Privacy Policy

Last updated: 24 August 2026

This policy explains how personal data collected through vsmesmart.com and app.vsmesmart.com is processed. It is intended to satisfy our information obligations under the EU General Data Protection Regulation (GDPR) and under Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

1. Who we are

The controller is {{TICARI_UNVAN}} (“VSMESmart”, “we”), of {{ADRES}}, registered under number {{MERSIS}}. For any question or request, write to info@vsmesmart.com.

2. What we process

a) Account and contact data

Name, business email address, telephone number, job title, company name and billing details. We need these to create your account, communicate with you and issue invoices.

b) Reporting data

The sustainability data you enter into the platform: energy consumption, greenhouse gas emissions, water and waste figures, headcount, accident records, pay and training data, and information about your policies and processes.

Most of this is company data rather than personal data. Some fields — headcount, gender distribution, accidents and pay — are processed in aggregate form. The VSME standard does not call for individual-level data, and we do not ask you to provide any. Please do not enter the names, identity numbers or health information of individual employees into the platform.

c) Technical data

IP address, browser and device information, session records and cookie data, processed for security, error handling and the operation of the service.

3. Purposes and legal bases

  • Performance of a contract — opening your account, providing the platform, generating your report. GDPR Art. 6(1)(b); KVKK Art. 5/2-c.
  • Legal obligations — invoicing, tax and commercial record-keeping. GDPR Art. 6(1)(c); KVKK Art. 5/2-ç.
  • Legitimate interests — platform security, prevention of misuse, service improvement. GDPR Art. 6(1)(f); KVKK Art. 5/2-f.
  • Consent — non-essential cookies and marketing messages. GDPR Art. 6(1)(a); KVKK Art. 5/1. You may withdraw consent at any time.

4. Your reporting data belongs to you

The sustainability data you enter is used solely to produce your report. It is:

  • never shared with third parties, sold, or published;
  • stored against your account only, and not visible to other customers;
  • never used to train artificial intelligence models. Reports are generated from pre-approved sentence structures rather than by a language model, and your data is not sent to any external service for that purpose;
  • shared onward only by you, with whomever you choose.

Supplier network accounts work differently: if you joined the platform at the invitation of a buyer, the data you enter is shared with the organisation that invited you. This follows from the nature of the service and is made clear to you at the point of invitation.

5. Recipients

  • Our hosting provider — our servers are located in Türkiye.
  • Our payment provider — card details never reach us; they are processed by the payment infrastructure.
  • Email and support infrastructure — so that we can correspond with you.
  • Competent public authorities — only where required by law and only to the extent required.

6. International transfers

Your data is hosted on servers located in Türkiye. If you are established in the European Economic Area, this constitutes a transfer to a third country for the purposes of the GDPR. Türkiye is not covered by an adequacy decision of the European Commission, and the transfer therefore takes place on the basis of the Standard Contractual Clauses under Art. 46 GDPR. You may request a copy of the safeguards in place by writing to info@vsmesmart.com.

7. Retention

  • Account and reporting data: for as long as your account is active, and for 12 months after closure, so that you can compare against the previous year when you next report. You may ask us to delete it sooner.
  • Invoicing and accounting records: 10 years, as required by tax law.
  • Technical and security logs: 12 months.
  • Correspondence: 3 years from resolution of the matter.

8. Your rights

Under Articles 15–22 GDPR and Article 11 KVKK you have the right to:

  • learn whether your personal data is processed, and obtain access to it;
  • have inaccurate or incomplete data corrected;
  • have your data erased;
  • request restriction of processing;
  • receive your data in a structured format and have it transmitted to another controller;
  • object to processing based on legitimate interests;
  • withdraw consent at any time;
  • claim compensation for damage suffered.

Please send requests to info@vsmesmart.com. We respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the supervisory authority in your country of residence, or with the Turkish Personal Data Protection Authority.

9. Cookies

We use strictly necessary cookies to maintain your session and keep the platform secure; the service cannot function without them. Analytics and marketing cookies are set only with your consent. You can change your preferences at any time through the cookie banner.

10. Security

Data is encrypted in transit using TLS. Access to the platform is restricted through role-based authorisation, and our staff can access only the data their role requires. Backups are taken regularly. In the event of a data breach we will notify the individuals concerned and the competent authorities within the periods prescribed by law.

11. Changes

We may update this policy from time to time. Where a change is material we will notify registered users by email. The date at the top of this page indicates the version in force.

VSMESmart is a reporting support tool and does not provide audit or assurance services.