Rmos Pos Report Mobile App Privacy Policy

Data controller

The data controller is Reşat Mendi Otelcilik Sistemleri Bilgisayar Sanayi Turizm ve Ticaret Anonim Şirketi.

• Address: Akdeniz Üniversitesi Akdeniz Tekno Kenti K:2 No:3 Konyaaltı / Antalya, Türkiye
• Phone: +90 242 227 87 31
• E-mail: [email protected]
• Registered e-mail (KEP): [email protected]
• Mersis No: 0-7340-1010-1400012

Data we process

The App processes only what it needs to function:

• Authentication data: username and password (sent to the server at sign-in only, never stored on the device) and the session key.
• User and branch: your username and the code of the branch your account belongs to.
• App preferences: language, appearance and the list of reports you opened last.
• Business data (reports): sales, bills, payments, discounts, complimentary items, cancellations and cash records. These records contain the names of the business's staff (waiters, cashiers, the user who cancelled), the names and account movements of customer accounts, and, in audit records, the name of the user and computer that made a change.
• Technical data: IP address, operating system, app version and a random per-install identifier used to check for updates. This identifier is not linked to your identity.

The App only displays reports; no records are entered or changed through it. Business data belongs to the business you work for; RMOS hosts and processes it on the business's behalf.

The App does not read, process or store bank or credit card details.

Your account is created by your business; there is no public sign-up in the App.

Data we do not collect

The App does not collect location, contacts, calendar, photos, camera, microphone, health data or the advertising identifier (IDFA/AAID), and does not ask for access to device sensors. It sends no notifications. It contains no ad network, tracking or third-party analytics.

Purposes and legal basis

Data is processed to authenticate the user, to show the business's sales reports to authorised staff, for debugging and for security.

The legal basis is Article 5/2-c (performance of a contract) and Article 5/2-f (legitimate interest of the data controller) of the Turkish Personal Data Protection Law No. 6698 (KVKK).

Where data is stored

The session key is kept in the operating system's secure storage on your device (iOS Keychain, Android Keystore). It is removed from the device when you sign out; each session is valid for at most 30 days.

Only your language and appearance preferences and the list of reports you opened last are kept on the device. Report data is not written to the device; it exists in memory only while the App is open.

Server-side data is hosted on the servers of RMOS and/or the infrastructure provider it uses. All communication is encrypted with HTTPS (TLS).

Transfers

Your personal data is not sold or transferred to third parties for marketing. Transfers are made only to the business you work for, to the infrastructure providers that host our services and to public authorities where the law requires it, within KVKK Articles 8-9.

One infrastructure provider based abroad is used:

• Expo — 650 Industries, Inc. (USA): when the App opens, it asks Expo's update server whether an update is available. Only the technical data above is sent with this request; no report or business data is sent.

Retention

Your user record is kept for as long as your relationship with your business continues. When the record is closed, your user details are deleted; records that legislation requires us to keep are retained for the statutory period. See the Account Deletion page for details.

Children's privacy

The App is for business use and is not directed at anyone under 18; we do not knowingly collect data from children.

Your rights

Under KVKK Article 11 you have the right to learn whether your personal data is processed, to request information, to ask for correction or deletion, to object to processing and to claim compensation for damage.

Send your requests, with information that verifies your identity, to [email protected] or to the registered e-mail address [email protected]. Requests are answered within 30 days at the latest.

If you are named in the reports as a member of staff or a customer account holder, you can first contact the business concerned about your data.

Changes

When this policy is updated, the effective date changes and the current text is published on this page. Significant changes are announced in the App.

Contact

For privacy questions [email protected], for technical support [email protected].