Privacy Policy
Last updated: 21 April 2026
This Privacy Policy explains how DKM Teknoloji ("we", "us") collects, uses and protects the personal data you share while using the DKM QR platform (dkmqr.com). By using our service you accept the practices described below. We only collect what is necessary to deliver the service and we never sell your data.
1. Information We Collect
We collect the following categories of data:
Account data: username, e-mail address, password (stored only as a secure hash), name of the authorised person.
Usage data: login timestamps, IP address, browser user-agent, device type — used for security and fraud prevention.
Business data: business name, address, phone number, business e-mail — shown on your public menu page.
Menu content: categories, products, prices, photos, descriptions you upload.
End-user data (menu visitors): an anonymous visitor identifier, visit logs, optional anonymous feedback. We do not ask menu visitors for their name, e-mail or phone number.
Demo applications: fields submitted through our trial form (business name, e-mail, phone, optional address, contact person, notes).
2. Cookies
We use the minimum number of cookies required for the service to work:
Essential: Session cookie — keeps you signed in (24 h lifetime).
Functional: Anonymous visitor identifier (1 year); theme preference cookie (light/dark/auto); language preference cookie.
Analytics: None. We do not use Google Analytics, Facebook Pixel or any third-party analytics service.
Marketing: None. We do not run ad-tracking or remarketing cookies.
You can accept or reject cookies at any time through your browser settings. Disabling essential cookies will prevent you from logging into the panel.
3. How We Use Your Data
We process your personal data for the following purposes:
• To operate the service (authentication, panel access, menu hosting).
• To improve platform performance through aggregated, anonymous analytics (most-viewed products, average session length, etc.).
• To provide customer support over WhatsApp and e-mail.
• To comply with legal obligations (invoicing, KVKK/GDPR record-keeping, tax reporting).
• To send transactional messages related to your subscription (renewal, grace period, payment reminder) — not marketing e-mails.
4. Third-Party Sharing
We do not sell, rent or exchange your data. We do not share information with ad networks, analytics platforms or data brokers.
Limited exceptions:
• Cloudflare (CDN & DDoS): traffic passes through Cloudflare's global edge for caching and protection. Cloudflare stores only short-lived logs and does not retain customer data.
• PayTR (payments): when you pay for a subscription, only the data needed to complete the payment is transmitted to PayTR (Turkish-licensed payment provider). We never see or store your full card number.
• Legal requirements: if a Turkish court or authorised agency requests data with a valid legal basis, we comply with the minimum disclosure needed.
5. Data Security
Security controls applied to every request:
• HTTPS everywhere with HSTS (1 year, includeSubDomains).
• Passwords protected with a secure hash algorithm — never stored in plain text.
• Two-factor authentication (TOTP) mandatory for super-admin accounts.
• Rate limiting on login, demo form and public endpoints.
• CSRF tokens on every form.
• Bot protection to block automated submissions.
• Cloudflare DDoS and WAF protection at the edge.
• PostgreSQL and Redis hosted on servers located in Türkiye.
• Daily automated backups with restricted access.
6. Retention Periods
• Tenant account data: kept for the life of the subscription plus 6 years, as required by Turkish commercial & tax law.
• End-user IP addresses: nulled after 90 days (KVKK/GDPR-compliant anonymisation).
• Anonymous feedback: kept indefinitely (no personal identifier attached).
• Demo applications: kept for 2 years after approval or rejection, then purged.
• Session cookies: 24 hours.
• Visitor cookie: 1 year.
7. Your Rights
Under KVKK article 11 and GDPR you have the right to:
• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain types of processing.
To exercise any of these rights, e-mail [email protected]. We reply within 30 days. For the full list of rights see our KVKK notice.
8. International Transfers
Your primary data (account, menu, business) is stored in Türkiye. The only edge services that handle traffic outside Türkiye are:
• Cloudflare CDN — caches static assets (CSS, JS, images) at global edges; no personal data is retained.
• PayTR — operates solely inside Türkiye; no cross-border transfer takes place.
9. Children's Privacy
DKM QR is not targeted at users under 18. We do not knowingly collect data from children. If we discover that a minor has created an account or submitted a demo request, we delete the associated data without delay.
10. Changes to This Policy
We may update this policy from time to time. The "last updated" date at the top always reflects the current version. Material changes (new data categories, new third parties, retention changes) are announced to tenants via in-panel notification and e-mail at least 14 days before taking effect.
11. Contact
Questions, concerns or requests? Reach us:
E-mail: [email protected]
WhatsApp: +90 533 451 85 46
Data controller: DKM Teknoloji, Türkiye
Website: dkmteknoloji.com.tr