage caused by unlawful processing.

How to apply: by e-mail to [KVKK E-POSTASI] (from your registered e-mail address), by KEP, or in writing to [ADDRESS], in line with the Communiqué on the Procedures and Principles for Applications to the Data Controller. Applications are answered free of charge within 30 days at the latest. If you are not satisfied with the answer, you may complain to the Turkish Personal Data Protection Board.

Where processing rests on your explicit consent (marketing), you can withdraw the consent at any time.

Additional information for people in the EU, the EEA and the United Kingdom (GDPR)

• Legal bases: contract (art. 6(1)(b)), legal obligation (art. 6(1)(c)), legitimate interests (art. 6(1)(f): security, fraud prevention, improving the service) and consent (art. 6(1)(a): marketing).
• EU representative (art. 27): [EU REPRESENTATIVE]. UK representative: [UK REPRESENTATIVE].
• Transfers: santral.la is established in Türkiye. As there is no EU adequacy decision for Türkiye, transfers are made under the EU Standard Contractual Clauses; you can ask for a copy at [KVKK E-POSTASI].
• Your rights: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, withdrawal of consent, and a complaint to the supervisory authority of the country you live in.
• No automated decision-making and no profiling takes place.

7. Changes

This policy may be updated. The current version and its date are published on this page and in the apps; material changes are announced to customers by e-mail.