KVKK Information Notice
Comprehensive information on how your personal data is processed under Turkey's Personal Data Protection Law No. 6698.
1. Data Controller
Under Personal Data Protection Law No. 6698 ("KVKK"), as the 3D QR Menü Development Team ("Development Team"), which jointly develops and operates the 3D QR Menü platform, and acting in the capacity of data controller, we will process, record, store, classify and update your personal data within the scope explained below; in a manner compliant with the law and the rules of good faith, and transfer it to third parties where the legislation permits.
You can access the VERBİS (Data Controllers' Registry) information regarding the processing of personal data at verbis.kvkk.gov.tr (in Turkish).
2. Personal Data Processed
Our platform processes the data of different parties. Below you can find which of your data is processed, depending on your role.
a) Business Account Holders
- Identity and contact: Full name, business name, email address; with Google sign-in, the name, email and profile photo in your Google account.
- Account security: Your password (never stored in plain text anywhere; encrypted one-way by Firebase Authentication), IP address, login-logout and session records.
- Billing and payment: Invoice name/company name, invoice address, city, phone; subscription plan, period, amount, coupon information and payment transaction records. Your card number, expiry date and CVV security code are never stored by us; card verification and payment transactions are carried out through our payment provider PayTR, and only the masked card (e.g. **** 1234) and a payment technology token are kept.
- Support records: Support requests, conversation contents and email communication history.
b) Business Staff
Staff data is recorded by the manager of the business using the platform:
- Full name, role/title and permission role.
- The PIN code used for sign-in (stored only as a peppered one-way digest, never in plain text) and PIN attempt records.
- Weekly work schedule, overtime and leave records.
c) Customers Using the Businesses' QR Menu
- Order information: Table information, order contents; name and note entered optionally during the order.
- Reservation information: Name-surname, phone number, reservation note, number of people and time (entered by the business or via the reservation form).
- Ratings and feedback: Score, review, table/order reference (a name is not required).
- Device and session data: Device identifier (deviceId), session identifier (sessionId), pages visited, time on site, browser type and IP address (for live table tracking, menu statistics and security).
- Waiter call: The table from which the call was made.
d) Website Visitors
- Name, email and message content shared in the contact and quote forms; the hashed (cryptographic digest) form of your IP address to prevent form abuse.
- Cookies: Pages visited, time on site, click data, approximate location (country/city), device and browser information collected via Google Analytics and Google AdSense cookies.
- Interaction data collected by Google reCAPTCHA to verify that you are not a robot.
3. Purpose of Processing Personal Data
- Creating, verifying and securing your account (email verification, password reset).
- Establishing and performing the digital menu, order, reservation, table, inventory, campaign, staff and reporting services we committed to.
- Carrying out subscription and billing processes, collecting payments, and performing card verification and refunds.
- Providing our products and services and running operational processes.
- Ensuring information security and preventing fraud and abuse (rate limiting, speed limits, log records).
- Handling your support requests and conducting communication activities.
- Processing order data to offer product recommendations to businesses (cross-sell suggestions).
- Analysing website traffic and improving user experience (Google Analytics).
- Conducting advertising and marketing activities on our website (Google AdSense).
- Fulfilling legal obligations (record retention, responding to requests from authorised institutions, etc.).
4. Collection Method and Legal Basis
Your personal data is collected through your visit to our website, your account creation, your use of the business panel, your orders/reservations/ratings via the QR menu and the forms you fill in, by automatic or non-automatic means and in an electronic environment.
Your data is processed based on the grounds set out in KVKK Art. 5/2: being necessary for the establishment or performance of a contract(account and service management, order and payment processes), being necessary for the data controller to fulfil a legal obligation (retention obligations in accounting and tax legislation), processing being necessary for the establishment or protection of a right (proof in disputes), being necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms(information security, abuse prevention, log records), and your explicit consent (personalised advertising and marketing communication).
5. Transfer of Personal Data
Your personal data may be transferred to the following parties to the extent necessary for the processing purposes:
- Google LLC (Firebase, Google Analytics, Google AdSense, Google reCAPTCHA): As the technical infrastructure of the service, all platform data is hosted on Firebase; measurement and advertising cookie data and reCAPTCHA verification data may be transferred to Google's servers abroad.
- PayTR Electronic Money and Payment Services Inc. (Türkiye): To carry out payment transactions, card verification and refunds, your billing information and card data are used (card data is transmitted directly to PayTR and never stored by us).
- Email service provider (Hostinger): Your email address, for sending system notifications (verification, password reset, subscription notifications).
- Authorised public institutions: In case of legal requests from institutions authorised by law (courts, enforcement authorities, BTK, etc.).
Transfers abroad are carried out in accordance with KVKK Art. 9 and the Regulation on Cross-Border Transfers, provided that the destination country has been declared by the Personal Data Protection Authority to have adequate protection or that the necessary safeguards are provided by us.
6. Retention Periods and Deletion
Your personal data is retained for as long as necessary for the processing purposes and limited to legal retention obligations (in particular the 10-year period under Tax Procedure Law No. 213). When you close your account or your subscription ends, your data — except records subject to legal retention obligations (such as invoice and collection records) — is deleted, destroyed or anonymised within a reasonable time after the processing purposes cease to exist. Security and system log records are kept for a reasonable period to ensure security.
7. Position of Businesses Regarding Their Own Customer Data
Decisions regarding the processing of customer, reservation and staff data collected through the platform are taken by the business manager; for this data, the data controller is the business purchasing the service. The Development Team processes this data only upon the business's instruction, as a technical infrastructure provider, in the capacity of data processor. Businesses are independently responsible for fulfilling their own information obligations towards their customers and staff (KVKK Art. 17, 18, 19, 20).
8. Cookies
Our website uses strictly necessary cookies (session management), measurement cookies (Google Analytics) and advertising cookies (Google AdSense). You can manage your cookie preferences from your browser settings. For details, please see our Privacy Policy (in Turkish).
9. Your Rights under KVKK Article 11
As a data subject, by applying to the Development Team you have the right to:
- Learn whether your personal data is being processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing and whether your data is used in line with that purpose,
- Know the third parties to whom your personal data is transferred, at home or abroad,
- Request the correction of your personal data if it is processed incompletely or inaccurately,
- Request the deletion or destruction of your personal data within the framework of the conditions set out in KVKK Art. 7,
- Request that correction, deletion and destruction operations also be notified to the third parties to whom the data was transferred,
- Object to a result that is detrimental to you arising from the analysis of your data exclusively by automated systems,
- Request compensation for damages if you suffer damage due to unlawful processing of your data.
You can submit your requests under these rights by email to [email protected]. Your request is concluded free of charge as soon as possible and at the latest within thirty days, depending on its nature.