KVKK requests
このコンテンツはまだ日本語訳がありません。
Under the Turkish Personal Data Protection Law (KVKK), an employee can ask your organization what data it holds about them, for a copy of it, to correct or erase it, or to object to how it is used. Your organization is the data controller and has to answer within 30 days. Focus keeps each request in one place: who asked, how their identity was checked, what was decided, what was done, and the proof.
Owners and admins open Settings → Privacy (KVKK) → Requests.
The requests list
Section titled “The requests list”The counters at the top show the open requests, those due within 7 days and those that are overdue. The table lists each request with its kind, the person, how it arrived, when it was received, the deadline with the days left, and its status. Filter by status, kind or person; choose a request to open its details.
| Kind | What the person asks for | What Focus does after approval |
|---|---|---|
| Access | To know what data is held about them | Prepares a ZIP with the data and a summary page |
| Export | A copy of their data | Prepares a ZIP with the data |
| Erasure | Their data to be erased | Erases the person’s data in this organization, except what the law requires to keep |
| Rectification | Wrong data to be corrected | Nothing by itself: you correct the data, then complete the request |
| Restriction | Their data to be used less | Nothing by itself: you change the settings, then complete the request |
| Objection | To object to how their data is used | Nothing by itself: you act on it, then complete the request |
For the last three, make the change where it belongs (for example correct the person in Settings → Users or stop tracking them), then complete the request with a short note of what you did.
How a request arrives
Section titled “How a request arrives”- From the person: employees send a request from their profile’s Privacy tab (my data). They have signed in within the last few minutes, so their identity counts as verified.
- Recorded by you: when a request arrives by e-mail, by letter, in person or another way, choose Record a request. Pick the person, the kind, how it arrived and the day you received it (not in the future and at most 30 days ago; the deadline counts from that day), and add the details of the request. Do not write health data or other special categories of personal data into the details.
A person can have one open request of each kind; a second one is refused (request_open).
Verify the identity
Section titled “Verify the identity”A request you record starts without a verified identity. Before approving it, make sure the request really comes from
that person, for example by calling them back on a known number or checking their ID in person. Choose
Verify identity, pick how you checked, and add a note. A request without a verified identity cannot be approved
(identity_not_verified).
The 30-day deadline
Section titled “The 30-day deadline”The deadline is 30 days after the day the request was received, and the list shows how many days are left. The owner and admins get a notification in the dashboard and by e-mail when a request arrives, 7 days before the deadline and once it has passed. These notifications cannot be turned off (notifications).
Approve or reject
Section titled “Approve or reject”Open the request and choose Approve or Reject. A rejection needs a reason, which the person sees. Nobody can
decide on their own request (self_decision_forbidden), and a request is decided only once (request_already_decided).
The person is notified of the decision.
Data export
Section titled “Data export”After you approve an access or export request, Focus prepares a ZIP file in the background and notifies the person when it is ready. It contains, as CSV and JSON files with a README in Turkish and English:
- the profile and membership (name, e-mail, mobile phone, role, team, time zone),
- activity: apps, window titles and website addresses where they were kept, daily totals,
- devices and sign-in sessions,
- time entries, leave, shifts and leave balances,
- notifications and notification preferences, support requests,
- audit log entries by or about the person, and the full list of who viewed their data,
- their privacy notice acknowledgements and their KVKK requests.
The person and you can download the ZIP for 7 days. Each download link works for 5 minutes, and every download is
recorded in the access log. Before the file is ready the download answers export_not_ready; after 7 days
export_expired.
Erasure
Section titled “Erasure”After you approve an erasure, Focus erases the person’s data in this organization step by step; the request shows the progress. The person’s sessions end and they can no longer sign in to this organization. If they also belong to another organization in Focus, their account and that organization’s data stay.
Keep payroll records (on by default) keeps the time and attendance records that employment and tax law require you to keep: time entries, approved leave, shifts and daily totals. They stay without the name, the e-mail address, the mobile phone number and any notes, under an anonymous identifier. Turn it off only when you are sure you do not need these records; they are then erased too.
The owner of the organization cannot be erased (owner_cannot_be_erased); transfer the ownership first
(users and roles).
What is kept, and why
Section titled “What is kept, and why”| What | Why |
|---|---|
| Time and attendance records, with Keep payroll records on | Employment law (3 years) |
| Invoices, the subscription and the billing entries of the audit log | Turkish Commercial Code and Tax Procedure Law (10 years); they belong to the organization, not to the person |
| Audit log and access log entries, without IP address, browser details and free text | Proof of what happened; they no longer say who the person was |
| The request itself and its report | Proof of how the request was answered |
| The person’s privacy notice acknowledgements, without the IP address | Proof that the person was informed |
Data erased from the live database stays in the encrypted backups for at most 35 days, then drops out (retention and legal holds).
When the erasure is complete, the request has a report: how many records of each kind were erased or anonymized, and what was kept with its legal basis. Keep it as your proof.
Legal hold
Section titled “Legal hold”If a legal hold covers the person or the whole organization, for example because of a court case, the erasure does
not start: the request’s status becomes On hold. When the hold is added after the approval but before the
erasure runs, the person who decided and the owner also get a notification. After the hold is released, choose
Resume in the request’s details; while a hold still covers the person, Resume is refused (legal_hold_active)
(retention and legal holds).
Access log: who viewed whose data
Section titled “Access log: who viewed whose data”Settings → Privacy (KVKK) → Access log lists every time someone viewed personal data: in the dashboard, in a report export, in an e-mail report or through support access. Each entry shows when, who (with their role), how, what kind of data (for example window titles), about whom, and for which period.
- Filter by the person whose data was viewed, the person who viewed it, the channel, the kind of data and the dates (up to 93 days at a time).
- Download the rows on the screen as a CSV file.
- An erased person appears without a name; a view by Workify360 support under a grant appears as support (support access).
Employees see their own entries on their profile’s Privacy tab under Who viewed my data. By default they see counts (by channel, kind of data and month); the owner can let them see the names and roles of the viewers too, in the policy on the same screen. The full list is always part of their data export.