Privacy Policy

Last updated: 2026-09-10

This Privacy Policy explains how Talya Global Lojistik Hizmetleri ("we", "us", "our") collects, uses, stores and shares personal data when you use CustomsScanner (the "Service"). We comply with the Turkish Personal Data Protection Law (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data we collect

We collect only the data we need to operate the Service:

  • Account data: name, work email, company (optional), hashed password.
  • Trade identity data: importer of record details, EORI / IRS / tax identification number, customs bond details and power-of-attorney records. Collected only when you engage a broker, because a broker cannot lawfully file without them.
  • Billing data: billing address, plan, payment-processor customer ID. Full card numbers are never stored on our servers — they live with the payment processor.
  • Entry and shipment data: the HS codes you classify, destination countries, declared values, supplier and consignee details, entry numbers and MRNs, and the documents you upload (commercial invoice, packing list, certificate of origin). Used to produce estimates, hand a complete set to your broker and report status.
  • Usage data: the classifications and duty estimates you run, timestamps, and the plan tier they were charged against. Used to compute quota and improve the product.
  • Technical data: IP address, browser user-agent, language, the page that referred you to us. Used for security, abuse prevention and aggregate analytics.
  • Communications: support tickets, feedback you submit through the in-app composer, your replies to system emails.

Some of this is commercially sensitive rather than personal — supplier identities, declared values and classification history reveal how you buy. We treat it with the same care as personal data and never sell or share it for marketing.

2. Why we collect it (legal basis)

  • Contract: to provide the Service you signed up for (account, billing, classification, estimates, broker handoff, status tracking).
  • Legitimate interests: security monitoring, fraud and abuse prevention, product analytics, customer support.
  • Legal obligation: customs and trade record-keeping, tax records, financial reporting, sanctions and denied-party screening where required, and responding to court orders or regulatory requests.
  • Consent: optional marketing emails (we ask once, opt-out is one click in every email footer).

3. How long we keep it

  • Account data: for the life of your account, then deleted within 30 days of account closure (or anonymised if needed for legal record-keeping).
  • Entry records, declarations and supporting documents: retained for the statutory customs record-keeping period of the jurisdiction concerned — commonly 5 years, and 5 years from the date of entry in the United States. We cannot delete these earlier on request, because both you and your broker may be required to produce them.
  • Billing records: 10 years, as required by Turkish tax law (VUK).
  • Usage and access logs: 12 months rolling, then aggregated and personal identifiers removed.
  • Marketing consent: until you unsubscribe.

4. Who we share it with

We do not sell personal data. We share it only with the following categories of recipients, each bound by a written agreement:

  • The customs broker you select — this is the point of the Service. When you engage a broker we transfer the entry data, trade identity data and documents that broker needs in order to file. The broker becomes an independent controller of that data and is bound by its own professional and statutory obligations.
  • Payment processor — subscription billing.
  • Buildfyio — application hosting.
  • Basefyio — application database (located in EU/Türkiye region).
  • Email delivery providers — transactional email (sign-up confirmation, password reset, billing receipts, hold and release alerts).
  • Tariff and trade data providers — when you run a classification or duty estimate, the HS code, destination and shipment characteristics are sent to the relevant tariff source. These requests are not associated with your account identifier.
  • Customs and partner agencies — where entry status is retrieved from an authority's system, or where an authority compels disclosure. We disclose only the minimum required.

5. International transfers

Cross-border trade is inherently cross-border in its data. Your entry data will be transferred to the jurisdiction of import — that is unavoidable and is the purpose of the Service. Transfers to processors outside Türkiye and the EEA rely on the European Commission's Standard Contractual Clauses or equivalent KVKK-approved mechanisms. Transfers to a customs authority are made under the law of the importing country.

6. Your rights

Subject to KVKK / GDPR you may request:

  • Access to the personal data we hold about you.
  • Correction of inaccurate or incomplete data.
  • Deletion of your data ("right to be forgotten") — subject to the customs and tax retention obligations in section 3, which override a deletion request for the records they cover.
  • Restriction or objection to certain processing activities.
  • Data portability — a machine-readable export of the data you supplied.
  • Withdrawal of consent for activities that rely on consent (e.g. marketing).

Send requests to info@talyasmart.com. We aim to respond within 30 calendar days.

7. Security

Passwords are hashed with industry-standard algorithms. Data in transit is protected by TLS 1.2+. Database access is gated by role-based authorisation and audited. Sensitive operator actions (admin role changes, broker verification, pricing overrides) are logged to an immutable audit log. We do not promise an impenetrable system — no online service can — but we work to make a breach unlikely and its impact small.

8. Cookies

See our Cookie Policy for the cookies we set, what they store and how to opt out.

9. Children

The Service is not directed at children under 18 and we do not knowingly collect personal data from them. If you believe a minor has signed up, contact us and we will delete the account.

10. Changes to this Policy

We will announce material changes by email and a prominent in-app banner at least 14 days before they take effect. The "Last updated" date at the top reflects the current version.

11. Contact and complaints

Privacy questions: info@talyasmart.com. Other support: info@talyasmart.com.

If you are not satisfied with our response you have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr) or, where applicable, your national EU data protection authority.

This Privacy Policy is a plain-language description of our data practices. It is not legal advice — for advice tailored to your situation consult a qualified attorney.