Last updated: 29 October 2026. This policy explains what personal data Bawabetna collects, why and on what basis, who it is shared with, where it is kept and for how long, and your rights and how to use them.
1. Who we are and how to reach us
The controller of this website, the Bawabetna platform and the clients' app is IGTEI LLC TEKNOLOJİ İÇ VE DIŞ TİCARET LİMİTED ŞİRKETİ, Şehremini Mah. Velet Çelebi Sk. No: 9/A, Fatih/İstanbul, Türkiye. For anything about your data, write to [email protected].
2. Who controls which data
- Working records in Bawabetna programs: kept in full, encrypted, on the subscribing establishment's own devices; we neither host nor see them. The establishment is responsible for these records towards its clients.
- The client file on the platform: we are responsible for it, keep it for the client and at the client's disposal, and no one reaches it without the client's consent.
- Website accounts, subscriptions and invoices: we are responsible for them.
3. What we collect, why and on what basis
- Visiting the website: a cookie that remembers your language, session cookies when you sign in, and server logs (IP address and request time), to run the website and protect it against abuse. The basis is our legitimate interest in keeping the service secure. We use no advertising trackers. We measure page speed and visit counts with Cloudflare Web Analytics, which uses no cookies or browser storage and does not keep your IP address. Your light or dark theme choice is stored in your browser only.
- Visit measurement on our own server: To learn which pages help visitors and where they stop, our server records each page view: the page address, the page you came from, campaign tags in the link, the browser name and device type, and the time zone, without your IP address. If you agree in the notice shown on your first visit, we also keep a random number in your browser to recognise returning visits; we never use browser fingerprinting. If you do not agree, no number is stored and the view is counted without anything that identifies you. If your browser sends a Do Not Track request, we record nothing. You can change your choice at any time with the “Visit measurement settings” link at the bottom of every page. We keep these records for 180 days. The basis is our legitimate interest in improving the website, and your consent for the random number.
- Contact and register-interest form: name, contact details, organization, the program of interest and your message, used to reply to you at your request.
- Account: name, e-mail address and password; the identity service stores the password only as a hash that cannot be read. If you choose Google sign-in we receive only your name and e-mail address from Google. The basis is providing the service you asked for.
- Subscriber (establishment): subscriber name and type, country, e-mail and phone, establishments and subscription scopes, invoices and payments, and a daily count of work units sent by the program without any personal or professional data. The basis is the subscription contract and our legal accounting and tax obligations.
- Phone verification: you send a message from WhatsApp or Telegram to our number, so we receive your number and the message. The basis is providing the service.
- Client file: full name, identity-issuing country, date of birth, gender, nationality, phone, e-mail, country of residence, city and address, and an optional emergency contact. We do not keep the official identity number in readable form: only a keyed fingerprint and two of its characters as a hint. The basis is providing the service the client asked for and the client's consent.
- Client identity confirmation: the client's identity is confirmed by three different establishments, each of which checks the client's original identity document in person and confirms it with a signed declaration, without photographing or copying the document. The client file becomes active after the third confirmation. We receive only the confirmations: the establishment and the person who confirmed, the document type, the time and the declaration. We collect no images of identity documents or faces.
- Health and genetic data in the client file: report summaries sent by establishments with the client's consent, the emergency card, and genetic reports the client uploads. These are sensitive data, processed only with the client's explicit consent, which can be withdrawn at any time.
- Electronic signature and declarations: the image of the signature you draw, and every declaration you sign with its text, fingerprint, time and device, kept as evidence of what you declared, to protect your rights and those of others.
- Consents and access log: every consent a client grants to or withdraws from an establishment, and every access by an establishment to the client's data, shown to the client and kept as evidence that the client's consent was respected.
The data required to create an account, a client file or a subscription is needed to provide the service; without it we cannot create the account or file. What is marked optional you may leave out.
4. Children
A parent or legal guardian adds a child under 18 to their own account, manages the child's file and signs for the child. The child receives a permanent client code of their own, so the child's reports stay theirs when they take over the file. We do not accept a separate account for a child below the age of consent set by the law of the child's country.
5. Automated decisions
We make no decision about you based solely on automated processing. A client's identity is confirmed by people at three different establishments that serve the client, and if you disagree with a decision about your file you can write to us to ask for a personal review.
6. Who we share data with
We do not sell or rent data and do not use it for advertising. We share it only as far as needed with:
- Establishments the client deals with: only the category the client allowed, for the period the client chose.
- Service providers processing data on our behalf: Google Cloud for hosting, Google Workspace for sending e-mail, and Cloudflare for delivering and protecting the website and counting its visits.
- Meta (WhatsApp) or Telegram: when you choose to verify your phone through one of them.
- Google: if you choose Google sign-in.
- Payment providers: PayPal, Paymob and banks for InstaPay or bank transfer. The payer enters card details with the payment provider directly; we do not receive them.
- Public authorities: only on a formal, binding legal request.
Genetic data is never made available to employment, insurance or similar programs, even with the client's consent.
7. Where data is kept and transfers outside your country
The platform is hosted on Google Cloud servers in Doha, Qatar, with encrypted backups in the same place. If you are outside Qatar, keeping your data there is a transfer outside your country. For this transfer we rely on the safeguards your country's law requires, such as standard contractual clauses with the service provider, and you may ask us which safeguard applies to you. In countries whose law requires health data to be kept inside the country, health programs are activated only once that requirement is met.
8. How long we keep data
- Server request logs: 14 days. Sign-in and activity logs: 90 days.
- Contact messages: until the reply and follow-up are complete, then deleted.
- Account and client-file data: while the account exists. When it is closed they are deleted, except what this policy or the law requires us to keep.
- Report summaries held for a client whose identity is not yet confirmed: permanently deleted one year after the code was reserved if the confirmation is not completed.
- Identity confirmations: for the life of the account and five years after it is closed, or a shorter period where the law of your country requires it.
- Genetic reports: until the client deletes them; the client can delete them permanently at any time.
- Signed declarations, consents and access logs: kept without deletion as evidence of what was done with your permission, and not used for any other purpose.
- Invoices and payments: for the period required by tax and commercial law.
9. How we protect data
Connections to the platform are encrypted. Report summaries, genetic data and the emergency card code are stored encrypted. Only staff whose task requires it can see data, and every opening of sensitive data is logged. If a breach affects your data, we notify you and the competent supervisory authority as the law requires.
10. Your rights
Under the law of your country you may ask us to:
- tell you whether we process your data, give you access to it, and give you a copy in a readable, portable format;
- correct or complete your data, or delete it;
- restrict or object to its processing;
- let you withdraw your consent at any time, without affecting what was done before the withdrawal (a client withdraws consents given to establishments directly in the consent centre);
- let you object to a result against you that comes solely from automated processing;
- tell you who your data was transferred to, and compensate damage caused by unlawful processing.
Write to [email protected] and we will answer within 30 days. We may ask for proof of identity before acting on a request. You also have the right to complain to the data protection authority of your country, such as the Personal Data Protection Authority in Türkiye (KVKK), the Saudi Data and AI Authority (SDAIA), Egypt's Personal Data Protection Center or the data protection authority of your EU country.
The right to deletion has legal limits: signed declarations, consents and access logs, and identity confirmations during their retention period, are not deleted, because they are evidence protecting your rights and those of others. They are not used for any other purpose.
11. Changes
We may update this policy and will announce material changes on this page with the update date. Where a change affects processing based on your consent, we ask for your consent again.