Privacy Policy

Who is the data controller?

Each company using Motiva (your employer) is the data controller for its own personnel data. Motiva acts as a data processor, processing that data on the employer's behalf and under its instructions. Accounts cannot be created inside the app; your account and credentials (staff number, PIN) are issued by your employer.

What data is processed?

The mobile app and platform process the minimum data required to run the employment relationship:

• Identity and organisation data: full name, staff number, department, position (defined by the employer).
• Working records: clock-in/out (punch) times, shift plans, leave and overtime requests, attendance results.
• Location: captured once, only at the moment you clock in/out by scanning a QR code, and attached to that punch as proof of presence at the workplace. There is no background location tracking; no location is collected while the app is closed or when you are not scanning.
• Camera: used solely to decode the QR code. No image is recorded, stored or transmitted off the device.
• Technical data: app version, language preference and session data (kept in the device's secure storage).
• The website uses no marketing or tracking cookies.

Purposes and legal basis

Data is processed to record working time, run attendance and payroll processes correctly, operate leave and overtime approval flows, and meet statutory obligations. Legal bases under KVKK art. 5/2 are: explicit provision by law (Turkish Labour Law no. 4857, social security legislation), performance of the employment contract, and the employer's legitimate interest. Data is not used for any other purpose.

Retention

Working records are retained for the statutory periods required by labour and social security legislation; afterwards they are deleted or anonymised according to the employer's retention policy.

Data sharing

Personal data is never sold, rented or shared with third parties for marketing. Data may only be shared with hosting/infrastructure providers (under data processing agreements) and with competent public authorities where legally required.

Security

All data is transmitted over encrypted connections (TLS). PINs are stored as irreversible hashes; session data is kept in the device's secure storage. Each employee can access only their own data; administrative access is role-based. Raw punch records are immutable; corrections are added as separate, attributable records.

Your rights

Under KVKK art. 11 you may request access to, correction or deletion of your data, and object to processing. As your employer is the data controller, please direct requests to your employer first; you may also contact us at info@motiva.solutions. Requests are answered within the statutory deadlines.

Changes

When this policy is updated, the new version is published on this page with a revised date.

Contact

For questions: info@motiva.solutions