GROWPLANT PRIVACY AND PERSONAL DATA PROTECTION

KVKK Information Notice + Privacy Policy • Last updated: 6 October 2026

This notice has been prepared to explain how personal data is processed within the Growplant mobile application and related digital services, and to fulfil the obligation to inform under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").

1. DATA CONTROLLER

2. DATA THAT MAY BE PROCESSED

Depending on the services used, data processed may include full name, email address, phone number, user ID, account and authorisation information, IP and session records, device information, transaction and access logs, sensor and automation data, control commands issued by the User, alarm and notification records, and technical support correspondence.

Facility or device location information may also be processed where required by the feature used. Turkish national identification numbers are processed only where genuinely necessary for legal or operational reasons and an appropriate condition for processing is present.

3. PURPOSES OF PROCESSING

Data may be processed to create accounts, authenticate users, provide Growplant services, link devices to User accounts, display sensor data, generate historical records and reports, run automations, send remote control commands, generate alarms and operational notifications, ensure security, detect errors and failures, provide User support, improve service quality, fulfil legal obligations, and establish, exercise or protect a right.

Growplant does not carry out advertising, campaign or commercial electronic messaging activities.

4. LEGAL BASES

Data is processed on the legal bases set out in Article 5 and, where necessary, Article 6 of the KVKK, primarily the establishment or performance of a contract, fulfilment of a legal obligation, establishment, exercise or protection of a right, the legitimate interests of the data controller provided that fundamental rights and freedoms are not harmed, and processing expressly provided for by law.

Where a separate processing activity legally requires explicit consent, such consent is obtained separately. Merely reading or viewing this notice, or using the application, does not constitute explicit consent.

5. DATA COLLECTION METHODS

Personal data may be collected by automated or partially automated means through the Growplant mobile application, registration/login screens, connected IoT devices, sensors, APIs, server records, technical support channels and email.

6. AWS AND FIREBASE

Amazon Web Services (AWS) and Google Firebase services are used for the technical delivery of Growplant services.

Depending on the nature of the service used, AWS and Firebase may act as service providers/data processors providing technical infrastructure on behalf of Growplant. These services may be used for cloud infrastructure, server/hosting, databases, authentication, push notifications, application infrastructure, security, error handling and performance operations.

Use of these services may involve processing personal data abroad or transferring it abroad.

7. DATA TRANSFERS

Personal data may be transferred to data processors providing technical services on behalf of Growplant, AWS, Google/Firebase, accounting or legal service providers where necessary, and legally authorised public institutions and organisations, only to the extent necessary to provide the service or fulfil legal obligations.

Growplant does not sell personal data to third parties or allow its use for advertising or marketing purposes.

8. INTERNATIONAL TRANSFERS

Personal data may be transferred abroad because the technical infrastructure used by AWS and Firebase is located abroad. Such transfers are carried out in accordance with the conditions set out in Article 9 of the KVKK and related secondary legislation.

9. RETENTION PERIODS

Personal data is retained for the period necessary for its processing purpose or prescribed by applicable legislation. When an account is closed or the processing purpose ends, data is deleted, destroyed or anonymised unless another legal basis requires its retention.

Records that must be kept for tax, accounting, security, legal disputes or other statutory obligations may be retained until the end of the applicable mandatory retention periods.

10. DATA SECURITY

Growplant implements appropriate technical and administrative measures under Article 12 of the KVKK to prevent unlawful processing of and access to personal data and to ensure its secure storage. Absolute security cannot be guaranteed for any internet-based information system.

11. ACCOUNT AND DATA DELETION

The User may request deletion of their Growplant account and associated personal data. In the application, this can be initiated through Profile / Account → Delete My Account.

If the application cannot be accessed, a deletion request may be sent to info@growplant.com. Reauthentication, a verification code or similar reasonable identity verification methods may be used to confirm that the request is made by the account holder.

Following account deletion, account-related personal data not legally required to be retained is deleted, destroyed or anonymised. Records that must legally be retained may be kept solely for mandatory purposes until the end of the applicable retention period.

12. DATA SUBJECT RIGHTS

Under Article 11 of the KVKK, the User has the right to learn whether their personal data is processed; request information if it has been processed; learn the purpose of processing and whether data is used in accordance with that purpose; know the third parties to whom data is transferred domestically or abroad; request correction of inaccurate or incomplete data; request deletion or destruction where the relevant conditions are met; request notification of correction, deletion or destruction to third-party recipients; object to an adverse outcome resulting from analysis exclusively through automated systems; and seek compensation for damage caused by unlawful processing.

13. KVKK APPLICATION METHOD

Requests under the KVKK may be sent to info@growplant.com or to Fenerbahçe Mah. İğrip Sok. No:13/1 Kadıköy/İstanbul. Applications are assessed as soon as possible according to their nature and, in all cases, within the statutory period prescribed by the legislation in force.

14. CHILDREN'S DATA

Growplant is generally not intended for individual use by persons under 18. If unauthorised processing of children's personal data is identified, appropriate legal and technical action is taken.

15. OPERATIONAL NOTIFICATIONS

Notifications relating to device status, security, alarms or automation may be sent as part of the service. Growplant does not send commercial electronic messages for advertising or campaigns.

16. CHANGES

This notice may be updated if Growplant services, technologies used or legislation change. The current version is kept accessible in the Growplant application and/or Growplant's relevant digital channels.

17. CONTACT

Growplant
Fenerbahçe Mah. İğrip Sok. No:13/1 Kadıköy/İstanbul
Email: info@growplant.com