Privacy Notice (KVKK)
Last updated: 22 April 2026
This Privacy Notice has been prepared by DKM Teknoloji (the operator of the DKM QR platform) in its capacity as “Data Controller” under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”). It informs business owners (tenants) who use our platform and end users (menu visitors) about how their personal data is processed.
1. Data Controller
Data Controller: DKM Teknoloji — Mahmut Dokumacı (sole proprietor)
Contact: [email protected]
WhatsApp: +90 533 451 85 46
Website: dkmteknoloji.com.tr
2. Categories of Personal Data Processed
Depending on whether you are a business owner (tenant), an end user (menu visitor), or a demo applicant, the categories below may be processed:
Business owners (tenants): identity data (name, surname), contact data (e-mail, phone), authentication data (username, password stored with a secure hash algorithm, TOTP secret where 2FA is enabled), business data (business name, address, tax information), financial data (subscription period, payment records).
End users (menu visitors): transaction security data (IP address — anonymised after 90 days, user-agent, anonymous visitor UUID stored in cookie), navigation data (timestamps, products viewed, selected language).
Demo applicants: business name, contact person name, e-mail, phone number, optional address and free-text notes.
Feedback: 1–5 star rating, optional free-text comment, product reference. The IP address associated with a feedback entry is irreversibly processed with a cryptographic hash and is not stored in plain form.
3. Purposes of Processing
• Providing the QR menu service (core functionality).
• Managing subscriptions, billing, and renewal reminders.
• Providing customer support via WhatsApp and e-mail.
• Anonymous analytics to help business owners improve their menus (popular products, visit patterns).
• Fulfilling legal obligations (e-invoice, tax, record-keeping).
• Preventing fraud, abuse, and bot traffic.
4. Method and Legal Basis of Collection
Personal data is collected electronically through our website forms (demo application, panel login, feedback form) and automatically as technical data (server logs, cookies) while the services are being used.
The legal bases under KVKK Article 5 are: (i) explicit consent where required, (ii) the performance of a contract (subscription), (iii) compliance with a legal obligation, and (iv) our legitimate interests in operating, securing, and improving the service, balanced against your rights and freedoms.
5. Transfers of Personal Data
We do not sell or share your personal data with third parties. Data is not transferred outside Türkiye. Our production relational database and in-memory cache layer are hosted on Türkiye-based infrastructure. Data may only be disclosed where required by a legally valid request from Turkish public authorities or courts, or to the limited extent necessary for service providers (payment processor PayTR, e-mail delivery) acting under a written data-processing agreement.
6. Retention Periods
• Tenant account data: retained during the subscription period and for 6 years thereafter, to satisfy the legal retention periods under the Turkish Tax Procedure Law and Turkish Commercial Code.
• Visitor IP address: stored in clear form for 90 days, then set to NULL. An irreversible cryptographic hash is retained for aggregated, anonymous analytics.
• Demo applications: retained for 2 years after the application is approved or rejected.
• Server access logs: retained for a maximum of 90 days for security and troubleshooting.
7. Your Rights under Article 11 of the KVKK
Under Article 11 of the KVKK you have the right to:
a) learn whether your personal data is processed;
b) request information about it, if processed;
c) learn the purpose of the processing and whether your data is used in line with that purpose;
ç) know the third parties (inside or outside Türkiye) to whom your data is transferred;
d) request correction where the data is incomplete or inaccurate;
e) request erasure or destruction of your data under the conditions set out in Article 7 of the KVKK;
f) request that any correction, erasure, or destruction is notified to third parties to whom your data has been transferred;
g) object to any result produced solely by automated analysis of your data that is to your detriment;
ğ) claim compensation for damages caused by unlawful processing.
8. Security Measures
• HTTPS enforced everywhere with a secure connection policy.
• Passwords stored with a modern hash algorithm — never in plain text or reversibly encrypted.
• Two-factor authentication (TOTP) mandatory for super-admin accounts.
• Request validation tokens, per-endpoint rate limiting, bot protection.
• Automatic visitor IP anonymisation after 90 days.
• Production database and in-memory cache on a private network.
• Regular automated backups and monitored access logs.
9. How to Exercise Your Rights
You may exercise your rights by sending a written request to [email protected], together with information that allows us to verify your identity (e.g. a copy of the e-mail address on record). We will respond, free of charge, no later than 30 (thirty) days after receiving a valid request, in accordance with Article 13 of the KVKK. If a request requires disproportionate effort, a reasonable fee may be charged in line with the tariff published by the Personal Data Protection Authority (KVKK Kurumu).
10. Changes to this Notice
We may update this Privacy Notice from time to time to reflect changes in our services or applicable law. The “Last updated” date above will always indicate when the most recent changes were made. Significant changes will be communicated to tenants through the panel.