1. Scope and controller
The service provider and controller of your personal data is Milpes Elektronik. Address: Malıköy Başkent OSB, 7.Cadde no:11, 06909 Sincan/Ankara, Türkiye. Email: info@milpes.com. Telephone: +90 507 930 20 25.
This policy covers personal data processing in the MILPES Monitoring System web platform and the Milpes Android app (com.monitoring.milpes). It is a privacy notice, not a separate declaration of consent.
2. Information and collection methods
Account and contact: name, surname, email, telephone, country, language, timezone and any agent code entered in registration/profile forms; roles, permissions, approval and active status. Passwords are stored as hashes for verification.
Plants and devices: plant name, type, address, city/country, coordinates, capacity, photo, prices and calculation coefficients; inverter/datalogger serial number, MAC, model, firmware, connection and operating status. Devices provide timestamped energy, power, voltage, current, temperature, battery, fault and supported sensor measurements. Plant/device data may be personal data when linked to an individual.
Transactions and security: sessions, sign-in attempts, IP address, browser/client information, action time and result; plant invitations, recipient emails, permissions, transfers, device commands and audit records; agreement version and acceptance time.
Documents and notifications: uploaded files/images and their metadata; notification channels, categories, quiet hours and delivery/read status. Notification tokens, installation identifiers, phone manufacturer/model, operating system and app version, language, timezone and notification permission status are processed for mobile notification delivery and registered-device management.
In the Android app, camera permission is requested to scan a device QR code into serial/verification-code fields or, at your request, take a plant photo. QR images are processed in the app; decoded fields are included in the device-registration request. A plant photo you select using the system photo picker or take with the camera is uploaded to the MILPES server when you create or update the plant. Camera and notification permissions can be managed in Android settings; accepting the agreement does not grant those permissions automatically.
The Android app stores access/refresh tokens encrypted using Android Keystore to maintain sessions, and keeps an app installation identifier, language/theme preferences and a copy of received notifications on the device. Uninstalling the app or clearing app data does not delete the server account or historical records.
Information is collected from you, authorised plant users, connected devices and automatically during platform use. The service does not request special-category personal data or payment card details; do not include them in free-text fields or files.
3. Purposes and legal grounds
Account creation, authentication, plant/device monitoring, reports, sharing and requested notifications are processed to the extent necessary to establish or perform the service agreement (Turkish Law No. 6698, Article 5(2)(c)). Permission, security, abuse-prevention and technical error records are assessed for necessary legitimate interests without prejudicing fundamental rights and freedoms (Article 5(2)(f)).
Data necessary to meet legal obligations may be processed under Article 5(2)(ç); records needed to establish, exercise or protect a right under Article 5(2)(e). An activity requiring explicit consent and not covered by these grounds needs separate, specific and withdrawable consent. The agreement checkbox is not a substitute. Without required fields, the relevant account or plant transaction may not be completed.
4. Access, recipients and hosting
Authorised MILPES personnel, users with whom you share a plant and transfer recipients may access data within their duties or granted permissions. Recipient selection and permissions affect the scope of sharing. Public documents are also available to visitors.
Core service data is hosted on Google Cloud infrastructure in Germany. Hosting and email-delivery providers may process information necessary for those services. Cloudflare Turnstile, Google Fonts, OpenStreetMap and external visual resources used by the web platform may receive your IP address and technical request information from your browser. Requests from competent authorities are assessed within legal requirements.
Google Firebase Cloud Messaging and Firebase Installations are used to deliver mobile push notifications. Google may process notification tokens, installation identifiers and technical connection information required for these services; MILPES uses this information for notification delivery and registered-device management.
The Android app also includes the Google Analytics for Firebase SDK. Under its default collection settings, Google may process app-usage/session events, app version, technical device/OS information, app-instance/installation identifiers and, where permitted by device settings, the advertising identifier for usage measurement and notification-interaction analysis. Google’s privacy information also applies. The description of web cookies is separate from this processing by mobile SDKs.
Hosting in Germany involves international data transfer from Türkiye. The location of the core server does not mean every supporting service or access is confined to Germany. An appropriate legal mechanism under Article 9 of Law No. 6698 must be separately established; this policy and checkbox are not a standard contract or transfer authorisation. Request transfer and recipient details at info@milpes.com.
5. Retention and account closure
Account and plant data is retained for as long as needed for the service relationship and relevant purpose. Retention of security and transaction records is separately assessed against legal obligations and protection of rights. No single fixed period or automatic blanket-deletion promise applies to all categories.
Account closure ends active access and sessions and de-identifies profile fields; a technical account record and some historical transactions may remain for audit relationships. This does not mean all personal data in historical logs or existing backups is fully anonymised. Requests to erase, destroy or anonymise data without a remaining retention ground are assessed separately.
6. Your rights and contact
Under Article 11 of Law No. 6698, you may ask whether personal data is processed, request information about processing, its purpose and appropriate use, and learn domestic/international recipients. You may request correction of incomplete/inaccurate data and erasure or destruction where statutory conditions are met; request notification of correction/erasure to recipients; object to adverse results arising solely from automated analysis; and seek compensation for unlawful processing.
Submit requests through legally prescribed methods to the postal address above or from your registered email to info@milpes.com. Identify the request and account; do not send passwords or verification codes. Additional information may be requested only as necessary to verify identity. Valid requests are handled within the statutory period, no later than thirty days. Complaints to the authority and other legal remedies remain available.