Mobile App Privacy Policy
Mobile App Privacy Policy
- Data controller: Figo Ticari Bilgi ve Uygulama Platformu A.Ş.
- Application: Figopara – Android package name: com.figopara.app
- Version: 1.0
- Effective date: 26.10.2026
This Privacy Policy applies to the mobile application published as Figopara on Google Play and the App Store (Android package name: com.figopara.app) by Figo Ticari Bilgi ve Uygulama Platformu A.Ş. (“Figopara” or the “Company”). It explains what user and device data the app processes, the purposes and legal bases of that processing, the parties with whom the data is shared, how long it is retained, how it is deleted, and your rights as a data subject.
If you use the app, your personal data is processed under this Policy together with the Privacy Notice for Platform Users. The two documents complement each other; this Policy prevails on matters specific to the app.
1. DATA CONTROLLER AND CONTACT
Under Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller is the Company identified below.
- Legal name: Figo Ticari Bilgi ve Uygulama Platformu A.Ş.
- Trade name: Figopara
- Address: Barbaros Mah. Kardelen Sk. Palladium Tower No:2 Door No:58, Ataşehir/İstanbul, Türkiye
- MERSİS no.: 0387059306400016
- Trade registry no.: 51451-5
- Telephone: +90 216 599 00 22 – Support line: 0850 242 34 46
- Privacy enquiries: kisiselverilerikorumakomitesi@figopara.com
- Registered e-mail (KEP): figoticaribilgi@hs01.kep.tr
- App support: destek@figopara.com
You may send any question, request or application concerning privacy and the protection of personal data to the addresses above. The application procedure is set out in Section 13.
2. SCOPE OF THIS POLICY
This Policy covers only the processing of personal data carried out through the Figopara mobile application. The privacy notices of third-party services accessed from within the app continue to apply to those services.
The Policy is kept permanently accessible from the Profile and Settings sections of the app and at figopara.com.
3. PERSONAL DATA WE PROCESS
The following personal data is processed through the app:
| Data category | Data processed |
|---|---|
| Identity and account data | Name and surname, Turkish national ID number or tax ID number, date of birth, company name and job title |
| Contact data | E-mail address, mobile telephone number |
| Account security data | Login password (stored as an irreversible hash), two-factor authentication records, session tokens |
| Financial and transaction data | Financing applications, invoice and cheque details, payment and transaction records, risk and score assessment outputs |
| Payment card data | If you pay by card in the app, card details are transmitted to the payment service provider; cards you choose to save are stored by the payment service provider as encrypted tokens |
| Uploaded documents | Invoice and cheque files you upload and images you scan |
| Device and technical data | Device model, operating system and version, app version, IP address, error and crash logs |
| Usage data | In-app screen and feature usage, session information; this data may be linked to your user ID |
| Device identifiers | Firebase app instance ID, push notification token and the Android Advertising ID |
| Request and complaint data | The content of requests, complaints and correspondence you send to our support channels |
The app does not process your location, contacts, messages or call logs. The Advertising ID is used solely to measure and analyse app usage; the app displays no advertising and the Advertising ID is not used for advertising profiling.
The app set ID and the Firebase app instance ID are used solely for analytics, measurement and fraud prevention. They are not used for personalised advertising or advertising measurement, and they are not linked to the Android Advertising ID or to personally identifiable information for advertising purposes.
The app does not collect persistent device identifiers such as the IMEI, IMSI or SIM serial number, and does not link such identifiers to any other personal data or to resettable device identifiers.
Personal data is obtained by automated and partly automated means when you sign in, complete forms, upload documents and use the app.
4. DEVICE PERMISSIONS
The following permissions are requested only when you use the relevant feature and can be revoked at any time in your device settings. Declining a permission does not make the app as a whole unusable; only the relevant feature stops working.
| Permission | Purpose | If declined |
|---|---|---|
| Camera | To scan cheque and invoice images and to read QR codes | Document scanning and QR code reading will not work |
| Photos, files and storage | To upload invoices and documents and to download receipts and documents to your device | Documents cannot be uploaded or downloaded |
| Notifications | To deliver transaction, application and security notifications | No notifications are sent; updates must be followed within the app |
| Internet and network state | To connect to the app's services | The app will not function |
5. PURPOSES AND LEGAL BASES OF PROCESSING
Your personal data is processed for the purposes below on the processing conditions set out in Articles 5 and 6 of the KVKK. Where no such condition applies, your explicit consent is sought.
| Purpose | Legal basis |
|---|---|
| Account creation, sign-in, authentication (including two-factor authentication) and account security | KVKK Art. 5(2)(c) – necessary for the conclusion or performance of a contract |
| Carrying out invoice, cheque, financing application and payment processes; transmitting your applications to financial institutions | KVKK Art. 5(2)(c) – necessary for the conclusion or performance of a contract |
| Fulfilling accounting, tax and record-keeping obligations | KVKK Art. 5(2)(a) and (d) – expressly provided for by law and compliance with a legal obligation |
| Managing user support, resolving requests and complaints | KVKK Art. 5(2)(c) and (f) – performance of a contract and legitimate interests |
| Analysing app usage, monitoring performance, detecting errors and improving the product | KVKK Art. 5(2)(f) – legitimate interests of the data controller |
| Fraud prevention, risk assessment and information security | KVKK Art. 5(2)(f) – legitimate interests of the data controller |
| Regulatory compliance, responding to requests from competent authorities and conducting legal proceedings | KVKK Art. 5(2)(a), (d) and (e) – provided for by law, compliance with a legal obligation, and establishment or protection of a right |
| Sending commercial electronic messages and marketing activities | Explicit consent (KVKK Art. 5(1)) and approval under Law No. 6563 |
Figopara is not a financing institution. Your financing applications are transmitted to financial institutions under the agreements concluded through the Platform, and the financing is provided by those institutions.
6. AUTOMATED SYSTEMS AND AI-ASSISTED ASSESSMENT
Automated and AI-assisted decision support systems may be used when assessing financing applications, calculating risk and scores, detecting fraud and prioritising workflows. The output of these systems is not the sole determinant of the outcome of your application; the final assessment is completed with human review.
Under Article 11 of the KVKK, you have the right to object to any outcome that is adverse to you and arises from the analysis of your data exclusively by automated systems.
7. PARTIES WITH WHOM DATA IS SHARED
Personal data is shared only to the extent necessary for the purposes below and with technical and organisational measures that comply with the KVKK. Personal data is not sold.
| Recipient group | Purpose of sharing |
|---|---|
| Google LLC (Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging) | App usage analytics, error and crash monitoring, push notifications |
| Payment service provider (Craftgate) | Processing card payments and storing saved cards |
| Banks and financial institutions | Carrying out the financing transactions you request and payment processes |
| Infrastructure, hosting, software and e-mail server providers | Technical delivery of the service, storage and archiving |
| E-invoice partner, commercial messaging infrastructure provider and the Message Management System (İYS) | Sending e-invoices and informational messages, managing consent records |
| Data verification partners and notaries | Verifying information and certifying documents |
| Lawyers, independent auditors, certified accountants and advisers | Conducting legal matters, audits and regulatory compliance activities |
| Competent public authorities | Where required by law |
The privacy notices of Google and Craftgate also apply to the processing they carry out; those notices are available at policies.google.com/privacy and craftgate.io.
8. TRANSFERS ABROAD
Personal data relating to Firebase services and to certain infrastructure and hosting services is processed on servers located outside Türkiye.
Transfers abroad are carried out within the conditions set out in Article 9 of the KVKK, relying on appropriate safeguards — in particular the standard contract published by the Personal Data Protection Board — on binding corporate rules, on the exceptions provided for in the Law, or on your explicit consent. Before any transfer, the level of protection in the recipient country and the technical and organisational measures in place are assessed.
9. DATA SECURITY
The following technical and organisational measures, among others, are applied to prevent the unlawful processing of personal data, unauthorised access to it, and its unlawful disclosure, alteration or destruction:
- use of HTTPS/TLS encryption for data in transit;
- storage of passwords as irreversible hashes and their encryption in transit;
- storage of session data in encrypted storage on the device;
- protection of account access by two-factor authentication and authorisation controls;
- limitation of employee access rights to what their role requires, with rights revoked immediately on role change or departure;
- retention of access logs in a form not open to user interference, with regular monitoring;
- firewall, malware protection and penetration testing;
- confidentiality undertakings from employees and regular information security training;
- conclusion of confidentiality and data processing agreements with service providers acting as data processors.
The Company operates its information security processes within an Information Security Management System aligned with ISO/IEC 27001 and ISO/IEC 27701. Further detail is set out in the Information Security Policy.
10. RETENTION PERIODS AND DESTRUCTION
Personal data is retained for the period necessary for the purpose of processing and for the period prescribed by the applicable legislation. The periods applied are as follows:
| Data category | Retention period | Legal basis |
|---|---|---|
| Account and profile data, uploaded documents, usage and device data | Until the account is closed; if the account is deleted, erased when the request is completed | KVKK Art. 7 |
| Records constituting commercial books and documents (invoices, cheques, transaction records) | 10 years | Turkish Commercial Code Art. 82; Tax Procedure Law Art. 253 |
| Records arising from a contractual relationship | 10 years from termination of the contract | Turkish Code of Obligations Art. 146 |
| Internet and access log records | 2 years | Law No. 5651 |
| Commercial electronic message consent records | 3 years from the date the consent ceases to be valid | Law No. 6563 and its Implementing Regulation |
Once the retention periods expire, personal data is erased, destroyed or anonymised. The periodic destruction interval is six months. Detailed rules are set out in the Personal Data Retention and Destruction Policy.
11. ACCOUNT AND DATA DELETION REQUESTS
You can delete your Figopara account and its associated data directly in the app:
- Tap the Profile tab in the bottom navigation.
- Select Delete Account from the menu.
- Follow the on-screen steps to confirm the deletion.
If you cannot access the app, or if you have uninstalled it, you may also request deletion by sending an e-mail from your registered e-mail address to kisiselverilerikorumakomitesi@figopara.com with the subject “Account Deletion Request”. Please state your name and surname, your registered mobile telephone number and your company name. Once your identity has been verified, your request is completed within thirty days at the latest and the outcome is notified to you by e-mail.
Data that is deleted
Account and profile data, contact data, uploaded documents, saved payment card tokens, device identifiers and device and usage data are deleted. You may also delete your saved cards at any time from the payment screen in the app.
Data that continues to be retained
Records that must be kept by law are retained, with restricted access, for the statutory retention periods set out in Section 10 and are then erased, destroyed or anonymised. These include financial transaction records, invoice and cheque details, contracts, and records kept for fraud prevention and information security purposes.
12. COMMERCIAL ELECTRONIC MESSAGES
Commercial electronic messages for campaigns, promotions and marketing are sent only where you have given approval under Law No. 6563 on the Regulation of Electronic Commerce. Approvals are recorded in the Message Management System (İYS).
You may refuse to receive messages at any time, without any further formality. You can exercise this right through the link or number given in the messages, through the İYS, or by contacting destek@figopara.com. Informational and transactional notifications relating to the provision of the service are not commercial electronic messages.
13. YOUR RIGHTS AS A DATA SUBJECT AND HOW TO APPLY
Under Article 11 of the KVKK you have the following rights:
- to learn whether your personal data is being processed;
- to request information if it has been processed;
- to learn the purpose of processing and whether the data is used in accordance with that purpose;
- to know the third parties in Türkiye or abroad to whom the data has been transferred;
- to request rectification where the data has been processed incompletely or inaccurately;
- to request erasure or destruction of the data within the conditions set out in Article 7 of the KVKK;
- to request that rectification, erasure and destruction be notified to the third parties to whom the data has been transferred;
- to object to an outcome adverse to you arising from the analysis of the data exclusively by automated systems;
- to claim compensation where you suffer damage because of unlawful processing of personal data.
In accordance with Article 13 of the KVKK and the Communiqué on the Procedures and Principles for Applications to the Data Controller, you may submit your application by registered electronic mail to figoticaribilgi@hs01.kep.tr, using a secure electronic signature or mobile signature, by e-mail from the address registered in our systems to kisiselverilerikorumakomitesi@figopara.com, or in writing to Barbaros Mah. Kardelen Sk. Palladium Tower No:2 Door No:58, Ataşehir/İstanbul, Türkiye. The Data Subject Request Form is available in the Protection of Personal Data section at figopara.com.
Your application must be clear and comprehensible, must concern you personally or, if you are acting on behalf of another person, must be supported by evidence of your specific authority, and must include your identity and address details. The Company reserves the right to verify your identity before responding.
Your request is concluded free of charge as soon as possible and within thirty days at the latest, depending on its nature. Where the process entails an additional cost, the fee in the tariff determined by the Personal Data Protection Board is charged.
If your application is rejected, if you find the response insufficient, or if no response is given within the period, you may lodge a complaint with the Personal Data Protection Board under Article 14 of the KVKK within thirty days of learning of the response and in any event within sixty days of the date of application.
14. CHILDREN'S PRIVACY
The app is intended for commercial enterprises and for users over the age of 18. We do not knowingly collect personal data from children. If it is established that personal data belonging to a child has been processed, that data is deleted without delay.
15. CHANGES TO THIS POLICY
This Policy may be updated to keep pace with changing circumstances and legal requirements. The current version is published on this page together with its effective date and version number. Material changes are additionally announced in the app or on this page.
16. RELATED DOCUMENTS
- Privacy Notice and Explicit Consent Text for Platform Users
- Personal Data Protection and Processing Policy
- Personal Data Retention and Destruction Policy
- Cookie Policy and Privacy Notice
- Information Security Policy
- Data Subject Request Form
These documents are available in the Protection of Personal Data section at figopara.com.