Privacy Policy & Data Protection Statement
Last Revised: August 2, 2026 | Data Privacy, Security Protocols & Processing Terms
This Privacy Statement is executed pursuant to General Data Protection Regulation (GDPR - EU 2016/679). İri CRM (Berke İri) operates as a "Data Controller" regarding direct platform subscribers, and as a "Data Processor" regarding end-customer/patient data uploaded to the software by registered clinic clients.
1. Data Controller Identification
İri CRM SaaS platform, cloud infrastructure, and software products are owned and operated by Berke İri ("Sole Proprietorship", "We", "İri CRM").
- Legal Business Name: Berke İri (İri CRM)
- Official Website: https://iricrm.com
- Official Email: [email protected]
- Headquarters: TOROS MAH. PINARBAŞI CAD. HACI GÖÇMEN APT NO: 13 İÇ KAPI NO: 7 KONYAALTI / ANTALYA, TURKEY
2. Categories of Personal Data Collected & Methods
In the course of providing SaaS operations, the following data categories are processed automatically or via user input:
A. Client Account Data
First/Last Name, Company Title, Corporate Email, Phone Number, Encrypted Password (Hashed), Billing & IBAN details.
B. System & Log Security Data
IP Addresses, Access Logs, Active Sessions, Browser Specifications, Device Hardware Identifiers.
C. Financial Transaction Data
PayTR Online POS Transaction ID (OID), Payment Status, Plan Invoices. (Credit Card numbers are NEVER stored on İri CRM servers).
D. API Integration Telemetry
Meta Business / WhatsApp Cloud API access tokens, Messaging Logs, Template Identifiers, Automation Execution Rules.
3. Limitation of Liability: Data Processor vs Data Controller
Enterprise clients, clinics, and agency accounts using İri CRM act as the SOLE DATA CONTROLLER for all patient, lead, and customer data uploaded into their isolated accounts.
- Clients are solely responsible for obtaining explicit consent from end-customers pursuant to GDPR Article 6 & 9.
- İri CRM acts exclusively as a cloud infrastructure DATA PROCESSOR.
- İri CRM shall not be held liable for any unauthorized data collection, spam violations, or lack of consent committed by client accounts. Clients agree to fully indemnify İri CRM against all third-party privacy claims.
4. Lawful Basis for Data Processing (GDPR Article 6)
Personal data processing is strictly conducted under the following lawful bases:
- GDPR Art. 6(1)(b): Necessary for the performance of the İri CRM Master SaaS Contract.
- GDPR Art. 6(1)(c): Compliance with legal obligations under commercial and tax legislation.
- GDPR Art. 6(1)(f): Legitimate interests pursued by İri CRM to maintain server security and prevent fraudulent access.
5. Third-Party Data Disclosures & Transfers
• PayTR Payment Gateway: For executing encrypted online POS subscription transactions.
• Meta Platforms Inc. / WhatsApp Cloud API: For routing outbound/inbound messaging triggers.
• AWS & Hostinger Cloud: For hosting encrypted database clusters and file storages.
• Legal Authorities: Pursuant to official judicial sub-poenas or court orders.
6. Your Data Protection Rights Under GDPR (Articles 15-22)
Under GDPR, data subjects maintain the right to access, rectify, request erasure ("Right to be Forgotten"), restrict processing, and request data portability. Official enquiries can be submitted to [email protected].
Start Your 15-Day Free Trial Today.
No Card RequiredCancel anytime. Join 500+ fast-growing companies scaling their sales with İri CRM.