Privacy Policy

This is an English translation provided for convenience. In case of any discrepancy, the Turkish version at netzeroes.com.tr/gizlilik-politikasi is the authoritative and legally binding text.

1. Nature of the Platform

NetZero E.S. (Emission Systems) is developed and operated not by a registered company or commercial enterprise, but as an independent student/personal project. The Platform was designed for educational and portfolio purposes, in order to build practical software in the fields of sustainability, carbon/water footprint calculation and ESG reporting. This matters so that users can honestly understand the nature of the legal relationship: there is NO joint-stock company, limited company or other legal entity behind the Platform; this Privacy Policy and the Terms of Use have been drafted to reflect that fact. This in no way reduces the Platform's commitment to protecting your personal data seriously and in good faith — the technical and organisational measures described in the sections below (encryption, role-based access, Firestore Security Rules, etc.) are fully implemented.

2. Data Controller / Processor

This Privacy Policy has been prepared by the natural person who develops and operates the Platform ("we", "Platform"), observing the principles of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the European Union General Data Protection Regulation ("GDPR"), in order to fulfil the duty to inform you about the personal data processed.

Because the Platform is a student/personal project (see Section 1), it has no official MERSİS or VERBİS registration and no KEP (registered electronic mail) address — these are registration systems that apply to registered commercial enterprises. The sole contact channel for any request, question or application concerning your personal data is help@netzeroes.com.tr; every request received at that address is reviewed directly by the person who develops the Platform.

3. Categories of Personal Data Processed

The following categories of personal data are processed through the Platform:

• Identity Data: Full name, title (including research field and academic title for academic accounts).
• Contact Data: Email address, institution/employer information (if any).
• Account and Transaction Security Data: Authentication data managed through Firebase Authentication (passwords are never stored in plain text by the Platform).
• Activity/Environmental Data: Calculation inputs declared by the user, such as energy consumption, fuel use, water consumption, waste and travel data; and the emission/water footprint results derived from them.
• Financial Data: Subscription payments are processed through the Shopier payment infrastructure; card details are never seen or stored by the Platform.
• Transaction Security Data: IP address, browser information, session records, audit log records.
• Survey Data: Commute data submitted anonymously or by name through the Employee Commute Portal, via a link shared by the employer.
• Referral/Invitation Data: Under the Invite a Friend programme, the association of people who register using your invitation link with your account (in order to track bonus entitlements).
• API Usage Data (Enterprise only): The name, permission type and daily usage counter of the API keys you create — the key itself is shown in full only once, at creation, after which only a shortened preview is stored.

4. Purposes of Processing

• Performing and reporting the greenhouse gas, water footprint and ESG calculations that are the Platform's core function,
• Creating, authenticating and authorising the user account (role-based access),
• Operating subscription and payment processes,
• Producing ISO 14064-compliant PDF reports and making them verifiable via QR code,
• Operating the referral/invitation programme and correctly calculating bonus entitlements,
• Improving service quality, detecting faults and ensuring Platform security,
• Fulfilling legal obligations (tax, accounting, consumer legislation, etc.),
• Responding to user requests and support enquiries.

5. Legal Bases

Your personal data is processed on the following legal bases under KVKK Art. 5 and 6 and GDPR Art. 6:

• Being directly related to the conclusion or performance of a contract (performance of the service agreement),
• Being necessary for the Platform to fulfil a legal obligation,
• Being necessary for the legitimate interests of the data processor, provided that the fundamental rights and freedoms of the data subject are not harmed,
• Explicit consent (in particular for marketing communications and non-essential cookies).

6. Retention Periods

Personal data is retained for the periods prescribed by the relevant legislation and/or for as long as the processing purpose requires. After an account is closed, data not subject to legal retention obligations (e.g. payment records required by tax legislation) is deleted, destroyed or anonymised within a reasonable period. Audit log records may be retained longer for security and accountability purposes. Under the KVKK Compliance Policy, automated data retention/deletion processes also run for accounts that have been inactive for a long time (see in-platform notifications).

7. Transfers of Personal Data

The Platform's infrastructure is hosted on Google Firebase (Google LLC); accordingly, your personal data may be processed on Google's servers as the technical infrastructure provider (in data centres that may be located abroad). Payment transactions are carried out through the Shopier payment infrastructure. These transfers are made only to the extent necessary for performance of the service and in accordance with the cross-border data transfer rules under KVKK Art. 9 and GDPR Chapter V. Apart from the above, your data is not shared with or sold to third parties without your explicit consent or a legal obligation — the Platform does not sell or rent any user data to third parties for advertising/marketing purposes.

Academic Laboratory feature: Users with an academic account may choose, with their own consent (via an invitation code), to join a laboratory created by an academic. This participation constitutes the "explicit consent" exception above: calculation records created FROM THE DATE OF JOINING onwards become visible to the academic responsible for that laboratory. Calculations made before joining are not covered and remain private. When a student leaves or is removed from the laboratory, the academic's access ends automatically.

8. Data Security Measures

To protect personal data against unlawful access, loss or disclosure, industry-standard technical and organisational measures aligned with the principles of the ISO 27001 Information Security Management System are applied. These include encryption in transit and at rest, role-based access control (RBAC), layered access restriction via Firestore Security Rules, audit logging, bot/abuse protection via App Check, and regular security reviews. Those who wish to test the site's security independently can run a scan via VirusTotal.

9. Cookies

The Platform uses a limited number of cookie/local storage mechanisms for session state, language preference and core functionality. For detailed information on the types and purposes of cookies and how to manage your preferences, see our Cookie Policy.

10. Rights of the Data Subject (KVKK Art. 11 / GDPR Art. 15-22)

Under Article 11 of the KVKK and (where applicable) the relevant articles of the GDPR, by applying through the contact channel set out in the following section you have the right to:

• Learn whether your personal data is being processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether the data is used in line with that purpose,
• Know the third parties to whom the data is transferred domestically or abroad,
• Request correction if the data has been processed incompletely or inaccurately,
• Request erasure/destruction within the conditions set out in KVKK Art. 7 (this can also be exercised directly via the "Permanently Delete My Account" feature on your profile page),
• Request that correction/erasure be notified to the third parties to whom the data was transferred,
• Object to an adverse outcome arising from automated analysis of your data,
• Claim compensation if you suffer damage due to unlawful processing,

Furthermore, you can download a copy of all your data yourself at any time via the "Download My Data" feature on your profile page.

11. How to Submit a Request

To exercise the rights above, you can send your requests by email to help@netzeroes.com.tr — since the Platform is run as a student project (see Section 1) there is no physical application address; all applications are accepted by email. To confirm that the request is yours, it is enough to write from your registered email address; additional verification may be requested if necessary. Depending on their nature, your requests are concluded free of charge as soon as possible and at the latest within the thirty (30) days prescribed by the KVKK.

12. Changes to This Policy

This Privacy Policy may be updated from time to time in line with changes in legislation or updates to the Platform. The current policy is always published on this page; users are informed through the Platform of significant changes.