Securify Privacy
Policy
Last modified: March
27, 2020
Securify (“Securify,” “we,” “our,” or “us”), recognizes that your
privacy is very important and we take it seriously. Securify provides
multi-factor authentication and other services to users (“User,” “Users,”
“you,” or “your”) and Enterprise Users (“Enterprise User”, “Enterprise Users”)
around the world. Your use of our website (the “Site”), the mobile
application (the “Application”) and the services made available on the Site
(“Services”) is subject to these Privacy Rules, “Terms & Conditions” (these
“Terms”) for individual users (http://securifyid.com/legal/terms-conditions/) and
Securify Data Processing Agreement for corporate users.
This Privacy Policy (the “Privacy Policy”) describes how Securify Ltd.
collect, use, and share information in connection with your use of our websites
(including securifyid.com, securify.com.tr and any subdomains of this site
unless expressly excluded by their own terms and conditions), Application,
services, and other web based applications (collectively, the “Services”).
This Privacy Policy
does not apply to information and data processed by
our customers when using our Services. A customer’s processing of any
information using our Services is specific to their implementation and governed
by customer’s own privacy policy and the written data
agreements between Securify and the customer.
If you have any
questions about this Privacy Policy or Securify’s data
collection, use, and disclosure practices, please contact us at
privacy@securify.com.tr.
1. Information we
collect
We collect and receive
information from you and your devices in the following cases:
·
When you make a job application (via sending your CV in Hardcopy or Digital
format, apply for a vacant position from our web sites)Through your visit to
our web sites and using our Applications,Giving your
contact details physically (mostly in an event, bilateral meetings or other
similar physical organizations)Using our services (mobile apps, management
console, API, plugins)
1.1 Information you
provide when you apply for a job
You provide several
personal data to us mostly in your resume and
sensitive information l in connection with your job application. Some of the
personal data your provide us are listed below:
·
Name Surname
·
Identity number / Passport number
·
Certificate of Identity Register Copy
·
Email address
·
Phone/mobile number
·
Date of Birth
·
Marital Status,
·
Gender,
·
Nationality
·
Address
·
Signature
·
Education Background
·
Professional Experience (Your previous employments, name of companies, your
positions etc.)
·
Salary
·
Project Experience (The project information you were involved, date of the
projects, your position etc.)
·
Your Publications
·
Your areas of interest
·
Your hobbies and social life
·
Your references (with a commitment that you have taken their consent
beforehand)
1.2 Information
collected when you visit our web sites
We use cookies on our
Sites to improve user experience and enhahce our services. Therefore when you visit
our web sites, our servers may automatically log the standard data provided by your web browser. It may include your
Internet Protocol (IP) address, OS platform, your browser
type and version, the pages you visit, the time and date of your visit, the
time spent on each page, your clicks, your scrolls and other details.
We may also collect
contact and/or professional data about you in person,
through means like online forms and/or communications, and through our
websites. For example, you may provide your name, surname and contact
information, as well as professional information to us when you sign up to
learn more about Securify’s products and services, download content, register
for an event, and visit our offices.
1.3 Information
collected physically
During our physical marketing efforts and business activities, you may provide
us your contact and professional details especially in business card format or
orally. If you attend an event, we may also receive contact
and professional details about you by filling in a form or by providing us a
business card or other method where you share Personal Data with us, as well as
pictures and videos taken that can be shared on social media to express
Enterprise activities. Typically, contact data
includes your name and contact methods, such as telephone number, email
address, and mailing address, and professional data includes details such as
the organization you are affiliated with, your job title, and industry.
1.4 Information
collected when you use our services
Information collected
by our systems will be detailed in the following sub-sections:
1.4.1 Mobile
Applications
We have Android and
IOS Mobile Applications. So, when you download our apps from online
stores and start using, we collect information in the following phases:
During First Registration: In order to be able to use our
mobile services, you should sign-up by entering your name, surname, email
address, phone number. After you entered your information, we sent a
registration code to your e-mail address and wants you enter this code in our
app in order to finalize your registration. During your registration we
generate symmetric and asymmetric key pairs in order to use them in digital
signing and encryption of transactions as well. According to our usage, we can
store these keys in mobile app, in backend server or
in both.
When You Add a New Service: You may add either a Enterprise or
individual service. Individual services can only be used in TOTP (Time-Based
One-Time Password) Authentication (RFC-6238). In this authentication mechanism,
a third-party service (i.e. Twitter, Facebook, LinkedIn) can be added by
scanning a QR code or enter a secret key manually in order to perform second
factor authentication. If you scan the QR code we obtain your secret key and
the name of your third-party service and if you add manually, we store the name
you gave to the service and the secret key. We store your secret key both in
your mobile app and in our backend servers in order to regenerate OTP and
recover it when you move your app to another phone or reinstall the app as a
backup for your own convenience. We also highlight that in order to let you
scan QR code, we need your camera permissions.
In Enterprise
services, you enter a code provided from your service provider and we just keep
service provider’s id and the user-id provided for the service. User id is only
a number produced by your corporation/service provider to pseudonmyse your identity , that is later shared by your corporation/service
provider with us in order to uniquely identity your transaction. User id can be
just a pseudonmysed number and we do not require it to be a personally
identifying number. But if your service provider provides such as personal data as user id, it is the responsibility of your service
provider which is also included in our contract with your service provider.
During Authentication: During authentication we use several
information about you and your device, app and transaction in order to improve
your security during authentication and store them for publc and third party
audit purposes, as well as improvements to our services. This information may
include your email address, your user-id, your Internet Protocol (IP) address,
OS platform, your browser type and version, browser
timezone, browser time offset, browser agent, screen resolution, the date and
time of your transaction, keystroke timings, geolocation, time spent on each
page, your clicks, your scrolls.
1.4.2 Management
Console
For Enterprise Users
that has contract with us, we provide a web-based management console for
identity and access management of their employees and/or customers. In this
console, employes or customer data is provided to the system by the Enterprise . In such cases, data
controller is the Enterprise and we are in data processor role. So, the
responsibility to meet the data privacy and other related legal requirements
with the endnuser or employee is primarily on the Enterprise
.
As a Enterprise User
of our Site, Application and services your data controller
may keep and process your personal data under the following sections of
management console:
Directory Section: In directory section, information about
users, groups, identities and zones can be stored in the system. Personal data can be kept within users or identities module. However,
neither our system nor the processes require users’ personal data
to operatecorrectly. Our system just needs a user ids and/or email addresses
which might be anonymous records that cannot be directly linked with the users’
identities. We recommend our Enterprise Users as data
controllers to utilise pseudonmysied user-ids for a better EU’s GDPR and
Turkish PPDA (KVKK) compliance. According to the Enterprise User configuration,
the users’ data can also be retrieved from an already
existing third-party system such as Active Directory, Office 365, Radius etc.
Applications Section: In the applications section, Enterprise
User can define its services and html forms in order to manage access to them.
Applications section processes ordinary data, such as
service name, form html id, field html. The only personal data
processed under this section isthe logs that are kept about the services used
by individual userid’s. .
Policies Section: In this section, Enterprise User can define rules to
allow or deny the user groups to use the defined services or forms according to
time period or IP addresses.
Licences Section: In licences section we keep Enterprise or individual licencing
information that includes the product name, licence name, start
date, expritation date, users’ email address (for individual users), Enterprise
information, Enterprise email address, phone number etc.
Audit Section: In audit section, system stores several information
about the authentication transactions for security and controls, including
Enterprise name, service name, user-ids, Internet Protocol (IP) address, OS
platform, browser type and version, browser time zone,
browser time offset, browser agent, screen resolution, the date and time of the
transaction, users’ keystroke timings, geolocation, time spent on each page,
clicks, scrolls.
Threat Management Section: In threat management section, the system
checks the collected data regarding the users’
authentication transactions and perform static and automatic analysis.
Automatic analysis includes analysing users’ historical and behavioural data using machine learning or statistical techniques and
detect anomalies. In this section, Enterprise should define risk-based
authentication parameters and actions when an anomaly is detected in users’
authentication transaction. Actions includes to trigger a third-party system or
send notification emails or SMS. Therefore, the information such as IP address
and service name of the third-party application or the e-mail and SMS information
of the persons to be notified should be entered to the system.
1.4.3 API Services
Since our backend
services runs through API services, the data mentioned
in the previous systems should be transferred using these API’s.
1.4.4 Plugins
We sometimes provide
some plugins in order to interact with third party systems. In the settings
page of these plugins, the system may store users’ email addresses, API Keys,
some other relevant configuration data.
How we collect
information
We collect information
by fair and lawful means, with your knowledge and consent. We also let you know
why we’re collecting it and how it will be used. You are free to refuse our
request for this information, with the understanding that we may be unable to
provide you with some of your desired services without it.Use
of information
We use your data in order to increase the security of your
authentication processes and prevent any malicious cyber attack against your
identities.
We may use a
combination of identifying and non-identifying information to understand who
our visitors are, how they use our services, and how we may improve their
experience of our Services in the future. We do not disclose the specifics of
this information publicly, but may share aggregated and anonymised versions of
this information, for example, in website and customer usage trend
reports.
We may use your
personal details to contact you with updates about our Services, along with
promotional content that we believe may be of interest to you. If you wish to
opt out of receiving promotional content, you can follow the “unsubscribe”
instructions provided alongside any promotional correspondence from us.
Data processing and
storage
We only transfer data within jurisdictions subject to data protection laws
that reflect our commitment to protecting the privacy of our users.
We only retain
personal information for as long as necessary to provide a service, or to
improve our services in future. While we retain this data,
we will protect it within commercially acceptable means to prevent loss and
theft, as well as unauthorised access, disclosure, copying, use or
modification. That said, we advise that no method of electronic transmission or
storage is 100% secure, and cannot guarantee absolute data
security.
If you request your
personal information be deleted, or where your personal information becomes no
longer relevant to our operations, we will erase it from our system within a
reasonable timeframe.
Cookies
We use “cookies” to collect information about you and your activity across
our site. A cookie is a small piece of data that our
website stores on your computer, and accesses each time you visit, so we can
understand how you use our site. This helps us serve you content based on
preferences you have specified. Please refer to our Cookie Policy (http://securifyid.com/legal/cookie)
for more information.
Third-party access to
information
We use third-party
services for:
·
Analytics tracking
·
Advertising and promotion
·
Content marketing
·
Email marketing
·
Payment processing
·
Hosting
These services may
access our data solely for the purpose of performing
specific tasks on our behalf. We do not share any personally identifying
information with them without your explicit consent. We do not give them
permission to disclose or use any of our data for any
other purpose.
We may, from time to
time, allow limited access to our data by external
consultants and agencies for the purpose of analysis and service improvement.
This access is only permitted for as long as necessary to perform a specific
function. We only work with external agencies whose privacy policies align with
ours.
We will refuse
government and law enforcement requests for data if we
believe a request is too broad or unrelated to its stated purpose. However, we may cooperate if we believe the requested information
is necessary and appropriate to comply with legal process, to protect our own
rights and property, to protect the safety of the public and any person, to
prevent a crime, or to prevent what we reasonably believe to be illegal,
legally actionable, or unethical activity.
We do not otherwise
share or supply personal information to third parties. We do not sell or rent
your personal information to marketers or third parties.
Children’s privacy
Securify does not
knowingly collect information from children under the age of 13, and children
under 13 are prohibited from using our Services. If you learn that a child has
provided us with personal information in violation of this Privacy Policy, you
can alert us at privacy@securify.com.tr.
Limits of our policy
This privacy policy
only covers Securify’s own collecting and handling of data.
We only work with partners, affiliates and third-party providers whose privacy
policies align with ours, however we cannot accept responsibility or liability
for their respective privacy practices.
Our website may link
to external sites that are not operated by us. Please be aware that we have no
control over the content and policies of those sites, and cannot accept
responsibility or liability for their respective privacy practices.
Changes to this policy
This Privacy Policy
may be modified from time to time, so please review it frequently. Changes to
this Privacy Policy will be posted on our websites. If we materially change the
ways in which we use or share personal information previously collected from
you through our Services, we will notify you through our Services, by email, or
other communication channels.
Your rights and
responsibilities
As our user, you have
the right to be informed about how your data is
collected and used. You are entitled to know what data
we collect about you, and how it is processed. You are entitled to correct and
update any personal information about you, and to request this information be
deleted. You may amend or remove your account information at any time, using
the links in our web sites.
You are entitled to
restrict or object to our use of your data, while
retaining the right to use your personal information for your own purposes. You
have the right to opt out of data about you being used
in decisions based solely on automated processing.
Contact us
If you have any
questions or concerns about this Privacy Policy, please feel free to email us
at privacy@securify.com.tr
Securify Ltd. is the data controller of your personal information in individual
services but data processor in the Enterprise services.