Privacy Policy

Sires Group has offices in Nigeria, Türkiye and Syria. Three group companies are responsible for your personal data. The law calls them “data controllers”.

• SİRES FOODS GIDA AMBALAJ İTHALAT İHRACAT TİCARET VE SANAYİ LTD. ŞTİ. (“SiresFoods”), Fatih Mah. 30009 Sk. Özdiker Sitesi Blok B No: 58 İç Kapı Kat: 14 No: 27, Mezitli / Mersin, Türkiye.
• Rayfab Enterprises Limited (“Rayfab”), No 14 Airport Road, Kano, Nigeria.
• MoneyWise LLC (“MoneyWise”), Aleppo, Syria.

If you work in the Türkiye office, SiresFoods is responsible for your data. If you work in the Nigeria office, Rayfab is responsible. If you work in the Syria office, MoneyWise is responsible.

The three companies work as one group and use the same business system. They share the business records with each other, only to run the group’s business.

Today the app runs only on invented demonstration data. It contains no real business records, and it does not collect any personal data from you.

• You sign in with demonstration accounts. The app checks them on the phone itself.
• Nothing you type into the app is sent anywhere, and the app makes no network connections for its data. It goes online only when you tap Privacy policy or Help & contact, which open pages on our website.
• Records you create in the demonstration stay only in the app’s memory and are gone when the app closes.
• On your phone, the app keeps only your sign-in session for the demonstration account and whether you turned face or fingerprint unlock on, in the phone’s secure storage (the Keychain on iPhone, or storage protected by the Android Keystore), and your chosen language and theme.
• If you turn on face or fingerprint unlock, your phone checks your face or finger itself. The app only learns whether the check succeeded, and it never sees your face or fingerprint.
• To pick its language and number format, the app reads your phone’s settings. This stays on your phone.

The sections on what we collect, why we use it, who can see it, where it is stored, how long we keep it and security describe the app once it is connected to the company’s business system. The other sections apply now. We will update this policy, and tell staff, before the app connects.

Once the app is connected, it processes the following data about you.

• Your account: your name, your work e-mail (you use it to sign in), an account ID that our system gives you, your role (owner, finance, office operator or sales) and your office. The app never stores your password. The server keeps passwords only in a scrambled form (hashed).
• Phone approval: the owner must approve each new phone before it can be used. For this, the app sends a code that it creates for that phone (a device ID, not the phone’s advertising ID) and the phone’s model name. Our server keeps a record of the approval.
• Security logs: our server records the IP address (the internet address a request comes from), the time and what was requested. We use these logs only for security and to fix problems, never to find out where you are.
• On your phone: your sign-in session, in the phone’s secure storage. It holds a sign-in key and your account details (account ID, name, work e-mail, role and office). Secure storage also holds whether you turned face or fingerprint unlock on. The app also keeps the code it created for your phone, and your chosen language and theme.

The app also processes the business records that you create or act on. This is financial information about the company’s business:

• Money transfers between offices: amounts, currencies, exchange rates, dates, offices, a reference and notes.
• Approvals and rejections of records. A rejection includes the written reason.
• Cash counts: the amount counted in an office vault, the difference from the books and a note.
• Expenses: amount, currency, category and a short description.
• Sales invoices: the customer’s name (a company or a person), quantities, prices, payment terms, destination, notes, and what the customer has paid and still owes.

Each record shows the name of the colleague who recorded, counted, approved or rejected it, and when they did it. Colleagues who have access to that record can see these names and times.

A customer on a sales invoice can be an individual person who buys from us for their business. In that case the invoice holds that person’s name and what they have paid and still owe.

Notes, references, descriptions and reasons are free text. Please write only what the record needs, and no private details about yourself or other people.

How we get this data: we enter your account details when we create your account. You and your colleagues type the business records into the app, including customer names. The app creates the phone code itself and reads the phone’s model name from the phone. Our server writes the security logs automatically. All of it is collected electronically, through the app and the company’s business system.

The app does not use your location, contacts, photos, camera or microphone. It does not collect health data, payment card data or advertising identifiers. The app never receives, stores or sends data about your face or fingerprint (biometric data): your phone checks it and only tells the app whether it matched. Unlocking with Face ID, Touch ID or your fingerprint is optional, and you can turn it off in More.

The app has no analytics, advertising, tracking or crash-reporting tools. We do not use your data for advertising or profiling. We do not make decisions about you by computer alone (automated decisions) that have a legal effect on you or affect you in a similarly serious way.

We never sell personal data.

We use personal data only for the purposes below. After each purpose we name its legal basis: the legal reason that allows it.

• To create and manage your account, let you sign in and show you only what your role and office allow. Legal basis: it is necessary to perform your employment or service contract with us.
• To run the company’s bookkeeping and approvals. Legal basis: the same contract.
• To keep accounting and tax records. Legal basis: the law requires it (legal obligation).
• To keep the system safe and prevent fraud, for example with phone approval and security logs. Legal basis: our legitimate interests. We have a real need to protect the company’s records, and these checks do not unfairly affect you.
• To record customer names on sales invoices. Legal basis: it is necessary to perform the sales contract with the customer and to meet our legal obligations.
• To share business records between SiresFoods, Rayfab and MoneyWise, so the group can work as one business. Legal basis: our legitimate interests and, for accounting and tax records, our legal obligations.

Inside the group, what you can see depends on your role and office.

• Office operators see the money transfers, expenses and cash counts of their own office. They do not see sales.
• The sales person sees the sales of their own warehouse, the list of customer names, and the expenses and cash counts of their own office. The sales person does not see money transfers.
• The owner and finance see all records.

SiresFoods, Rayfab and MoneyWise share business records with each other, only to run the group’s business. Staff of all three companies see records only as their role and office allow, as described above.

Our hosting providers store the data for us (see the next section). They act only on our instructions. All three group companies and our hosting providers give your data the same protection that this policy describes.

We do not give the data to anyone else, except to public authorities, such as tax authorities or courts, when the law requires it.

Once it is connected, the app talks only to the company’s own business system, over an encrypted HTTPS connection. The only exceptions are the Privacy policy and Help & contact links, which open pages on our website.

This system is hosted in the European Union, in Germany, by service providers: a managed database host in Frankfurt and a rented server in Germany. They are our processors, which means they act only on our instructions.

So data entered in Nigeria, Türkiye or Syria is stored in Germany. Authorised staff in all three countries can see it, and SiresFoods, Rayfab and MoneyWise share the business records with each other. The law calls this an international transfer of personal data.

We protect all of these transfers, including the sharing between SiresFoods, Rayfab and MoneyWise, with the safeguards the law requires, such as standard contracts. These include the standard contract approved by the Turkish Personal Data Protection Board and the safeguards required by the Nigeria Data Protection Act 2023. We give the same protection to the data of staff in every office.

• Account details: kept while you work for the group. When you leave, we close your account and, within 90 days, delete your personal account details (your e-mail and phone approvals). Your name stays on the business records where it appears.
• Business records: kept as long as the commercial and tax law of each office requires. This is up to 10 years in Türkiye and at least 6 years in Nigeria. For the Syria office, we keep them as long as Syrian commercial and tax law requires. After that, we delete them or anonymise them (we remove anything that shows who a person is).
• Security logs: up to 90 days.
• Phone approvals: deleted when the phone is removed from your account. When your account is closed, the approval ends at once and the record is deleted within 90 days.
• On your phone: your sign-in session is deleted when you sign out, or when it expires or is no longer accepted. To be sure it is removed, sign out before you delete the app. Your language and theme stay until you change them or delete the app.

Once the app is connected, we protect your data in these ways:

• Your data is encrypted while it travels between the app and our system (HTTPS/TLS).
• Your sign-in session is kept in the phone’s secure storage.
• Passwords are kept on the server only in hashed form.
• Access is limited by role and office.
• The owner approves each phone before it can be used.
• Access to the system is logged.

If there is a data breach, we tell the data protection authority and the people affected, as the law requires. For example, we tell the Nigeria Data Protection Commission, the Turkish Personal Data Protection Board, or both, within 72 hours after we find out. We tell the people affected as soon as we can.

Whatever country you work in, you have the right to:

• know whether and how we process your data;
• get a copy of your data;
• have wrong data corrected;
• ask us to delete your data or limit how we use it, where the law allows;
• object to how we use your data;
• get your data in a common electronic format that you can pass on, where this applies;
• withdraw your consent at any time, where we use your data based on your consent (today, nothing in this app is based on consent);
• complain to a data protection authority, where your country has one.

To use any of these rights, e-mail info@siresfoods.com. This is free of charge. We may ask you to confirm who you are. We answer within 30 days.

You can ask at any time to have your account closed and your data deleted. E-mail info@siresfoods.com. We close the account and, within 90 days after that, delete your personal account details (your e-mail and phone approvals). We must still keep business records, with the names on them, for as long as the law requires (see “How long we keep it”).

If you are a customer and your name is on one of our sales invoices, you have the same rights. Write to the same e-mail address.

Nigeria: you have the right to complain to the Nigeria Data Protection Commission (NDPC). Its website is ndpc.gov.ng.

Syria: send any request or complaint to us at info@siresfoods.com. We answer within 30 days.

Türkiye: Article 11 of the Personal Data Protection Law No. 6698 (KVKK) also gives you the right to:

• learn why we process your data and whether we use it only for that purpose;
• know who we have shared your data with, in Türkiye or abroad;
• ask us to tell those people about any correction or deletion;
• object if a result that goes against you comes only from automated analysis of your data;
• claim compensation if you suffer damage because your data was processed unlawfully.

Please apply to us first. If we refuse, if our answer is not enough, or if we do not answer within 30 days, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). You must do this within 30 days of our answer, and in any case within 60 days of your request. Its website is kvkk.gov.tr.

The app is only for adult staff of the group. It is not for anyone under 18.

When we change this policy, we update this page and the date at the top. We tell staff in advance about important changes, in the app or by e-mail. This includes the update we will make before the app connects to the company’s business system.

For any question about this policy or your data, e-mail info@siresfoods.com. This address is for SiresFoods, Rayfab and MoneyWise. You can also write to us by post at the addresses under “Who we are”: SiresFoods for the Türkiye office, Rayfab for the Nigeria office, and MoneyWise for the Syria office.