Privacy policy
Last updated: 2026-10-21
This policy explains what personal data Kroveo collects when you visit kroveo.com or use the Kroveo app at app.kroveo.com, why we collect it, how long we keep it and what rights you have. Kroveo is offered to businesses only.
Who we are
Kroveo is operated by Deka Teknoloji Bilişim Hizmetleri ve Ticaret A.Ş. (“Deka”, “we”), Aydınevler Mah. Durak Sok., Ofisin Maltepe A Blok Kat 2, 34854 Maltepe / Istanbul, Türkiye. Trade registry no. 705808 (Istanbul), MERSİS no. 0827060634600013, VERBİS registration no. 10183770. Phone +90 216 606 69 57.
- For website, sign-in, account and sales data, Deka is the data controller.
- For the content and data in your organisation’s workspace, your organisation is the controller and Deka processes it on its behalf under our Data Processing Agreement.
Deka is not required to appoint a data protection officer and has not done so. Privacy questions: privacy@kroveo.com.
What we collect
- Account data from your sign-in provider: name, email address, profile picture and your organisation’s Microsoft tenant or Google Workspace domain. If your organisation’s admin invites you, we receive your name and email address from your organisation.
- Workspace content: images, descriptions, Power BI files and their data, brand assets and the reports Kroveo generates for you.
- Usage and security logs: actions such as sign-ins, uploads, downloads, shares and deletions, with time, IP address and browser.
- Demo and contact requests: name, work email, company, BI platform, your message, whether you asked to talk to Deka’s consultants, and the page and campaign that brought you to us (UTM parameters and referring website).
- Website visits: Cloudflare Web Analytics counts page views without cookies and without building a profile of you. Cloudflare Turnstile checks that a form is submitted by a person, using your IP address and browser signals.
We do not use advertising pixels or cross-site tracking.
How we use it and on what legal basis
| Purpose | Legal basis (GDPR / KVKK) |
|---|---|
| Provide the service: sign-in, build, store and publish reports | Contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Keep the service secure: detect abuse, investigate incidents, audit trail | Legitimate interest (Art. 6(1)(f); KVKK Art. 5(2)(f)) and legal obligation (KVKK Art. 5(2)(ç)) |
| Reply to demo and contact requests | Steps before a contract and legitimate interest (Art. 6(1)(b), (f); KVKK Art. 5(2)(c), (f)) |
| Put you in touch with Deka’s BI consultants, only if you tick that box | Your request (Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Count visits and campaign results in aggregate | Legitimate interest (Art. 6(1)(f); KVKK Art. 5(2)(f)) |
Your workspace content is yours. We use it only to run Kroveo for your organisation. We do not use it to train AI models, and we do not use it for Deka’s sales or consulting activities. If you are a consultant building reports for your own clients, your clients’ material stays in your workspace.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
We send marketing emails only with your separate, explicit consent; Kroveo does not currently send any.
Google user data
When you sign in with Google we receive your name, email address and profile picture and use them only to create and secure your Kroveo account. Kroveo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share it with
We do not sell personal data. We use these service providers (sub-processors), also listed on our security page:
- Cloudflare, Inc. (USA) — hosting, database, file storage, CDN, bot protection (Turnstile) and cookieless analytics.
- Microsoft — sign-in with Entra ID and, when you choose, publishing to your Microsoft Fabric workspace.
- Google — sign-in with Google.
- Your organisation’s AI provider (OpenAI or Microsoft Azure OpenAI) — through the key your organisation adds; your organisation’s agreement with that provider applies.
We may disclose personal data to public authorities where the law requires it.
International transfers
Deka is established in Türkiye, and some providers process data outside Türkiye and the EEA. For transfers from the EEA, the UK and Switzerland we rely on the EU–US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses (GDPR Art. 46(2)(c)) with the UK and Swiss addenda; for your organisation’s workspace data these clauses are part of our Data Processing Agreement. For transfers from Türkiye we rely on the safeguards in KVKK Art. 9. Your workspace content is stored in Cloudflare data centres located in the European Union.
How long we keep it
- Workspace content: until you or your organisation delete it; deletion removes it from storage and the database. After the subscription ends, content is kept for 30 days so you can export it, then deleted within a further 30 days.
- Account data: while the account is active, then deleted within 30 days.
- Security and audit logs: 12 months.
- Demo and contact requests: 12 months after our last contact, or longer if a contract follows (commercial records: up to 10 years under TTK Art. 82 and VUK Art. 253).
- Cloudflare Web Analytics: aggregated, without personal profiles.
Your rights
Under GDPR (Art. 15–22) and KVKK (Art. 11) you can ask to access, correct, delete or export your data, to restrict or object to processing, to learn who received it and to withdraw consent. Email privacy@kroveo.com or send a letter to our address above. We reply within one month (30 days under KVKK), free of charge. If your request concerns your organisation’s workspace, we pass it to your organisation’s admin, who decides as controller.
You can complain to the KVKK Board (kvkk.gov.tr) or to your EU supervisory authority (edpb.europa.eu). Turkish residents can read our KVKK aydınlatma metni.
Cookies
We use only strictly necessary cookies: one keeps you signed in to the app and one protects forms against forgery. Analytics does not use cookies. Because of this, there is no cookie banner. Details: cookie notice.
Security
See our security page. Deka is certified to ISO/IEC 27001, ISO 22301 and ISO/IEC 20000-1.
Changes
If we change this policy in a meaningful way, we tell admins by email at least 14 days before it takes effect. The date at the top shows the latest version.