Privacy Notice
This notice has been prepared by Levent Nacar under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform the people who use the account and licence service of the MPI · Project Management program about how their personal data is processed. Additional information for users in the European Union and Uzbekistan is given in section 6.
Your project data (work plans, Gantt charts, reports, etc.) is not sent to this service. It stays on your computer or in the OneDrive folder you choose, and the data controller does not process it.
1.Identity of the data controller
| Data controller | Levent Nacar |
|---|---|
| kvkk@mpisuite.com | |
| Registered e-mail (KEP) | levent.nacar@hs01.kep.tr |
2.Personal data processed, purposes and legal grounds
| Data | Purpose | Legal ground |
|---|---|---|
| Identity and contact: full name, email address | Opening the account, verifying the email address, password reset, account and licence notifications | Establishment or performance of a contract (KVKK Art. 5/2-c) |
| Organisation: name of the company you work for | Assigning and managing the licence on behalf of your organisation | Establishment or performance of a contract (KVKK Art. 5/2-c) |
| Sign-in security: password hash (the password itself is not stored), session token hash, Microsoft or Google account identifier, device description (operating system and browser name), sign-in and last-use times | Authentication, session management and protecting your account | Performance of a contract (KVKK Art. 5/2-c); legitimate interest in the security of the service (KVKK Art. 5/2-f) |
| IP address | Limiting repeated failed sign-in attempts and other abuse | Legitimate interest in the security of the service and accounts (KVKK Art. 5/2-f) |
| Licence: trial and licence start and end dates, licence type, administrator notes | Defining and tracking the trial period and the licence; checking the right to use the program | Performance of a contract (KVKK Art. 5/2-c) |
| Activity records: registration, licence and account changes made by the administrator, with date and time | Security of the service; proving licence transactions in case of dispute | Legitimate interest (KVKK Art. 5/2-f); establishment, exercise or protection of a right (KVKK Art. 5/2-e) |
3.Purposes of transfer and recipient groups
| Recipient group | Purpose | Location |
|---|---|---|
| Server (hosting) service provider (Netinternet Bilişim Teknolojileri A.Ş.) | Running the licence service and storing the data in section 2 | Türkiye |
| Email delivery service provider (Netinternet Bilişim Teknolojileri A.Ş.) | Sending verification, password reset and licence emails | Türkiye |
| Competent public authorities | Only when required by law and upon their request | Türkiye |
Your personal data is stored on servers in Türkiye and is not transferred abroad. If you sign in with Microsoft or Google, only your identity information is received from that company; no personal data is transferred to it by this service.
4.Method of collecting personal data
Your personal data is collected electronically and by automated means through the registration and sign-in screens of the program, through the identity information sent by Microsoft or Google when you choose to sign in with them, and through the communication between the program and the licence service. If your account was created by the licence administrator, your email address and, where given, your name and company are entered by the administrator in the licence management panel and notified to you by an invitation email. Licence definitions and administrator notes are entered manually by the administrator in the licence management panel.
5.Your rights under the KVKK
You may submit your requests regarding your personal data under Article 11 of the KVKK at any time, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing or by registered electronic mail (KEP), secure electronic signature, mobile signature or the email address you previously notified to us and that is registered in our system, to the addresses below. Requests are concluded free of charge within 30 days at the latest (KVKK Art. 13).
| Channel | Address |
|---|---|
| kvkk@mpisuite.com | |
| KEP | levent.nacar@hs01.kep.tr |
6.Additional information for users in the European Union and Uzbekistan
Retention periods. Data is kept for the periods below and deleted automatically by a daily deletion job; when you ask for your account to be deleted, the account, its sessions and links are deleted and your email address in the activity records is replaced by an irreversible short code; copies in the database backups are removed when those backups expire.
| Data | Retention |
|---|---|
| Account data (identity, contact, organisation, licence) | While the account is open; accounts without a valid licence that have not been used for 2 years are deleted |
| Registrations whose email address was never verified | 30 days |
| IP addresses (failed sign-in counters) | 1 day |
| Sessions | Become invalid and are deleted after 90 days without use |
| Used or expired verification and password links | 7 days after expiry |
| Activity records | 2 years |
| Daily database backups | 14 days |
European Union (GDPR). The legal grounds above correspond to Article 6(1)(b) GDPR (contract) and Article 6(1)(f) GDPR (legitimate interest: security of the service and accounts, preventing abuse, and establishing or defending legal claims). In addition to the rights above, you have the rights of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest, and the right to lodge a complaint with the supervisory authority of the EU member state where you live or work. Providing your name, email address and a password (or a Microsoft or Google account) is required to open an account; without them the account cannot be opened and the program cannot be used. No profiling is carried out; the closing of access at the end of the trial or licence period is the date-based application of the licence terms. The data controller and the servers are located in Türkiye; your data is stored in Türkiye.
Uzbekistan. Under Law No. ZRU-547 “On Personal Data”, the data processed by this service is not among the categories that must be stored in Uzbekistan (biometric and genetic data, and user data of telecommunications operators in Uzbekistan). It is stored on servers in Türkiye. You may exercise your rights as a data subject under that Law through the contact addresses above.
Last updated: 12 October 2026 · Version 1.1