Privacy Notice on the Protection and Processing of Personal Data
Data Controller: Luminis Lojistik Teknoloji Ticaret Danışmanlık Hizmetleri Limited Şirketi
Effective Date: July 10, 2026
This privacy notice has been prepared by Luminis Lojistik Teknoloji Ticaret Danışmanlık Hizmetleri Limited Şirketi (hereinafter referred to as "Luminis" and "COMPANY"), in its capacity as data controller, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the "Law") for the purpose of fulfilling the obligation to inform.
Scope of This Notice and Our Capacity
This privacy notice concerns only the personal data that Luminis processes in its capacity as data controller. This includes the data of individuals visiting our websites, those wishing to obtain information about our application, and the representatives and administrators of the customer (employer) organizations that register with Rota, relating to their account, billing, marketing, and website usage.
With respect to the workforce data that employers process about their own employees through the Rota platform (such as shifts, location, clock-in/out, leave, and documents), the data controller is the relevant employer organization; Luminis processes such data solely on the employer's instructions, in its capacity as data processor. If you are an employee and wish to exercise your rights regarding your personal data, you must direct your requests to your employer, who is the data controller.
What Is the Method and Reason for Personal Data Collection?
We collect and record your personal data through the Rota mobile application, https://rota-app.com, and https://my.rota-app.com, which are interconnected and serve a common purpose. Due to the service we provide, the data of individuals visiting our website, those wishing to obtain information about our application, and the representatives of customer organizations registering with the system are processed and securely stored in accordance with the Law.
Your personal data is processed through cookies and other automated and non-automated methods, provided that it is part of a data recording system and in accordance with the purposes above and the Law, under the conditions specified in Article 5 of the Law (including explicit legal provisions, fulfillment of legal obligations as the data controller, direct relevance to the establishment and performance of a contract, and the legitimate interests of the data controller), without causing harm to the fundamental rights and freedoms of the data subject.
For What Purpose Will Your Personal Data Be Processed?
Our COMPANY aims to process personal data in accordance with Law No. 6698 on the Protection of Personal Data and other applicable legislation. Personal data that you notify or will notify our company due to visiting our website or receiving services from us, and/or that is obtained externally by our company, shall be processed by our company as "Data Controller":
- Within the framework of the purpose requiring processing and in a manner connected, limited, and proportionate to this purpose,
- By maintaining the accuracy and most current state of personal data as notified to or by our company.
We inform you that your personal data will be recorded, stored, preserved, reorganized, shared with institutions legally authorized to request such personal data, and processed under the conditions stipulated by the Law.
Your personal data may be processed by our Company for the following purposes: Execution of Information Security Processes, Execution of Audit / Ethics Activities, Execution of Activities in Compliance with Legislation, Execution of Finance and Accounting Affairs, Execution of Brand / Product / Service Loyalty Processes, Follow-up and Execution of Legal Affairs, Execution / Audit of Business Activities, Receipt and Evaluation of Suggestions for Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Goods / Service Procurement Processes, Execution of Goods / Service After-Sales Support Processes, Execution of Goods / Service Production and Operation Processes, Execution of Product Training Activities and Corporate Organizations for Customer (Employer) Representatives, Execution of Customer Relationship Management Processes, Execution of Marketing Analysis Studies, Execution of Storage and Archive Activities, Execution of Contract Processes, Development and Optimization of Products and Services, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions, and Organizations, and Execution of Management Activities.
Your personal data will be retained for the period specified in the relevant legislation or the reasonable period until the purpose of processing ceases, and in any case for the duration of the statutory limitation periods.
Which Personal Data Will Be Processed?
| Data Category | Scope |
|---|---|
| Identity Data | Full name, role/title (representative of the customer organization). |
| Contact Data | Phone number, email address, open address information. |
| Financial Data | Billing and payment information, IBAN, bank information, tax identification number, tax office. |
| Transaction Security / Digital Trace Data | IP address, cookie records, session and usage logs, device and browser information. |
| Marketing Data | Commercial electronic message preferences, corporate contact and lead information. |
The specified personal data does not mean that it is mandatorily collected and processed from all representatives of customer organizations visiting our website or registering with our application within the scope of contracts. Such personal data is processed and stored as detailed in our cookie privacy notice through automated means, or when communicated to us by the relevant person.
To Whom and for What Purpose May Your Processed Personal Data Be Transferred?
Your personal data may be transferred to our infrastructure service providers acting as data processors under written contracts (Supabase, Inc., Vercel, Inc., Expo / EAS) for the provision of technical services such as hosting, database, authentication, and application distribution; to our financial advisor for the execution of our finance and accounting processes; and to relevant public institutions, judicial authorities, or relevant law enforcement upon request for the resolution of disputes or pursuant to legislation, in accordance with the transfer conditions specified in Articles 8 and 9 of the Law and provided that adequate measures are taken.
What Are the Rights of the Data Subject Under Article 11 of the Law?
As a personal data subject, we hereby inform you that you have the following rights under Article 11 of the Law:
- To learn whether your personal data is processed,
- To request information if your personal data has been processed,
- To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
- To know the third parties to whom your personal data is transferred within or outside Turkey,
- To request the correction of your personal data if incompletely or incorrectly processed, and to request that such correction be communicated to third parties to whom your personal data has been transferred,
- To request the deletion or destruction of your personal data when the reasons requiring its processing have ceased, despite being processed in accordance with the Law and other relevant legislation, and to request that such deletion or destruction be communicated to third parties to whom your personal data has been transferred,
- To object to the occurrence of a result against yourself due to the analysis of your processed data exclusively through automated systems,
- To request compensation for damages incurred due to the unlawful processing of your personal data.
You may submit your applications regarding the above-listed rights by filling out the Data Subject Application Form available at rota-app.com/legal or physically obtainable from us, and by mailing it to our Company's address at Küçükbakkalköy Mah. Yüksel Sk. No: 10 A Ataşehir/İstanbul, Turkey, by emailing it to privacy@rota-app.com, or by delivering it physically. Depending on the nature of your request, your applications will be finalized free of charge as soon as possible and no later than thirty days; however, if the operation requires additional cost, a fee may be requested from you in accordance with the tariff determined by the Personal Data Protection Board. In case of rejection of the request, the reason(s) for rejection will be communicated to you in writing or electronically with justification.
This document is provided for informational purposes only. The legally binding version is the Turkish original.