Mehmet Gümrah
Home/Apps/Tekno Portal/Privacy

Tekno Portal

Privacy Policy

Applies to the Tekno Portal B2B customer application. The iOS, Android, and Windows versions follow the same data processing principles. The app is designed solely for Tekno İklimlendirme customers to access their own account data.

Effective date: 24 July 2026

TürkçeEnglish

This Privacy Policy explains what information the Tekno Portal application (the “App”) processes about its users, the purposes it is used for, who it may be shared with, and how it is protected. The policy applies to the iOS, Android, and Windows versions of the App.

Tekno Portal is a B2B self-service application for customers of Tekno İklimlendirme. A customer can review their own account, balance, invoice and payment activity, orders, and quotes, pay by card, and place orders from their own product catalog. Each account can only reach data belonging to its own set of customer accounts; no other customer's data is visible.

Accounts cannot be created in the App. User accounts are set up by Tekno İklimlendirme, and credentials are provided through a sales representative.

1. Summary

  • The App contains no advertising, no advertising identifier, and no third-party tracking or analytics SDK.
  • No location, camera, microphone, contacts, or sensor permission is requested.
  • Card details are never saved on the device; payment completes on the bank's 3D Secure page.
  • Your password is not stored on the device; the session runs on a time-limited, securely stored token.
  • The IBANs and addresses you enter under Profile are never sent to the server and stay on your device only.
  • The commercial data the App processes is the data of your own customer account.

2. Data Processed

Account and Session Data

  • Username and password (transmitted only in the sign-in request)
  • User ID, full name, and role
  • The customer account code linked to the login and its access permissions
  • Session token and its expiry

Account and Financial Data

  • Customer account code, trade name, and display name
  • Balance, debit, and credit status
  • Account activity (statement) history
  • Invoice details, invoice line items, and invoice PDF documents
  • Collection receipts and records of past card collections
  • Billing details: trade name, address, district, province, tax office, tax number, phone, and email

On the billing details screen, only the address, district, and phone fields can be updated by the user. Trade name, tax office, tax number, and province cannot be changed from the App.

Order, Quote, and Product Data

  • Product information from your own catalog and per-product price queries
  • Orders you create and their line items
  • Pending orders and quote records
  • Your own past product (stock) activity

The order request body carries neither the price nor the customer account code — the server derives both. A single-use request identifier generated for each basket prevents the same order from being recorded twice.

Card Payment Data

  • Cardholder name, card number, expiry date, and CVV (only at the moment of payment)
  • Payment amount, number of installments, and the account the payment is booked to
  • Payment result: transaction number, date, amount, bank authorization code, card type, and the last four digits of the card number

Data Kept on the Device Only

  • Your own IBAN and location records. The bank account and address entries you add under Profile are never sent to the server; they are kept only in the App's private storage on the device. These records contain no coordinates — the map is searched using the address text you typed.
  • Downloaded product catalogs (PDF) and the statement, invoice, and receipt documents you view
  • Unfinished order drafts and temporary input in the calculation tools
  • Simple app preferences, such as whether the “What's new” screen has been shown

Technical Data

  • App version and application identifier (sent so the server can enforce its minimum version check)
  • Network connectivity status (read on the device only, to tell “no internet” apart from “server unreachable”)

The App uses no crash reporting, usage analytics, screen tracking, or telemetry service. Information such as device model, operating system version, or advertising identifier is not collected and is never sent to any server.

Permissions Not Requested

The App does not requestaccess to location, camera, microphone, contacts, calendar, health, or sensor data, and does not collect such data. On Android, only the internet and network-state permissions are declared. Map links shown in the App open the device's map application with an address string, without reading the device's location.

3. Purposes of Processing

  • Authenticating the user and managing the session
  • Showing the user only the data belonging to their own customer accounts
  • Presenting statements, balances, invoices, and collection information
  • Running order and quote workflows
  • Initiating and completing card payments and generating the collection receipt
  • Downloading and viewing product catalogs and documents
  • Running the term-difference and discount calculation tools
  • Checking the minimum app version and showing an update prompt when required
  • Enforcing permission-based access control

Data is not used for advertising, ad targeting, profiling, or third-party marketing.

4. Card Payment and 3D Secure

Card payments complete through the 3D Secure flow operated by the bank. The process works as follows:

  • Card details are entered in the payment form and sent over HTTPS to the company server (api.teknoiklimlendirme.com), which opens the 3D session with the bank's virtual POS infrastructure.
  • The verification step completes on the bank's own page, inside a secure browser component within the App. SMS verification codes and similar information belong to the bank; the App does not read them.
  • The card number, expiry date, and CVV are never stored on the device: they are not written to disk, not backed up, not written to logs, and not held in any persistent store while moving between screens. They exist in memory only for the duration of the payment request and are cleared once it is sent.
  • After payment, the server retains only the transaction record and the last four digits of the card number. The full card number and the CVV are not retained.
  • Screenshot and screen-recording protection is active on the screens where card details are entered and shown: on Android, screenshots are blocked; on iOS, sensitive areas are masked when screen recording or mirroring is detected.
  • The App offers no card-on-file feature for reusing a card in later payments.

The entries listed on the “My cards” screen are past collection receipts booked to your account. They contain no card credentials — only date, amount, installments, bank, and, where available, the last four digits of the card.

5. Advertising, Analytics, and Tracking

Tekno Portal shows no advertising and uses no ad network, social media tracking SDK, analytics, or crash reporting service. The App contains no push notification infrastructure (such as Firebase Cloud Messaging) and processes no device notification token.

On iOS, the Apple Advertising Identifier (IDFA) is not collected and App Tracking Transparency permission is not requested. The App's PrivacyInfo.xcprivacy manifest declares that no tracking takes place; the only declared data type is the user ID, processed for authentication and app functionality. On Android, the Google Play Services advertising ID is not used.

6. Data Transfer and Sharing

The App transmits data only to the company's own server at api.teknoiklimlendirme.com, over HTTPS. Data is not sold or transferred to third parties for marketing purposes.

  • Banks and virtual POS providers:card payments run through the relevant bank's 3D Secure infrastructure. Card and transaction data is transmitted to the bank, which acts as a separate data controller under its own privacy policy.
  • App stores:distribution and updates are handled by the App Store, Google Play, and the Microsoft Store. Data related to downloads and updates is subject to the respective store provider's policies.
  • Map application:tapping a link on the location screen opens the device's map application with an address string. From that point the map provider's privacy policy applies; the App neither reads nor transmits the device's location.

7. Data Security

  • All server communication uses HTTPS (TLS); cleartext HTTP connections are not permitted.
  • Requests are authorized with a server-validated API key (x-api-key) and, for signed-in users, a time-limited session token (Authorization: Bearer).
  • Session data is held in platform-specific secure storage: an encrypted preference store on Android, the Keychain on iOS (this-device-only, with iCloud sync disabled), and the operating system's data protection (DPAPI) mechanism on Windows.
  • The user's password is not stored on the device. Session continuity relies solely on the time-limited session token.
  • On Android, session data is excluded from cloud backup and device transfer; on iOS, the session token is not synced through iCloud.
  • File sharing is narrow and controlled: only the downloaded catalog and document folders are exposed for sharing, and areas holding session data cannot be shared.
  • On the server, every request is validated against the set of accounts the user may reach; a request for an account outside that set is rejected.

8. Data Retention

Session data stored on the device becomes invalid when the user signs out or when the session token expires; removing the App deletes all local data from the device.

Downloaded catalogs are kept persistently on the device, while statement, invoice, and receipt documents are kept in a temporary cache that the operating system may clear.

Because the IBAN and address records you enter under Profile are held on the device only, they are lost when the App is removed or the device is replaced; they are not synced between devices.

Commercial, financial, and operational data on the server is retained in line with the company's internal retention policies and applicable legal obligations (for example, legislation on the retention of commercial books and records).

9. Account Creation and Closure

New accounts cannot be created in the App; accounts are set up by Tekno İklimlendirme. To request closure of your account or suspension of your access, contact your sales representative or use the contact addresses below. Closing an account does not prevent commercial and financial records from being retained in company systems for their statutory retention periods.

10. User Rights

Users can:

  • Sign out of the App to delete the session data stored on the device.
  • Remove the App to clear all local data from the device.
  • Delete the IBAN and address records they entered under Profile at any time.
  • Submit requests to access, correct, or delete their personal data, or to object to its processing, to the data controller. Requests are handled in accordance with applicable legislation.

11. Children's Privacy

This App is intended solely for authorized users of corporate customers. Data is not knowingly collected from individuals under the age of 18.

12. Changes to This Policy

This Privacy Policy may be updated as new modules are added to the App. The updated version is published on this page and the “Effective date” is revised. Significant changes may be announced in the App or through the company's official communication channels.

13. Contact

Company / Data Controller: Tekno İklimlendirme
Email: info@teknoiklimlendirme.com
Web: teknoiklimlendirme.com

Technical Developer: Mehmet Gümrah
Email: support@mgumrah.com
Web: mgumrah.com