Tanbu Platform and Mobile App Privacy Notice

Controller and processor

Your employer, who invited you to the platform, is the controller of the employee data processed in it: your employer decides which surveys, trainings and announcements reach whom and how long the data is kept.

Tanbu is a product of SPO Eğitim Danışmanlık E-Ticaret Ltd. Şti. (address: Esatpaşa Mah. Güllük Sok. No:25 D:4 Ataşehir/İstanbul; MERSIS: 0781111781200001). We process this data as a processor, under our contract with your employer and on its instructions. For the technical records we keep to secure and operate platform accounts, we are the controller.

Personal data we process

Depending on the modules your employer uses, the platform processes:

• Identity and account: name, work email address, role, department, job title, organisational unit, language preference.
• Surveys: the surveys assigned to you and your answers. In a survey marked anonymous, an answer is not linked to your identity; it is stored under an irreversible token.
• Training: assigned trainings, progress, completion and certificate records.
• Announcements, votes and suggestions: read and acknowledgement status, your choices in named votes, and suggestions you submit.
• Notifications: platform notifications sent to you, your email and phone-notification preferences, and, if you allowed notifications in the mobile app, your phone's notification identifier.
• Security of processing: session records, IP address, browser or app version, audit records.

Anonymity and small groups

Survey results are shown to your employer at group level. No score is shown for a group of fewer than five people; some screens use a higher threshold. Open-text answers are not shown until identifying details are removed and enough people have answered. Open-text answers from an anonymous survey are never shown one by one.

Named votes and event attendance responses are not anonymous, and those screens tell you so.

Purposes and legal bases

Data is processed to measure employee experience, assign and track training, run internal communication, turn results into action plans, manage your account and keep the platform secure.

Legal bases: the performance of the employment contract (KVKK art. 5/2-c), the controller's legitimate interest (KVKK art. 5/2-f) and legal obligations (KVKK art. 5/2-ç); under the GDPR, art. 6(1)(b), (c) and (f). The platform does not rely on consent, because consent cannot be freely given in an employment relationship.

Survey answers are not collected for performance evaluation or disciplinary purposes.

AI-assisted reports

If your employer uses AI-assisted reporting, report text is generated from group-level results only. Your identity is not sent to it; open-text answers from anonymous surveys are not sent; other open-text answers are used only after identifying details are removed and when enough people have answered. This processing makes no automated decision about you.

Recipients and transfers

Your data is shown to the users your employer authorises, to the extent of their role (for example HR administrators, and managers limited to their own team).

To provide the service we use processors for server hosting and backups, email delivery, phone-notification delivery, and AI-assisted report generation. Some of them may be located outside Türkiye; transfers are made with the safeguards required by KVKK art. 9 and the GDPR. You can ask for the current list of providers at the contact address below.

Your data is not sold, and it is not shared with anyone for advertising or marketing.

Mobile app

The mobile app processes the same data as the web application. The one addition is your phone's notification identifier, if you allow notifications: notifications are delivered to it through your phone operating system's push service and carry only the notification title and the screen to open. If you do not allow them, no identifier is created. It is deleted when you sign out, and you can turn notifications off at any time in your phone's settings or your notification preferences. The app contains no advertising, analytics or crash-reporting software, and it does not access your location, contacts, camera or microphone.

Your session is stored only on your device and is excluded from cloud backup and device transfer. It is deleted when you sign out or uninstall the app.

Retention

• Account data: while your account is active; deleted when your employer closes the account or a deletion request is carried out.
• Survey answers and the reports built from them: for the period your employer sets (365 days by default, at least 90 days), then deleted automatically.
• Audit records: 90 days by default.
• Training, announcement and suggestion records: for the term of your employer's contract and as it instructs.

Security

All traffic travels over encrypted connections (HTTPS). Each employer's data is separated from the others; access is role-based; sensitive fields are stored encrypted, and access to personal data is written to a tamper-evident, hash-chained audit log.

Your rights

Under KVKK art. 11 and the GDPR you have the right to learn whether your data is processed, to request information, rectification and erasure, to object to processing, to receive a copy of your data, and to claim compensation for damage.

Because your employer is the controller, the fastest route is your employer's HR team. You can also write to [email protected]; we will pass your request to your employer and help carry it out. Written requests: SPO Eğitim Danışmanlık E-Ticaret Ltd. Şti., Esatpaşa Mah. Güllük Sok. No:25 D:4 Ataşehir/İstanbul. You may also complain to the Turkish Personal Data Protection Authority or the supervisory authority in your country.

Changes

When this notice changes, the current text is published at this address and the date at the top is updated.