Last updated
Scope and responsibility
Zeva Software is an independent software team without separate legal personality. This policy covers our website, accounts, digital services, project enquiries and communications. Contact contact@zevasoftware.com about privacy.
Responsibilities for customer users’ data in systems developed or managed for a customer are set out in the project agreement. Independent linked services have their own policies.
Personal data we process
We process account identity and contact details, identifiers and basic profiles received from sign-in providers, and fields you supply. We also process your messages, project requirements, files and support correspondence.
Services may process account settings, records you create and usage results. Connections may generate IP addresses, browser and device details, request times, errors and security logs. The scope depends on the feature. Do not send unnecessary sensitive information or other people’s data.
Purposes and legal grounds
Data directly necessary for accounts, enquiries, services, projects and support is processed to establish or perform a contract. Security and troubleshooting rely on legitimate interests without harming fundamental rights; mandatory records on legal duties; and dispute records on establishing, exercising or defending a right.
Optional activities requiring explicit consent have a separate choice. Reading this policy or visiting the site does not itself give consent. We do not sell data or use it for behavioural advertising profiles or AI model training.
Cookies and device preferences
Necessary cookies may support sign-in and security. Local storage may remember preferences, saved content or completed interface steps. These records are not used for advertising tracking.
You can delete or block these records in your browser, which may affect sign-in and remembered preferences. External resources such as fonts may send the technical information needed for a connection to their provider.
Providers and transfers
Hosting, storage, authentication and communications providers may receive data needed for their function. Your chosen external sign-in provider operates its own service. Competent authorities may receive information where a valid legal request or duty requires it.
Foreign providers may process data abroad. Transfers are subject to applicable legal conditions; using a service is not blanket explicit consent to international transfers. You may ask about recipient categories and the transfer process for your service.
Retention and deletion
Data is retained as needed: account and service records during the relationship, support messages to resolve and follow up requests, and security logs to investigate incidents. Legal duties or disputes may require certain records for longer.
When the processing basis ends, data is deleted, destroyed or anonymised. On closure or deletion requests, mandatory records are separated and use restricted. Backup copies may be removed through backup renewal; closure does not delete every copy simultaneously.
Security and access
We use encrypted connections, access restrictions and security controls against unauthorised access, loss and alteration. Access should be limited to people who need it for their work. No internet system guarantees absolute security.
Protect your account and sign-in provider account, and report suspected unauthorised use. Do not include passwords, secret keys or tokens in support messages.
Rights and requests
Under applicable law you may ask whether data is processed, request information about its purpose, use and recipients, correct incomplete or inaccurate data, and request deletion or destruction where conditions are met. Turkish law also provides rights to request notification of relevant actions to recipients, object to adverse outcomes from solely automated analysis, and seek compensation for unlawful processing.
Send requests to contact@zevasoftware.com identifying the account and request. Proportionate identity verification may be needed. Proper requests under Turkish data protection law are concluded within thirty days; other applicable statutory deadlines are preserved. Your right to approach a competent data protection authority remains unaffected.
Children’s privacy
Our services are not directed at children under 13. Age requirements and, where necessary, parental or legal representative consent apply to minors. Report suspected submission of a child’s data without the required authority so we can investigate and act.
Policy changes
We revise this text and its date when operations or legal duties change. Changes materially affecting rights or data use are communicated appropriately. Revising this text does not replace separate consent where required.