Privacy Notice
This notice has been prepared by Levent Nacar under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform the people who use the account and licence service of the MPI · Project Management program, and those who contact us through the contact form on mpisuite.com or request the program on its download page, about how their personal data is processed. Additional information for users in the European Union and Uzbekistan is given in section 6.
If your workspace is on your computer or in a OneDrive folder, your project data (work plans, Gantt charts, reports, etc.) is not sent to this service. Only if you or your organisation choose a cloud workspace is the project data stored, encrypted, on the server in Türkiye and shared with the workspace members (sections 2, 3 and 6).
1.Identity of the data controller
| Data controller | Levent Nacar |
|---|---|
| kvkk@mpisuite.com | |
| Registered e-mail (KEP) | levent.nacar@hs01.kep.tr |
2.Personal data processed, purposes and legal grounds
| Data | Purpose | Legal ground |
|---|---|---|
| Identity and contact: full name, email address | Opening the account, verifying the email address, password reset, account and licence notifications | Establishment or performance of a contract (KVKK Art. 5/2-c) |
| Organisation: name of the company you work for | Assigning and managing the licence on behalf of your organisation | Establishment or performance of a contract (KVKK Art. 5/2-c) |
| Sign-in security: password hash (the password itself is not stored), session token hash, Microsoft or Google account identifier, device description (operating system and browser name), sign-in and last-use times | Authentication, session management and protecting your account | Performance of a contract (KVKK Art. 5/2-c); legitimate interest in the security of the service (KVKK Art. 5/2-f) |
| IP address | Limiting repeated failed sign-in attempts and other abuse | Legitimate interest in the security of the service and accounts (KVKK Art. 5/2-f) |
| Licence: trial and licence start and end dates, licence type, administrator notes | Defining and tracking the trial period and the licence; checking the right to use the program | Performance of a contract (KVKK Art. 5/2-c) |
| Activity records: registration, licence and account changes made by the administrator, with date and time | Security of the service; proving licence transactions in case of dispute | Legitimate interest (KVKK Art. 5/2-f); establishment, exercise or protection of a right (KVKK Art. 5/2-e) |
| Contact form: full name, email address, company, subject and message | Answering your request; evaluating licence and trial requests | Being directly related to the establishment of a contract (KVKK Art. 5/2-c); legitimate interest in answering your request (KVKK Art. 5/2-f) |
| Download request (mpisuite.com/indir): full name, email address, company; the one-time code sent to your email address (stored only as a hash); the times of verification and downloads and the version downloaded | Verifying your email address before the download; recording who downloaded the program; evaluating the licence request | Being directly related to the establishment of a contract (KVKK Art. 5/2-c); legitimate interest in knowing to whom the program is distributed and preventing misuse (KVKK Art. 5/2-f) |
| Cloud workspace (only if chosen): workspace name; members’ email addresses and roles; who last changed the data and when; the project data itself (task names, dates, names of people, notes and other content entered in the program); while the program is open, the view and task you are currently on (presence) | Storing the workspace on the server, sharing and synchronising it between members, keeping version backups; showing other members where each member is working at the moment | Performance of a contract (KVKK Art. 5/2-c). For the content of the project data, the data controller is the organisation or person who opened the workspace; we store it on their behalf and on their instructions as a data processor |
Cloud workspace content is encrypted on the server with a key that is kept separately from the database and its backups, is sent only to members of the workspace, and is not used for any other purpose.
3.Purposes of transfer and recipient groups
| Recipient group | Purpose | Location |
|---|---|---|
| Server (hosting) service provider | Running the licence service and storing the data in section 2, including encrypted cloud workspaces | Türkiye |
| Email delivery service provider | Sending verification, password reset and licence emails; delivering contact form messages to the data controller’s mailbox | Türkiye |
| Competent public authorities | Only when required by law and upon their request | Türkiye |
Your personal data is stored on servers in Türkiye and is not transferred abroad. If you sign in with Microsoft or Google, only your identity information is received from that company; no personal data is transferred to it by this service.
4.Method of collecting personal data
Your personal data is collected electronically and by automated means through the registration and sign-in screens of the program, through the identity information sent by Microsoft or Google when you choose to sign in with them, and through the communication between the program and the licence service. The information you write in the contact form on mpisuite.com is collected electronically when you send the form, and the information you write on the download page (mpisuite.com/indir) when you request a code. If your account was created by the licence administrator, your email address and, where given, your name and company are entered by the administrator in the licence management panel and notified to you by an invitation email. Licence definitions and administrator notes are entered manually by the administrator in the licence management panel.
5.Your rights under the KVKK
You may submit your requests regarding your personal data under Article 11 of the KVKK at any time, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing or by registered electronic mail (KEP), secure electronic signature, mobile signature or the email address you previously notified to us and that is registered in our system, to the addresses below. Requests are concluded free of charge within 30 days at the latest (KVKK Art. 13).
| Channel | Address |
|---|---|
| kvkk@mpisuite.com | |
| KEP | levent.nacar@hs01.kep.tr |
6.Additional information for users in the European Union and Uzbekistan
Retention periods. Data is kept for the periods below and deleted automatically by a daily deletion job; when you ask for your account to be deleted, the account, its sessions and links are deleted and your email address in the activity records is replaced by an irreversible short code; copies in the database backups are removed when those backups expire.
| Data | Retention |
|---|---|
| Account data (identity, contact, organisation, licence) | While the account is open; accounts without a valid licence that have not been used for 2 years are deleted |
| Registrations whose email address was never verified | 30 days |
| IP addresses (failed sign-in counters) | 1 day |
| Sessions | Become invalid and are deleted after 90 days without use |
| Used or expired verification and password links | 7 days after expiry |
| Activity records | 2 years |
| Daily database backups | 14 days |
| Contact form messages (in the service and in the data controller’s mailbox) | 1 year |
| Download requests | 1 year after the request; requests whose code was never entered: 7 days |
| Cloud workspace data and memberships | Until the workspace is deleted by its administrator, or until it has no members left; a member’s membership ends when they leave, are removed or their account is deleted |
| Cloud workspace version backups | Hourly for the last 2 days, then one a day up to 30 days |
| Presence in shared work (the view and task currently open) | Not stored; kept only in the server’s memory and deleted when the program closes or after 75 seconds without an update |
European Union (GDPR). The legal grounds above correspond to Article 6(1)(b) GDPR (contract) and Article 6(1)(f) GDPR (legitimate interest: security of the service and accounts, preventing abuse, and establishing or defending legal claims). In addition to the rights above, you have the rights of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest, and the right to lodge a complaint with the supervisory authority of the EU member state where you live or work. Providing your name, email address and a password (or a Microsoft or Google account) is required to open an account; without them the account cannot be opened and the program cannot be used. In the contact form, your name, email address and message are required; without them your request cannot be received. No profiling is carried out; the closing of access at the end of the trial or licence period is the date-based application of the licence terms. The data controller and the servers are located in Türkiye; your data is stored in Türkiye.
Uzbekistan. Under Law No. ZRU-547 “On Personal Data”, the data processed by this service is not among the categories that must be stored in Uzbekistan (biometric and genetic data, and user data of telecommunications operators in Uzbekistan). It is stored on servers in Türkiye. You may exercise your rights as a data subject under that Law through the contact addresses above.
Last updated: 13 October 2026 · Version 1.5