Your data and Sardera

This policy explains how personal data of business accounts is processed through the Sardera web panel and the Sardera Wi-Fi iOS app. The app is for owners and authorised staff of businesses that use the Sardera Guest Wi-Fi service. Accounts cannot be created inside the app; we create them when the service is set up.

The privacy notice shown to your venue's guests on the internet login screen is separate and is displayed on that screen.

The data controller for your account data (email, name, password) is Görkem Kurt (Sardera), Palmiye Mah. 1223 Sk. Palmiye Sitesi B Blok No:17 BB, Yenişehir / Mersin, Türkiye (tax ID 5940713061). Contact: destek@sarderasoft.tech.

For guest data (guest name, room, masked phone and ID numbers, device MAC address, connection times and traffic volumes) the data controller is the business providing the internet access. The obligations under Turkish Law No. 5651 belong to the business; Sardera is the technical service provider processing this data on the business's behalf and instructions.

• Account: email address, full name, role and permissions. Your password is stored on the server only as a one-way hash; nobody, including us, can read it.
• Your actions: issuing and revoking guest codes and changing settings are written to the business's audit trail together with who did it and when. This record cannot be altered later.
• Information you enter for guests: the guest name, room and optional ID/passport number you type when issuing a code. ID numbers and guest phone numbers are stored encrypted on the server and shown masked on screen.
• Technical logs: IP address and time of requests to our servers, for service security.

• Session tokens are stored in the iOS Keychain, bound to this device only; they are not transferred to another phone through backups. Your password is not stored on the phone.
• Your selected business and app-lock preference are kept in the device settings.
• If you enable the Face ID / Touch ID lock, iOS performs the check; face or fingerprint data never reaches the app or us.
• Guest lists and reports are not stored on the phone; they are loaded from the server each time.
• The app contains no advertising, no tracking and no third-party analytics. Your data is not used for advertising and is never sold.

So that you can sign in securely, manage your venue's guest internet (issuing codes, seeing connected guests and device status, reports) and so that the business can meet its logging obligation under Law No. 5651. Legal bases: performance of a contract, compliance with a legal obligation and legitimate interest in service security (Turkish Personal Data Protection Law, KVKK art. 5/2-c, ç, f).

• Account data: for as long as the service agreement lasts; deleted once legal retention periods end.
• Access logs under Law No. 5651: for the legal retention period (740 days), as encrypted and tamper-evident archive packages. Expired packages are deleted.
• Database backups are encrypted and deleted automatically after a limited period.

Your data is shared only with the infrastructure providers needed to run the service (server hosting and encrypted archive storage — Cloudflare R2). These providers process the data only on our behalf and under the same level of protection as described in this policy. Archive packages are encrypted before they are sent to storage.

Law No. 5651 records are disclosed only upon a lawful request from competent authorities, through the business and to the extent permitted by law.

Under KVKK art. 11 you have the right to learn whether your data is processed, to request information, correction or deletion, and to object. You can also ask us to close your account and delete your data (except records whose legal retention period has not ended). Send your request to destek@sarderasoft.tech; we reply within 30 days at the latest. Requests about guest data should first be addressed to the relevant business.

When we update this policy we publish the new text on this page and change its date. We also notify you of significant changes at the email address on your account.