Privacy Policy | SUSOFTECH

Data controller / service provider:
SU AGENCY DANIŞMANLIK VE YAZILIM BİLİŞİM TEKNOLOJİLERİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ
Address: Bulgurlu Mah. Kızıltepe Sk. Malatya Teknokent, Teknokent-B No: 3/1, Door No: B12, Battalgazi / Malatya, Türkiye
Tax office / tax no: Fırat Tax Office — 7811093542
E-mail: [email protected]
Phone: +90 507 579 44 74

1. Scope

This Privacy Policy explains how information is collected, used, protected and shared when you use the website, the store administration panel and the related services provided through susoftech.com and its subdomains. For the processing of personal data under Turkish data protection law please see our Data Protection Notice, and for cookies our Cookie Policy.

2. Our principles

We do not ask for more than we need. Our forms only request the fields required to answer your enquiry.
We do not sell your personal data and we do not transfer it to third parties for marketing purposes.
We never see your card details. Payments are processed on the infrastructure of licensed payment institutions.
Our visitor measurement is cookie-free. We do not place an identifier on your device; visitors are distinguished with an irreversible digest based on a key that changes daily.

3. What information do we collect?

3.1. Information you give us

Your name, e-mail address, phone number, company name and message content submitted through contact and quote forms, the live chat box, phone and e-mail. If you become a customer, your billing details as well.

3.2. Information collected automatically

Our server logs record your IP address, browser and device information, the pages viewed, the time of the visit and the referring address, if any. This information is kept for security and statistical purposes.

3.3. Time spent on a page

How long you stay on a page is measured only if you consent to analytics cookies. The timer runs only while the page is visible and stops when the tab moves to the background.

4. What do we use the information for?

To respond to your enquiry and prepare a quote.
To manage your account and subscription and to issue invoices.
To resolve your support requests and fix technical problems.
To keep the site secure and to prevent attacks and abuse.
To understand which content works and to improve the site.
To send campaigns and announcements, if you have consented.

5. Your Google accounts and Google API services

SUSOFTECH applications — SUSOFTECH Store Panel, E-Com Assistant and SU AGENCY Ads Management — connect to your Google account only when you explicitly authorise it. The connection is established through Google's own consent screen (OAuth); you can see exactly which permissions you grant and you can revoke them at any time. We never see or store the password of your Google account. This section explains how we access, use, protect, share and delete the data obtained from your Google account (Google user data).

5.1. Which Google data do we access?

We access only the data of the service you have connected, within the scope you granted. No data is retrieved from a service you have not connected.

Account identity (basic profile): the e-mail address, name and profile picture of your Google account. Used only to show which account is connected and to confirm that we are working with the correct account.
Google Ads API: ad account id and name; your campaign, ad group, ad and keyword structure; impression, click, cost and conversion statistics; conversion actions and budget information. If you grant write access, changes to campaigns, budgets and ads are made only at your request or with your approval.
Merchant Center / Content API for Shopping: merchant account id; your product feeds, product and variant records, price and stock information, product approval or disapproval status and product performance reports.
Google Business Profile API: business name, address, location, phone, opening hours and categories; reviews left for your business and the replies to those reviews; the posts you publish and business performance summaries.
Search Console and Google Analytics API: site performance reports (search queries, impressions, clicks, average position, indexing status) and aggregated visit and behaviour statistics. No individual visitor identity is retrieved in this scope.
Access and refresh tokens: the tokens issued by Google so that the connection can continue. Tokens are stored encrypted, belong to you alone and are never associated with another customer's account.

5.2. What do we use this data for?

To display your advertising, product, business profile and search performance in the panel and in reports.
To carry out campaign, budget, product feed and business profile operations at your request.
To synchronise product, stock and price data with your store and to report rejected or faulty products.
To collect reviews in one screen and to publish the replies you write or approve.
To operate the service, fix errors, resolve your support requests and prevent abuse.

We process the data only to the extent necessary to provide the service to you. Our operation logs record which action was taken, when and at whose request.

5.3. What do we never use it for?

We do not use data obtained from your Google account, and do not transfer it to third parties, for any of the following purposes:

Serving targeted, personalised, retargeted or interest-based advertising.
Selling or transferring it to data brokers, information resellers or any other recipient.
Determining creditworthiness or making lending decisions.
Building a marketable database or profile pool.
Developing, improving or training generalised or non-personalised artificial intelligence (AI) or machine learning (ML) models. Data received from Google APIs is never used for this purpose.

Google user data is not read by humans, except in the following cases: you give your explicit consent; a security incident or abuse investigation requires it; the law requires it; or the data has been aggregated and de-identified for internal reporting.

5.4. Sharing and transfers

We do not sell data obtained from your Google account. It is shared only:

On your instruction: e.g. with the agency contact or your own team member you want to have access to your account.
With infrastructure providers required to run the service: hosting and backup services, which process the data only on our behalf, on our instructions and under a confidentiality obligation.
Where legally required: upon a lawful request from a competent authority.

Our servers are located in Türkiye. The connection established through Google APIs retrieves the data directly from Google's infrastructure; Google's own privacy policy also applies to that processing.

5.5. How do we protect Google data?

All transfers are encrypted with TLS; unencrypted connections are not accepted.
Access and refresh tokens are stored encrypted, are never displayed in the panel and are never exported.
Each customer's data is isolated to their own account; one customer's connection can never reach another customer's data.
Access is limited to staff who need it for their duties and is logged.
Scopes are requested on a least privilege basis; we do not request permissions the work does not require.

5.6. Retention, disconnecting and deletion

Tokens and data obtained from Google are retained for as long as the connection remains active.
When you end the connection with “Disconnect Google” in the panel, the tokens are deleted immediately and the related Google data is removed from our systems within 30 days at the latest; it ages out of backups within 90 days.
You can also revoke the authorisation directly at Google: Google Account → Third-party apps. The connection then stops working and the same deletion periods apply.
When you close your account, all Google connections are terminated and the data is deleted within the same periods.
You may also send a deletion request to [email protected]; requests are completed within 30 days at the latest.

5.7. Google API Services User Data Policy (Limited Use)

SUSOFTECH's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Information security

All site traffic is encrypted with SSL/TLS; unencrypted connections are not accepted.
Access to the administration panel is limited by username, password and permission level; passwords are stored as irreversible hashes (bcrypt).
Forms and panel operations are protected by CSRF protection, and automated attacks by bot protection and rate limiting.
Databases and files are backed up regularly.
Our servers are located in Türkiye.
Access to personal data is limited to staff who need it for their duties.

Nevertheless, no transmission over the internet or electronic storage can be guaranteed to be 100% secure. In the event of a data breach we notify the Turkish Personal Data Protection Authority and the affected individuals as soon as possible, in line with Article 12/5 of the Turkish Data Protection Law.

7. Children's privacy

Our services are intended for commercial use and are not directed at anyone under 18. We do not knowingly collect personal data of people under 18. If we become aware that such data has reached us, we delete it without delay.

8. Third-party links

Our site may contain links to other sites and embedded content (maps, social media). We are not responsible for the privacy practices of those sites; we recommend that you review their own policies. Embedded content is not loaded unless you explicitly request it by pressing a button.

9. Commercial electronic messages

We send campaign, promotional and announcement messages only if you have consented. Every message contains a free opt-out; you may also withdraw your consent through the Contact page or by writing to [email protected]. Opt-out requests are processed within three business days of receipt.

10. Changes

This policy may be updated from time to time. When an important change is made, the update date at the bottom of the page changes; for substantial changes we also inform you through the site. If the way we use Google user data changes, we will notify affected users.

11. Contact

For any question or request regarding privacy, please write to [email protected] or call us on +90 507 579 44 74.