Your business stays yours.
This notice explains what IBDock collects, why, and how to exercise your rights. Your broker relationships are not a sales list.
1. Who is responsible
IBDock is operated by Nordera Works Teknoloji Danışmanlık AŞ, İstanbul, Türkiye, the controller for the website, onboarding and enquiries described here. Privacy and rights requests: hello@norderaworks.com. Product assistance: desk@ibdock.com. A product brand is not a separate legal person.
2. What you choose to share
When you submit a request or save an onboarding step, we record your name, work email, optional company, business type, country of operation, chosen broker names, reporting preference and stated priority. We also record step timestamps, a notice version, optional product-news choice and an internal reference. Saving a step submits that step even if you do not finish onboarding. Contact addresses are self-reported until separately verified.
Do not include trader identities, account numbers, passwords, API keys, identity documents or sensitive financial records in these forms. The public statement preview processes sample files in the browser tab. Those files and their financial amounts are not attached to onboarding or demo notifications.
3. Purpose and legal basis
We use requested contact and workflow information to evaluate and respond to your enquiry, prepare a potential service and maintain its progress. Where applicable, this relies on steps requested before a contract (GDPR Article 6(1)(b), KVKK Article 5(2)(c)). Necessary abuse prevention and service security rely on legitimate interests, subject to your rights (GDPR Article 6(1)(f), KVKK Article 5(2)(f)). Applicable legal obligations may require limited retention.
Optional demo reporting and optional product news rely on your separate affirmative choice. Refusing either does not prevent using the demo or submitting an enquiry. You can withdraw by contacting us; withdrawal does not undo lawful earlier processing. Reading this notice is not blanket consent to unrelated processing, international transfers or broker marketing. No automated decision with legal or similarly significant effects is made from onboarding.
4. Demo events, cookies and technical records
Exploring the demo does not automatically identify you or send your financial activity to our inbox. “Share my demo visit” optionally records a demo-start event, random event reference, timestamp and this notice version. It does not contain your files, email, broker selection or figures. It is an event count, not a verified unique visitor count.
After you request saved onboarding, an essential HTTP-only session cookie lets this browser resume for up to 30 days. Keep a shared device private: anyone using the same browser session may see that saved form. Owner login uses a separate eight-hour session cookie. We do not install advertising pixels. Temporary keyed network-address hashes enforce request limits; hosting and security providers may separately process technical network logs.
5. Who receives information
Authorized IBDock administrators can review enquiries and onboarding. Hosting is provided by Vercel and database infrastructure by Supabase. The configured mailbox service is PrivateEmail. Operational event notifications are addressed to desk@ibdock.com; their contents are limited to the event type, reference and protected inbox link. A separate transactional email provider must be configured before automatic sending operates. We do not sell IB information or give brokers access to it. A requested broker introduction would need a separate, specific instruction.
6. International processing
Hosting, support, email and backup processing may involve countries outside Türkiye or the EEA. A Frankfurt database region alone does not establish that every service operation remains in Germany. Applicable transfer requirements must be addressed for each provider and route, including GDPR Chapter V and KVKK Article 9 where applicable. A checkbox on this page does not replace required contractual safeguards. Contact the controller for the applicable provider and transfer arrangements before submitting information that requires a specific regional commitment.
7. Retention and security
Saved onboarding and its step history expire 30 days after the first saved step. Anonymous demo events expire after 30 days. Expired records are removed during the next onboarding, demo or owner-inbox operation. Completed enquiries are separately retained for up to 90 days and removed during the next CRM operation. Notification status records expire with their associated events. Restricted access, transport encryption, bounded requests and rate limiting reduce risk; no system promises absolute security.
Mailbox copies, provider logs and backups have separate retention schedules; deleting an active application record does not instantly remove those copies. A verified deletion request must be handled across relevant systems, subject to applicable legal holds. Private financial accounts, if separately activated, use their own access and erasure workflow.
8. Access, correction, withdrawal and complaints
Depending on the applicable law, you may request access and information, correction, erasure, restriction, portability, objection, withdrawal of consent, and review of qualifying automated decisions. Under KVKK Article 11, rights include learning whether data is processed, purposes and recipients, requesting correction or deletion under the statutory conditions, notification of those actions to recipients, objecting to adverse results from exclusively automated analysis and compensation for unlawful processing.
Email hello@norderaworks.com with your request and, if available, your reference. We may request proportionate identity verification; do not send passwords or identity documents unsolicited. GDPR requests are normally answered within one month, with permitted extensions explained; KVKK applications are concluded as soon as possible and within 30 days under the applicable procedure. You may complain to the competent supervisory authority, including the Turkish Personal Data Protection Authority or your relevant EEA authority.
9. Türkçe KVKK özeti
Veri sorumlusu Nordera Works Teknoloji Danışmanlık AŞ, İstanbul/Türkiye’dir. İletişim: hello@norderaworks.com. Başvuru ve başlangıç formunda verdiğiniz iletişim, işletme, broker tercihi ve süreç bilgileri talebinizin değerlendirilmesi, yanıtlanması ve kaydedilen adımların takibi için elektronik ortamda işlenir. Uygun olduğu ölçüde sözleşme öncesi talebiniz, meşru menfaat ve kanuni yükümlülük hukuki sebeplerine dayanılır. İsteğe bağlı demo bildirimi ve ürün haberleri ayrı seçime tabidir. Veriler yetkili ekip ve ilgili altyapı hizmet sağlayıcılarıyla amaçla sınırlı olarak işlenir; brokerlara satılmaz. Yurt dışı hizmet kullanımı için Kanun’un 9. maddesindeki aktarım koşulları ayrıca değerlendirilir. Kanun’un 11. maddesindeki haklarınızı yukarıdaki iletişim adresinden kullanabilirsiniz.
10. Sources and changes
This notice describes this release; it is not a certification of universal compliance. Material processing changes require an updated notice before the new collection. The service does not target children.
Preview terms →