Legal documents

1. Privacy Notice (KVKK)

Prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").

Data controller

Navluno. Contact: info@navluno.com

For data that customers enter into the platform themselves (for example, contact details of carrier representatives), the customer is the data controller and Navluno is the data processor (see Data Processing Terms).

Personal data processed

Purposes and legal grounds

• Concluding the sales agreement, opening the account, delivering sign-in details, providing the platform and authorisation: conclusion and performance of a contract (Art. 5/2-c).
• Creating freight requests, sending invitations to carriers, collecting and comparing quotes: performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f).
• Invoicing, accounting records and obligations under tax law: legal obligation (Art. 5/2-ç).
• Proving contract acceptance and establishing rights in possible disputes: Art. 5/2-e.
• Account security, preventing unauthorised access and misuse, keeping activity logs: legitimate interest (Art. 5/2-f) and legal obligation (Art. 5/2-ç).
• Plan expiry reminders, payment receipts and service notifications: performance of a contract (Art. 5/2-c). We do not send marketing emails; if we ever wish to, we will ask for your consent separately.

Transfers

Transfers to providers abroad fall under Article 9 of the KVKK and are made under standard contracts [signing of the standard contracts and notification to the Board to be completed with legal counsel]. Beyond these, data is not transferred to third parties, sold, or used for advertising or profiling.

Collection method

Data is collected electronically and by automated means, from the information the data subject enters on the purchase, sign-up and application screens and from records created while using the platform.

Retention periods

• Account and workspace data: for the duration of the plan and 90 days after it ends; a workspace that is not renewed is deleted at the end of this period.
• Trial workspace data: at most 90 days after the trial ends; contact details from the sign-up form for at most 1 year.
• Order, invoice and contract acceptance records: 10 years, as required by tax and commercial law.
• Activity and security logs: for the life of the account, at most 1 year.
• Automatic database backups: 14 days.

When the period ends, the data is deleted, destroyed or anonymised.

Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its deletion or destruction; to request that these actions be notified to third parties to whom the data was transferred; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.

You can send requests to info@navluno.com. Requests are answered free of charge within thirty days at the latest.

2. Privacy Policy

Navluno is an online business software service (SaaS) for collecting spot freight requests and comparing quotes. This policy explains what data we process, why, and how we protect it.

What we collect

We collect only the data the service needs to work: account and billing details, freight request content, documents attached to requests, quotes submitted by carriers, and activity and security logs. We do not use ad networks, analytics software, tracking pixels or social media tracking code.

Each customer's data is separate

Each customer works in its own workspace: the application runs as a separate process for each customer and its data is kept in a separate data folder. One customer's users cannot see another customer's data. See the Information Security Policy for details.

Payment details

Card payments are made on the secure payment page of iyzico Ödeme Hizmetleri A.Ş. The card number, expiry date and security code never reach Navluno's servers and are not stored. We only record the result of the payment and the transaction number issued by the payment institution.

Email

Invitations to carriers and account notifications are sent through our sending infrastructure on a domain authenticated with SPF, DKIM and DMARC. In invitations, the sender name is the username of the customer user who performed the action, and replies go to the customer's email address.

Sub-processors

• Railway Corp. — hosting the application and data.
• Sendinblue SAS (Brevo) — sending email.
• iyzico Ödeme Hizmetleri A.Ş. — taking card payments.
• Google Fonts — page fonts are loaded from Google's servers; the visitor's IP address is sent to Google with this request.

Any change to the list of sub-processors will be announced on this page.

You as the data owner

The customer organisation owns the data it enters into the platform. During the plan and within 90 days after it ends, you may request that your data be exported or deleted. Send requests to info@navluno.com.

3. Terms of Use

The service

Navluno is an online software service that lets users create spot freight requests, invite carriers to quote with a single link and compare the quotes received on one screen. Navluno does not provide transport services, is not a party to any contract of carriage and does not guarantee the accuracy of quotes.

Plans

• The service is offered in 3-month, 6-month and annual plans, paid upfront. Prices are shown on the purchase page excluding and including VAT.
• Plans do not renew automatically. A reminder is sent before the plan ends; at the end of the term the workspace is closed for use.
• Purchase terms are set out in the Distance Service Sales Agreement.

Accounts

• Accounts belong to the organisation; usernames and passwords may not be shared.
• Users are responsible for actions taken with their account. Suspicious access must be reported immediately to info@navluno.com.
• The workspace admin can add and remove users, assign roles and reset two-step verification. Purchasing a plan is limited to the admin role.

Use of email

• Invitation emails may only be sent to carriers with whom there is a business relationship, for the purpose of requesting quotes. Bulk promotional email (spam) may not be sent.
• A daily sending limit applies per workspace. Sending may be suspended temporarily in case of misuse or a high bounce rate.

User obligations

• Documents and information uploaded to the platform must be accurate and must not infringe third-party rights.
• Personal data entered into the platform (for example, carrier representatives' contact details) must have been obtained lawfully.
• The platform may not be reverse-engineered or scraped, and no attempt may be made to circumvent its security measures.
• Applicable law must be complied with, in particular data protection regulations.

Suspension

In case of a serious breach of these terms, a security threat or misuse, access may be suspended until the breach is remedied. The reason is notified to the customer's email address.

Intellectual property

All rights in the software, interface design and promotional content belong to Navluno. The customer is granted a non-transferable, non-exclusive right of use for the duration of the plan only. Data the customer enters into the platform belongs to the customer.

Service level and liability

We aim to provide the service continuously, except for planned maintenance and outages caused by the infrastructure provider; uninterrupted operation is not guaranteed. Planned maintenance is done outside business hours where possible. Navluno is not liable for indirect damage, loss of profit, or the consequences of business decisions made in reliance on quotes provided by third parties. Except in cases of intent or gross negligence, liability is limited to the plan fees paid in the last twelve months.

End of the plan

The plan ends automatically at the end of the purchased term. Within 90 days after it ends, the data is delivered in machine-readable form on request; it is deleted at the end of this period.

Changes

If these terms change, the current text is published on this page and admins are notified by email. Fees already paid for the current term do not change.

Governing law

These terms are governed by Turkish law. The courts and enforcement offices of the Republic of Türkiye have jurisdiction over disputes (Turkish text: Türkiye Cumhuriyeti mahkemeleri ve icra daireleri).

4. Pre-Contract Information and Distance Service Sales Agreement

The sales agreement is concluded in Turkish. During purchase it is filled in automatically with your billing details, the selected plan and the amounts, and you accept it by ticking the box on the payment page; a copy of the completed agreement is emailed to you after payment.

The agreement covers, in summary: the parties and the service; plan, price and VAT; upfront payment by card through iyzico or by bank transfer; immediate start of the service on payment confirmation; no automatic renewal; the absence of a right of withdrawal for electronically provided services started immediately with the buyer's consent; refunds for failures attributable to Navluno; data protection; and jurisdiction. The full text is available in the Turkish version.

5. Payment, Cancellation and Refund Terms

• Payment: The plan fee is paid upfront by credit or debit card through iyzico. For payment by bank transfer, write to info@navluno.com.
• No automatic renewal: Your card is not charged for the next term. A reminder email is sent before the plan ends.
• Cancellation: As plans do not renew automatically, no cancellation is needed. A prepaid plan can be used until the end of its term; no refund is made for unused time if you stop using it.
• Service failure: If a failure attributable to Navluno that prevents use of the service is not fixed within a reasonable time, the unusable period is added to the plan or the corresponding fee is refunded.
• Incorrect or duplicate charge: Reported to info@navluno.com, it is investigated; any amount found justified is refunded to the card used within 14 days at the latest. How long the refund takes to appear depends on your bank.
• Right of withdrawal: As the service is provided electronically and starts immediately on payment confirmation, there is no right of withdrawal (see the sales agreement).

6. Information Security Policy

The technical and organisational measures we apply to protect the confidentiality, integrity and availability of customer data. This policy also explains how the data security obligation under Article 12 of the KVKK is met.

Separation between customers

• Each customer workspace runs in a separate operating system process and uses a separate data folder; customers do not share a database file.
• Which workspace a user is routed to is determined by a cookie signed on the server with a secret key; without the signature, no one can switch to another workspace.
• Each workspace has its own session key; a session opened in one workspace is not valid in another.

Access and authentication

• Passwords are stored irreversibly with bcrypt; no screen, email (except initial sign-in details) or API response contains a password hash.
• Two-step verification is supported: passkeys (WebAuthn/FIDO2) or a six-digit verification code, plus a one-time recovery code.
• Failed sign-in and password reset attempts are rate-limited per IP and per user. Password reset links are single-use and expire after 30 minutes.
• Permissions (admin, procurement, operations) are enforced on the server; actions outside a role are not just hidden in the interface but rejected by the server.
• Quote links are generated with unpredictable random keys and stop accepting quotes once the request is concluded.

Transmission and storage

• All traffic is encrypted with HTTPS (TLS). Session cookies are set as httpOnly, secure and SameSite.
• Card details never reach our systems; payment is taken on the page of a licensed payment institution subject to PCI-DSS (iyzico). The payment result is verified server-to-server with the payment institution.
• Emails are sent from a domain authenticated with SPF, DKIM and DMARC.

Backup and continuity

• A daily copy of each workspace's database is taken and kept for 14 days. The workspace admin can download a backup of their own data at any time.
• Backups are kept on persistent disk in the infrastructure hosting the application.

Logging and monitoring

• A separate activity log is kept for each workspace: account opening, payments, plan changes, application start-up and errors. Logs are protected against unauthorised access and kept for at most 1 year.
• Sign-in attempts and security events are monitored.

Development and change management

• Each new version is tested in a separate trial environment before it reaches customer workspaces. The version number is visible in every workspace.
• The software runs on a small number of widely used open-source dependencies, which are monitored for security updates.

Staff and administrative access

• Administrative access to the infrastructure and customer data is limited to authorised persons bound by confidentiality.
• Customer data is accessed only to the extent necessary for a support request, a security incident or a legal requirement.

Security breaches

If personal data is found to have been obtained by unauthorised persons, the affected customer is informed without delay and within 72 hours at the latest; the Personal Data Protection Board and, where necessary, the data subjects are notified under Article 12/5 of the KVKK. To report a vulnerability: info@navluno.com

Customer responsibility

Security is a shared responsibility. The customer is responsible for using strong passwords, enabling two-step verification, closing the accounts of departing employees and assigning user roles correctly.

7. Data Processing Terms

Under Article 12/2 of the KVKK, these are the terms between the customer ("Data Controller") and Navluno ("Data Processor") regarding personal data the customer enters into the platform. They form an integral part of the sales agreement.

Scope

Personal data the customer enters into or creates on the platform: account details of the customer's users, names and contact details of carrier representatives, personal data within request and quote content, and uploaded documents.

Processor obligations

• Processes the data only to provide the service and in line with the customer's instructions; does not use it for its own purposes, sell it or disclose it to third parties.
• Applies the technical and organisational measures in the Information Security Policy.
• Uses only the sub-processors listed in the Privacy Policy and announces changes in advance.
• Informs the customer of a security breach without delay and within 72 hours at the latest, and provides the information needed to remedy it.
• Reasonably assists the customer in responding to data subjects' requests under Article 11 of the KVKK, and forwards any requests it receives directly.
• Ensures its staff are bound by confidentiality.
• When the plan ends, delivers the data on the customer's request and deletes it within 90 days of the end date, except for records that must be retained by law.
• Provides information demonstrating compliance with these terms upon the customer's reasonable request.

Controller obligations

• Obtain the personal data entered into the platform lawfully, inform the data subjects and obtain their explicit consent where required.
• Use the platform only for quote processes with carriers with whom there is a business relationship.
• Keep its own user accounts secure.

8. Cookie Policy

No advertising, analytics or profiling cookies are used. There are only cookies that are strictly necessary for the service to work.

As strictly necessary cookies do not require consent, no cookie banner is shown. If you block cookies in your browser, the website keeps working but you cannot sign in to the application. Cookies set by the iyzico page opened during payment are iyzico's responsibility.

Pages load fonts from Google Fonts. This does not create cookies, but your IP address is sent to Google's servers with the request.