Ermada LogiCore
Privacy Policy
This policy explains what personal data the Ermada LogiCore web platform and the Ermada LogiCore mobile app (Google Play and App Store) process, on what legal basis, who we share it with, and how you can exercise your rights.
1. Summary
- LogiCore is a business application for logistics teams; users are staff authorised by their employer.
- We do not sell personal data, do not share it with ad networks and do not collect advertising identifiers (AAID/IDFA).
- Location is captured only while the app is open and in use; there is no background location tracking.
- Camera, microphone, photos and NFC are used only when you start the related action.
- No automated decision-making or profiling with legal effect takes place.
2. Who we are
- Operator: Ermada Group
- Registered name: [to be completed]
- Address: [to be completed]
- E-mail: info@ermadagroup.com
- Web: ermadalogicore.com
LogiCore is multi-tenant: every customer company works inside its own workspace
(company.ermadalogicore.com). For operational data uploaded into a workspace the
customer company is the data controller and Ermada Group acts as a
processor under the customer's instructions. For account, session, security, billing and
support data Ermada Group is the controller. If your employer holds records about you, address such
requests to your employer first; we will route them to your workspace administrator.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, e-mail, phone, username, job title, workspace | You or your workspace admin |
| Account security | Password hash, two-factor status, passkey records, session and refresh tokens, failed sign-in attempts | Automatic |
| Device and technical | Device model, OS version, app version, language, IP address, timestamps, error logs | Automatic |
| Location | Latitude/longitude, accuracy, timestamp — only for the relevant operation step | Device location service, with your permission |
| Images and files | Document and waybill photos, container/damage images, QR and barcode results, uploaded files | Uploaded by you |
| Audio and video | Live audio/video stream when the calling feature is used | Started by you |
| NFC | Tag identifier and content read or written for equipment matching | Started by you |
| Notifications | Push device token (FCM), notification preferences and read state | Automatic, if permission granted |
| Operational records | Assigned jobs and trips, status updates, expense entries, activity log | App usage |
| Support | E-mails you send us and their attachments | You |
We do not intend to collect special categories of data (health, biometrics and similar). Please avoid uploading documents containing such data.
4. Mobile app permissions
All permissions are optional and requested in context. Declining keeps the app usable; only the related feature is disabled.
| Permission | Why | If declined |
|---|---|---|
| Location (while in use) | Stamp an operation step at the correct place; estimate distance and route | You select the location manually |
| Camera | Capture documents and damage photos, scan QR/barcodes, video calls | Pick files from the gallery instead |
| Photos / files | Attach existing documents and images to a job | Only live capture is used |
| Microphone | Voice/video calls and voice notes | Calling is unavailable; no background recording ever takes place |
| NFC | Read and write equipment or container tags | Match manually by code or QR |
| Notifications | Deliver job assignments, status changes and reminders | You see updates when you open the app |
| Bluetooth | Pair with field hardware such as printers or scales | Hardware integration is unavailable |
5. Location data
- The app requests "while in use" location only; the Android background location permission is not declared.
- Location is used to stamp an operation step (arrival, delivery, gate in/out) and to estimate distance, not for continuous tracking.
- Location entries are written to your workspace records and are visible to authorised users at your company.
- For route estimates only the start and end coordinates are sent to the routing service — no names, phone numbers or job details.
6. Purposes and legal bases
| Purpose | GDPR basis | Turkish KVKK basis |
|---|---|---|
| Account creation, authentication, service delivery | Art. 6(1)(b) | Art. 5/2-c |
| Operational records, dispatch and reporting | Art. 6(1)(f) | Art. 5/2-f |
| Security, abuse and fraud prevention, logging | Art. 6(1)(f), 6(1)(c) | Art. 5/2-f, 5/2-ç |
| Statutory retention, tax and commercial record keeping | Art. 6(1)(c) | Art. 5/2-ç |
| Location, camera, microphone and NFC features | Art. 6(1)(a), 6(1)(b) | Explicit consent + contract |
| Optional promotional messages | Art. 6(1)(a) | Art. 5/1 explicit consent |
7. Sharing and service providers
| Provider | Purpose | Data shared |
|---|---|---|
| Google Firebase Cloud Messaging | Push notification delivery | Device push token, notification title/body |
OSRM public routing service (router.project-osrm.org) | Road distance and duration estimates | Start and end coordinates only — no identifiers |
| Hosting and infrastructure provider | Servers, database, backups | All platform data (encrypted in transit, access controlled) |
| E-mail (SMTP) provider | Notification, verification and system e-mails | E-mail address and message content |
| Object storage (S3 compatible, where used) | Storing document and image attachments | Files you upload |
| Error monitoring (where enabled) | Crash and error diagnostics | Technical error records, app version, device type |
We may also have to satisfy lawful requests from public authorities. Unless legally prohibited, we inform the affected workspace administrator.
8. International transfers
Some providers (push notifications, routing) operate servers outside Türkiye and the EEA. Such transfers rely on appropriate safeguards under GDPR Chapter V and Article 9 of the Turkish KVKK — standard contractual clauses, undertakings or explicit consent. Hosting location: [to be completed].
9. Retention
| Data | Retention |
|---|---|
| Account and profile data | For as long as your workspace membership lasts |
| Operational and document records | Customer retention policy and statutory periods (commercial records 10 years, tax documents 5 years in Türkiye) |
| Session and security logs | Up to 12 months |
| Push notification token | Until sign-out or app removal |
| Support correspondence | 24 months after the request is closed |
| Deletion request records | 3 years, as proof of compliance |
10. Security
- TLS encryption for all traffic; cleartext HTTP is disabled in the app.
- Role-based access control; workspace data is isolated per tenant.
- Password policy, sign-in rate limiting and two-factor authentication support.
- Session tokens are stored in the platform secure store (iOS Keychain / Android Keystore).
- Backups, logging and incident monitoring; breach notification to the authority and affected people without undue delay.
11. Account and data deletion
You can request deletion of your account and related data at any time. Steps, timing and what is retained are described on the Account & Data Deletion page.
12. Your rights
Subject to applicable law you may request access, rectification, erasure, restriction of processing, data portability, and object to processing based on legitimate interests. Write to info@ermadagroup.com; we respond within 30 days. You may also lodge a complaint with your supervisory authority — in Türkiye, the Personal Data Protection Authority (KVKK).
13. Children
LogiCore is a workplace product and is not directed at anyone under 18. We do not knowingly collect children's data and will delete it if discovered.
14. Changes
We may update this policy. Material changes raise the version number, update the effective date and are announced in the app or by e-mail. The current version is always published at this address.
15. Contact
- E-mail: info@ermadagroup.com
- App: Ermada LogiCore (Android and iOS bundle id
com.ermadagroup.logicore) - Related documents: Terms of Service, Cookie Policy, Support