Privacy Policy

This is an English translation provided for convenience. In case of any discrepancy, the Turkish version at netzeroes.com.tr/gizlilik-politikasi is the authoritative and legally binding text.

1. Nature of the Platform

NetZero E.S. (Emission Systems) is developed and operated not by a registered company or commercial enterprise, but as an independent student/personal project. The Platform was designed for educational and portfolio purposes, in order to build practical software in the fields of sustainability, carbon/water footprint calculation and ESG reporting. This matters so that users can honestly understand the nature of the legal relationship: there is NO joint-stock company, limited company or other legal entity behind the Platform; this Privacy Policy and the Terms of Use have been drafted to reflect that fact. This in no way reduces the Platform's commitment to protecting your personal data seriously and in good faith — the technical and organisational measures described in the sections below (encryption, role-based access, Firestore Security Rules, etc.) are fully implemented.

2. Data Controller / Processor

This Privacy Policy has been prepared by the natural person who develops and operates the Platform ("we", "Platform"), observing the principles of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the European Union General Data Protection Regulation ("GDPR"), in order to fulfil the duty to inform you about the personal data processed.

Because the Platform is a student/personal project (see Section 1), it has no official MERSİS or VERBİS registration and no KEP (registered electronic mail) address — these are registration systems that apply to registered commercial enterprises. The sole contact channel for any request, question or application concerning your personal data is [email protected]; every request received at that address is reviewed directly by the person who develops the Platform.

3. Categories of Personal Data Processed

The following categories of personal data are processed through the Platform:

• Identity Data: Full name, title (including research field and academic title for academic accounts).
• Contact Data: Email address, institution/employer information (if any).
• Account and Transaction Security Data: Authentication data managed through Firebase Authentication (passwords are never stored in plain text by the Platform).
• Activity/Environmental Data: Calculation inputs declared by the user, such as energy consumption, fuel use, water consumption, waste and travel data; and the emission/water footprint results derived from them.
• Financial Data: Subscription payments are processed through the Shopier payment infrastructure; card details are never seen or stored by the Platform.
• Transaction Security Data: IP address, browser information, session records, audit log records.
• Survey Data: Commute data submitted anonymously or by name through the Employee Commute Portal, via a link shared by the employer.
• Referral/Invitation Data: Under the Invite a Friend programme, the association of people who register using your invitation link with your account (in order to track bonus entitlements).
• API Usage Data (Enterprise only): The name, permission type and daily usage counter of the API keys you create — the key itself is shown in full only once, at creation, after which only a shortened preview is stored.
• Supplier Declaration Data: Through the Supplier Data Portal, via a link shared by the supplier's customer: the company name declared by the supplier, an optional contact email, annual electricity, natural gas and diesel consumption, and the share of its output/revenue going to that customer. These declarations are visible only to the account holder who shared the link.
• Quote and Contact Request Data: The full name, company name, business email and optional phone number and message you submit through the enterprise quote form.
• Target Data: The emissions reduction target you define on the dashboard (base year, base-year emissions, target year and reduction percentage).
• Client Error Logs: The message of technical errors occurring in your browser, the path of the page, browser information and, if you are signed in, your user identifier. These logs are kept solely for troubleshooting and are deleted automatically after 30 days.
• Aggregate Usage Statistics (not personal data): Page view and visit counts, the domain of the referring site, interface language, device class (mobile/tablet/desktop) and daily totals of certain actions such as sign-ups and demo calculations. No cookies are used for this measurement; no IP address, user identifier or browser fingerprint is recorded, and the records consist only of daily totals that cannot be linked to an individual. If “Do Not Track” or “Global Privacy Control” is enabled in your browser, no measurement takes place.
• Invoice Files Processed on Your Device: A PDF or XML file you select with the “Read from invoice” feature is processed only in your browser; it is not uploaded to or stored on our servers. Only the consumption value you select and confirm is written into the form field.

4. Purposes of Processing

• Performing and reporting the greenhouse gas, water footprint and ESG calculations that are the Platform's core function,
• Creating, authenticating and authorising the user account (role-based access),
• Operating subscription and payment processes,
• Producing ISO 14064-compliant PDF reports and making them verifiable via QR code,
• Operating the referral/invitation programme and correctly calculating bonus entitlements,
• Improving service quality, detecting faults and ensuring Platform security,
• Fulfilling legal obligations (tax, accounting, consumer legislation, etc.),
• Responding to user requests and support enquiries.
• Collecting supply chain (Scope 3) data from suppliers and transferring it into the inventory,
• Sending transactional emails such as account verification, security notices and subscription reminders,
• Measuring and improving use of the service through aggregate statistics that are not linked to individuals.

The Platform does not use your personal data for advertising profiling and does not make decisions about you that are based solely on automated processing and produce legal or similarly significant effects.

5. Legal Bases

Your personal data is processed on the following legal bases under KVKK Art. 5 and 6 and GDPR Art. 6:

• Being directly related to the conclusion or performance of a contract (performance of the service agreement),
• Being necessary for the Platform to fulfil a legal obligation,
• Being necessary for the legitimate interests of the data processor, provided that the fundamental rights and freedoms of the data subject are not harmed,
• Explicit consent (in particular for marketing communications and non-essential cookies).

6. Retention Periods

Personal data is retained for the periods prescribed by the relevant legislation and/or for as long as the processing purpose requires. After an account is closed, data not subject to legal retention obligations (e.g. payment records required by tax legislation) is deleted, destroyed or anonymised within a reasonable period. Audit log records may be retained longer for security and accountability purposes. Under the KVKK Compliance Policy, automated data retention/deletion processes also run for accounts that have been inactive for a long time (see in-platform notifications).

The main periods applied are: (i) client error logs are deleted automatically after 30 days; (ii) for free (Standard and Academic) accounts, if there is no sign-in for approximately three years, a warning is sent to the registered email address and, if there is still no sign-in within the following 30 days, the account is deleted together with its associated data; (iii) free Standard accounts whose email address has not been verified and which have no payment record are deleted automatically, together with their associated data, 30 days after registration; (iv) when you delete your account, your calculations, reports, employee survey responses and supplier declarations are deleted with it; (v) aggregate usage statistics contain no personal data and may be retained indefinitely.

7. Transfers of Personal Data

The Platform's infrastructure is hosted on Google Firebase (Google LLC); accordingly, your personal data may be processed on Google's servers as the technical infrastructure provider (in data centres that may be located abroad). Payment transactions are carried out through the Shopier payment infrastructure. These transfers are made only to the extent necessary for performance of the service and in accordance with the cross-border data transfer rules under KVKK Art. 9 and GDPR Chapter V. Apart from the above, your data is not shared with or sold to third parties without your explicit consent or a legal obligation — the Platform does not sell or rent any user data to third parties for advertising/marketing purposes.

Academic Laboratory feature: Users with an academic account may choose, with their own consent (via an invitation code), to join a laboratory created by an academic. This participation constitutes the "explicit consent" exception above: calculation records created FROM THE DATE OF JOINING onwards become visible to the academic responsible for that laboratory. Calculations made before joining are not covered and remain private. When a student leaves or is removed from the laboratory, the academic's access ends automatically.

Processors and infrastructure providers: The following providers are used to deliver the service, and each receives only the data its function requires: Google Firebase (authentication, database and server functions; the database runs in the europe-west3 (Frankfurt) region and server functions in the europe-west1 (Belgium) region, both within the European Union), Google reCAPTCHA (abuse protection as part of App Check), Microsoft Azure (the server that delivers the web pages), Cloudflare (content delivery and attack protection; your IP address is technically processed for this purpose), Resend (delivery of transactional emails; your email address and the message content) and Shopier (payments).

Sharing that you initiate: When you join a team with an invitation code, the calculation records you create within the team after joining can be viewed and approved by the team owner. When you create an audit link, anyone holding the link can view your summary indicators and leave comments; you can revoke the link at any time. If you define an API key or a webhook, your data is sent to the systems you specify on your instruction; you are responsible for the security of those systems.

8. Data Security Measures

To protect personal data against unlawful access, loss or disclosure, industry-standard technical and organisational measures aligned with the principles of the ISO 27001 Information Security Management System are applied. These include encryption in transit and at rest, role-based access control (RBAC), layered access restriction via Firestore Security Rules, audit logging, bot/abuse protection via App Check, and regular security reviews. Those who wish to test the site's security independently can run a scan via VirusTotal.

9. Cookies

The Platform uses a limited number of cookie/local storage mechanisms for session state, language preference and core functionality. For detailed information on the types and purposes of cookies and how to manage your preferences, see our Cookie Policy.

Visitor measurement is carried out without cookies and as daily totals that cannot be linked to an individual, so no cookie consent is requested for it (see Section 3).

10. Rights of the Data Subject (KVKK Art. 11 / GDPR Art. 15-22)

Under Article 11 of the KVKK and (where applicable) the relevant articles of the GDPR, by applying through the contact channel set out in the following section you have the right to:

• Learn whether your personal data is being processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether the data is used in line with that purpose,
• Know the third parties to whom the data is transferred domestically or abroad,
• Request correction if the data has been processed incompletely or inaccurately,
• Request erasure/destruction within the conditions set out in KVKK Art. 7 (this can also be exercised directly via the "Permanently Delete My Account" feature on your profile page),
• Request that correction/erasure be notified to the third parties to whom the data was transferred,
• Object to an adverse outcome arising from automated analysis of your data,
• Claim compensation if you suffer damage due to unlawful processing,

Furthermore, you can download a copy of all your data yourself at any time via the "Download My Data" feature on your profile page.

11. How to Submit a Request

To exercise the rights above, you can send your requests by email to [email protected] — since the Platform is run as a student project (see Section 1) there is no physical application address; all applications are accepted by email. To confirm that the request is yours, it is enough to write from your registered email address; additional verification may be requested if necessary. Depending on their nature, your requests are concluded free of charge as soon as possible and at the latest within the thirty (30) days prescribed by the KVKK.

If your request is rejected, you find the response insufficient, or you do not receive a response in time, you may lodge a complaint with the Turkish Personal Data Protection Board under KVKK Art. 14 within thirty (30) days of learning of the response and in any event within sixty (60) days of your request. If you reside in the European Union, you also have the right to contact the data protection supervisory authority of your country.

12. Changes to This Policy

This Privacy Policy may be updated from time to time in line with changes in legislation or updates to the Platform. The current policy is always published on this page; users are informed through the Platform of significant changes.