Introduction
SOMM Platform ("SOMM") is an in-store digital sales and management platform for furniture dealers, operated by OCZ Company. This Privacy Policy explains how your personal data is collected, used, stored and protected when you use our services. SOMM operates in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and applicable regulations. This English page mirrors the Turkish policy at /gizlilik.
Data we collect
Identity information
- Full name
- National ID number (for sales transactions)
- Email address
- Phone number
- Address information
Transaction information
- Sales and quote history
- Product preferences
- Payment and installment plans
- Delivery information
Technical data
- IP address
- Browser and device information
- Session cookies (JWT token)
- Platform usage logs
Social media data
- Messages received via Instagram and WhatsApp
- Social media usernames
- Conversation history at the customer's request
Purpose of data use
- Managing sales and quote processes
- Customer relationship management (CRM)
- Delivery tracking and logistics operations
- SAP integration and inventory management
- Customer communication over social media
- Performance analysis and reporting
- Fulfilling legal obligations
- Ensuring platform security
Data storage and security
Your personal data is protected on servers located in Türkiye using industry-standard security measures. Data is retained for the legally required periods and securely destroyed at the end of those periods.
- Data transmission with SSL/TLS encryption
- Cloudflare security layer
- JWT-based session management (HttpOnly, Secure, SameSite cookie)
- Role-based access control (RBAC)
- Brute-force protection via rate limiting
- Regular security audits
- PostgreSQL database encryption
Data sharing
Your personal data is not shared with third parties except in the cases below. Your data is never sold or transferred to third parties for marketing purposes.
- Legal obligations (court order, official authority request)
- For dealer management within the franchise partnership
- For business processes within the SAP integration
- Within the Meta (Facebook/Instagram/WhatsApp) API integration
Meta Platform Data (Facebook & Instagram)
SOMM lets stores connect their OWN Instagram Business and Facebook Page accounts to manage customer Direct Messages (DMs) from a unified inbox. Meta permissions are used only for the account the store explicitly connects, and only for the purposes below.
How we use Meta permissions
- instagram_basic / pages_show_list — let the store select and connect its own Instagram Business account (linked to its Facebook Page).
- instagram_manage_messages — display incoming Instagram DMs in the inbox and send replies to customers on the store's behalf.
- pages_manage_metadata — subscribe to webhook events for new messages.
- business_management — access the business assets (Pages/IG accounts) the store owns.
- pages_messaging — manage Facebook Page messages.
Data handling and deletion
- Data obtained via Meta is used solely to power the store's own customer-message inbox.
- It is never shared with third parties, sold, or used for marketing.
- A store can disconnect its Instagram/Facebook account at any time, which immediately ends the related access.
- Data deletion requests: email [email protected], or use the data deletion callback at https://sosyal.somm.com.tr/api/meta/data-deletion.
- Access is always limited to the account the store connects through the standard Facebook Login + OAuth consent flow.
Your rights (under KVKK)
Under Article 11 of the Turkish Personal Data Protection Law No. 6698, you have the right to learn whether your personal data is processed, to request information, correction, deletion, transfer and to object.
- Learn whether your personal data is being processed
- Request information if it has been processed
- Request correction if processed incompletely or inaccurately
- Request deletion or destruction under Article 7 of KVKK
- Request that processed data be reported to third parties
- Object to results arising against you from automated analysis
- Request compensation if you suffer damages
Data deletion
To request deletion of your account and associated data, email [email protected] with the subject "Data Deletion Request". Your request is processed within 30 days at the latest. For Meta (Instagram/Facebook) data, the data deletion callback URL https://sosyal.somm.com.tr/api/meta/data-deletion may also be used.
Changes
This privacy policy may be updated in line with legal regulations or service changes. Significant changes are announced through the platform.
Contact
For questions about our privacy policy, write to [email protected] or [email protected]; you can also reach us via the /iletisim page.