Shop-owner Kit — Puw

Last updated: 31 October 2026

In short
- You are the data controller for your cameras' footage and for the descriptions Puw writes from it. Luvi never receives this data.
- Decide the purpose of each camera before you install it, and film only the places that purpose needs.
- Put no cameras in toilets, changing rooms, prayer rooms (mescit) or rest areas. Do not record covertly or focus on faces, and keep audio off.
- Do not use the cameras to monitor staff performance, productivity or attendance.
- Put up signs at the entrances and give visitors and staff a notice. Ready texts are in sections 9, 10 and 11.
- Keep recordings for the shortest time your purpose needs. Set Puw's storage limit to match, and count the event descriptions too.
- Protect the PC that runs Puw with a password, and decide who may see the recordings.
- Most small businesses are exempt from VERBİS registration; the duties to inform, secure and delete still apply.
- This kit is practical guidance, not legal advice. For your own situation, you may want to ask a lawyer.

1. Your role

When you use Puw in your business, you decide what the cameras record, why and for how long. So under the Turkish Personal Data Protection Law No. 6698 ("KVKK") you are the data controller for the footage and for the event descriptions, reports and alert history Puw produces.

All of this stays on your PC. Luvi Technologies, Inc. ("Luvi"), which sells Puw, does not receive, see or store it, and is neither a controller nor a processor for it. The one exception is when you turn on Telegram alerts with easy setup (@puw_bot): the alerts then pass through Luvi's server without being stored, and for that delivery Luvi acts as a processor on your behalf (see section 4).

As controller, your main duties are:

Legal basis: security monitoring usually rests on KVKK Art. 5/2(f), the business's legitimate interest, provided it does not harm people's fundamental rights and freedoms. Consent from staff is not a sound basis, because consent given at work may not count as freely given.
Information (Art. 10): tell people before they are filmed. Do it in two layers: a short sign at the entrance and a fuller notice.
Data security (Art. 12): prevent unauthorised access to the recordings.
Proportionality and deletion (Art. 4, Art. 7): record only what the purpose needs, and delete recordings once the purpose is met.

Breaching these duties can lead to administrative fines under KVKK Art. 18; the amounts are raised each year by the revaluation rate.

2. The rules in Türkiye: the KVKK announcement on workplace cameras

On 8 June 2026 the Turkish Personal Data Protection Authority published a public announcement on the use of security cameras at workplaces: https://www.kvkk.gov.tr/Icerik/8770/is-yerlerinde-guvenlik-kamerasi-sistemi-kullaniminda-dikkat-edilecek-hususlara-dair-kamuoyu-duyurusu. Its main points, and how to apply them with Puw, follow.

2.1. Decide the purpose first

Before you install a camera, write down concretely why: for example "prevent theft at the till" or "notice unauthorised entry to the storeroom". Camera positions, retention and who may watch the recordings all follow from that purpose.

2.2. Where to put cameras

Entrances and exits, storerooms and the till can be proportionate.
Put no cameras in toilets, changing rooms, prayer rooms (mescit) or staff rest areas. These places must not fall within another camera's view either.
Do not film neighbouring property or more of the street than you need.
To keep an area out of the picture, change the camera's angle or use the camera's own "privacy mask" setting. Puw's ignored areas only stop motion there from counting; that part of the picture is still recorded.

2.3. No face-focused, wide-angle or covert recording

Do not aim cameras so that they focus on faces. Avoid wide-angle views that cover the whole workplace and the staff all the time.
Do not use hidden cameras. Every monitored area must be marked with a sign.

2.4. Audio off

According to the announcement, recording sound is high-risk and needs its own strong justification. Puw neither records nor processes audio. If your camera or recorder has its own audio recording, turn that off too.

2.5. Children and other vulnerable people

If your visitors include children or vulnerable people, limit camera positions and access to the recordings even further.

2.6. Staff

Inform your staff in writing before monitoring starts (the text in section 11). A signature shows they were informed; it is not consent.
Under Art. 419 of the Turkish Code of Obligations No. 6098, an employer may use staff personal data only as far as needed to assess their suitability for the job or to perform the employment contract.
Do not use the cameras or Puw to monitor staff performance, productivity, attendance or discipline. Monitoring that goes beyond your stated purpose can breach privacy.
The daily report is about the premises, not about people. It sums up what happened at the business during the day; it must not be used to measure staff performance.
The AI's descriptions can be wrong. Never make a decision about an employee, such as a warning, an accusation or a dismissal, unless a person has watched the clip and heard the employee's side.

2.7. Who may see the recordings

Decide who may watch the recordings and when, and keep a short written list of authorised people. If Telegram alerts or questions from Telegram are on, everyone with access to that chat belongs on the list.

2.8. When something happens

Puw's description alone is not enough to accuse anyone; watch the clip yourself first.
Give recordings only to authorities entitled by law to ask for them (police, prosecutors, courts) and only at their request.
For legal proceedings, set aside only the clip of that event; let the other recordings be deleted on their normal schedule.

3. How long to keep recordings

The announcement asks for the shortest retention that serves the purpose, with automatic deletion. Choose the period to fit your purpose and state it in your notices.

Clips: in Puw, Settings → Storage → "Keep up to" sets how much disk space clips may use. When clips use more than that, the oldest are deleted automatically. The same screen shows the space used now: after a few days, check how much is used per day and set the limit so that it matches the period you chose.
Event descriptions: descriptions are personal data too, because together with a time, a place and a clip they can be linked to a particular person. The storage limit deletes clips only; descriptions stay on the PC after their clip is deleted. Do not keep descriptions longer than your purpose needs either, and state in your notices how long you keep them.

4. Phone alerts and Telegram

If you want, Puw sends the alerts you choose to your phone through Telegram. Phone alerts are off by default; when you turn them on, only text is sent. Adding a photo or a clip has to be chosen separately for each alert. WhatsApp alerts are not offered.

There are two ways to set it up:

Your own Telegram bot: messages go straight from your PC to Telegram; Luvi sees nothing.
Easy setup (@puw_bot): messages, and a photo or clip if you chose one, pass through Luvi's server in the US to Telegram without being stored and are never written to disk. While your PC or Telegram cannot be reached they wait in memory for at most 10 minutes, and are then dropped. The server keeps only the link between your installation and your Telegram chat, and the signal that shows Puw is running.

You can also ask Puw questions from Telegram, such as "Was anyone at the till last night?". The question and the answer travel the same way, and the answer can include a photo or clip you ask for. This means the recordings can be viewed remotely from a phone.

What you need to know:

Telegram's servers are outside Türkiye. If an alert contains an image of a person, or information that makes a person identifiable, sending it is a transfer abroad made by you (KVKK Art. 9). Today the transfer routes KVKK provides are not easy to apply to routine alerts of this kind; use the feature knowing this risk and keep it as small as you can.
Use text-only alerts wherever you can. A short text such as "A person at the till, 22:14" carries far less data than a photo or a clip.
If you really need alerts with a photo or clip, prefer setting them up with your own bot, so that Luvi's server is not in between.
If you use these features, say so on your sign and in your notices (the optional sentences in sections 9, 10 and 11).
Share the Telegram chat only with authorised people and, if you can, set old messages to delete automatically.

5. Securing the PC and the recordings

Run Puw under a password-protected Windows account and lock the screen when you step away.
Let only authorised people use the PC and Puw.
Change the factory passwords of your cameras and your recorder.
Keep Windows up to date. Puw tells you when a new version is ready; it installs only when you press "Restart and update".
If you copy clips to a USB stick, another disk or a cloud service, apply the same access and retention rules to the copies.
For support you can send Puw's support file: it holds technical logs, settings with passwords masked and system information; it holds no video and no event descriptions.

6. VERBİS registration

VERBİS is the Turkish registry of data controllers. Under the decisions of the Personal Data Protection Board:

If you have fewer than 50 employees a year and your annual balance sheet total is under 100 million TL, you do not have to register with VERBİS.
If you do not keep balance-sheet books (for example, a tradesperson keeping books on the işletme hesabı basis), only the employee count matters: fewer than 50 employees means no registration duty.
If your main activity is processing special categories of personal data, such as health data, the thresholds are lower: fewer than 10 employees and an annual balance sheet total under 10 million TL.
Camera monitoring without face recognition does not make special-category processing your main activity. Puw does not recognise faces.

Basis: Board decisions 2018/87 (as amended by 2023/1154), 2025/1572 and 2025/2393.

By these thresholds most shops, cafés, restaurants and small hotels are exempt from VERBİS registration. The exemption removes only the duty to register: the duties to put up signs and inform people, to keep the data secure and to delete recordings on time still apply.

If you do have to register, register with VERBİS (https://verbis.kvkk.gov.tr) and prepare a personal data retention and destruction policy. Your accountant (mali müşavir) can tell you your annual balance sheet total.

7. In the European Union (short note)

If your business is in the EU, the General Data Protection Regulation (GDPR) applies, and most of the principles in this kit hold there too:

You are the controller of the footage. Security monitoring usually rests on legitimate interest (GDPR Art. 6(1)(f)), which means weighing your business's interest against the rights of the people filmed.
Information again comes in two layers: a sign at the entrance and a full notice (GDPR Art. 13). Adapt the templates in sections 9 and 10 to the GDPR instead of KVKK, and add people's right to complain to your country's data protection authority.
Systematic monitoring of publicly accessible areas on a large scale requires a data protection impact assessment beforehand (GDPR Art. 35).
Many countries have extra rules on camera monitoring and staff monitoring, for example a duty to consult staff representatives. Check your national data protection authority's guidance.
Under the EU AI Act, the business using Puw is the "deployer". Emotion recognition at the workplace is prohibited; Puw's AI does not describe emotions. Do not use Puw to monitor or evaluate staff.

8. How Puw helps you

Everything on your PC: footage, descriptions, reports and alert history are processed and stored only on your PC. There is no account, no cloud and no telemetry; Luvi never receives them.
No continuous archive: Puw does not record 24/7; it records short clips of events.
No face recognition and no audio.
No sensitive details: the AI is instructed never to describe people's identity, ethnicity, religion, age, health or emotions. It says "a woman" or "a man" only when that is clearly visible, and otherwise "a person".
Text-only alerts: phone alerts are off by default; when on, only text is sent. A photo or clip is chosen separately for each alert.
Automatic deletion: when the storage limit is reached, the oldest clips are deleted by themselves.
No images in the support file: the support file contains no video, pictures or event descriptions, masks passwords, and Puw never sends it anywhere by itself.
Puw is not a security or alarm system. It can miss events, and its AI can describe them wrongly. Watch the clip yourself before making any decision about a person.

9. Sign text (template)

Put it at the entrance to every monitored area and at the till, where people can read it before they enter. Fill in the parts in parentheses with your own details, and remove any optional line that does not apply to you.

NOTICE: This area is monitored and recorded by camera.

Purpose: (the camera's purpose, for example the security of the premises and preventing theft)

No audio is recorded and no face recognition is used. Recordings are kept on a PC at our premises; an AI running on that PC turns events into short written descriptions.

(If you use Telegram alerts or questions from Telegram:) For some events, alerts are sent to our authorised staff's phones through Telegram, and recordings can also be viewed from a phone. Telegram's servers are located abroad.

Data controller: (your business name) · More information: at the till and at (your website address or a QR code)

10. Notice for visitors (template)

Keep it in print at the till, or publish it on your website and link it from the sign with a QR code.

(Your business name) — Notice on Camera Monitoring

This notice is given to inform you under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").

Data controller: (your legal business name), (your address), (your e-mail address).
Data processed: images of you recorded in the following parts of our premises: (where the cameras are, for example the entrance, the till and the storeroom), and short descriptions written about the events in those images (for example "a person paying at the till"). No audio is recorded and no face recognition is used. The descriptions do not mention your identity, ethnicity, religion, age, health or emotions.
Purpose: (the camera's purpose, for example the security of the premises, our staff and visitors, preventing theft and loss, and reviewing incidents).
How the data is collected, and the legal basis: the images are collected automatically by the cameras. The legal basis is our business's legitimate interest, provided it does not harm your fundamental rights and freedoms (KVKK Art. 5/2(f)).
How it is processed: images are not archived continuously; short clips are recorded when an event is detected. The clips and descriptions are kept on a PC at our premises, and an AI running on that PC writes the descriptions. Images are not uploaded to a cloud, and the provider of the software we use has no access to them. (If you use the black box feature, add:) When a camera is tampered with or goes dark, the recording of the 20 minutes before is also kept.
Sharing: recordings are not shared with third parties; they are given only to authorities entitled by law (such as the police, prosecutors and courts) at their request. (If you use Telegram alerts or questions from Telegram, add:) For some events, a short alert, with a photo or a short clip if chosen, is sent to our authorised staff's phones through Telegram, and recordings can also be viewed by them from a phone. Because Telegram's servers are abroad, this information is transferred abroad. (If you use easy setup, that is @puw_bot, add:) These messages pass through the US server of our software provider, Luvi Technologies, Inc., without being stored.
Retention: clips are kept for at most (retention period for clips) and then deleted automatically, oldest first. Event descriptions are kept for at most (retention period for descriptions). If an event becomes part of legal proceedings, only the recording of that event is kept for the duration of the proceedings.
Your rights: under Article 11 of KVKK you have the right to learn whether your personal data is processed; to ask for information if it is; to learn the purpose of the processing and whether the data is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to ask for incomplete or incorrect data to be corrected and, where the legal conditions are met, for the data to be deleted or destroyed, and for these steps to be notified to the third parties who received it; to object to a result against you that arises solely from automated analysis; and to claim compensation if you suffer damage from unlawful processing.
How to apply: send your request in writing to (your address) or by e-mail to (your e-mail address). Your request will be answered within 30 days at the latest and, as a rule, free of charge. If your request is refused, the answer is inadequate or no answer comes in time, you may complain to the Personal Data Protection Board.

11. Notice for staff (template)

Give it to every employee before the cameras start working and keep a signed copy. Give it to new employees on their first day.

Subject: Information on camera monitoring at the workplace

Dear colleague,

At (your business name) we use camera monitoring at our premises. This note tells you, under Article 10 of KVKK, how your personal data is processed in this context.

Purpose: (the camera's purpose, for example the security of the premises, staff and customers, preventing theft and loss).
Camera positions: (where the cameras are). There are no cameras in the toilets, changing rooms, prayer room (mescit) or rest areas.
How: no audio is recorded and no face recognition is used. Short clips are recorded when an event is detected; an AI running on a PC at our premises turns events into short written descriptions. Images are not uploaded to a cloud.
What it is not used for: the recordings and the daily report are not used to measure your performance, productivity or working hours. The daily report only sums up what happened at the premises.
About the AI: the descriptions can be wrong. No decision about you is made unless an authorised person has watched the recording and heard your side.
Who can see the recordings: only (the people or roles authorised to view recordings).
(If you use Telegram alerts or questions from Telegram, add:) Phone: for some events, alerts are sent to these people's phones through Telegram, and recordings can also be viewed from a phone. Telegram's servers are located abroad.
Legal basis: the legitimate interest of the business (KVKK Art. 5/2(f)).
Retention: clips are kept for at most (retention period for clips) and event descriptions for at most (retention period for descriptions); then they are deleted.
Your rights: you can exercise your rights under Article 11 of KVKK through (the person or e-mail address to contact).

I have read this note and have been informed. This signature is not consent; it only shows that I have been informed.

Full name: ________ · Date: ________ · Signature: ________

12. Checklist

1. I have written down the purpose of the cameras.
2. Toilets, changing rooms, prayer rooms and rest areas are not filmed; neighbouring property and the street are not filmed more than needed.
3. No camera is face-focused or hidden.
4. Audio recording is off on the cameras and the recorder.
5. There is a sign at the entrance to every monitored area and at the till.
6. The visitor notice is at the till or on my website, and the sign points to it.
7. Staff were informed before monitoring started; signed copies are kept.
8. Puw's storage limit matches the retention period I chose; the period for descriptions is stated in the notices too.
9. The PC is password-protected; there is a list of people authorised to view recordings.
10. If I use phone alerts: I send text only wherever I can, the sign and notices mention Telegram, and only authorised people are in the chat.
11. I have checked whether I must register with VERBİS.
12. I do not use the recordings or the daily report to track staff performance or working hours.