Personal Data Protection Disclosure Notice

This English text is provided for information only. In the event of any inconsistency, the Turkish version prevails.

1. Data controller

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by Agah Altun as data controller.

Controller	Agah Altun
Tax office / number	Halkalı Vergi Dairesi / 0670923484
Address	İstasyon Mah. Halkalı İstasyon Cad. Göl Konutları B1 Blok, No: 56/C, İç Kapı No: 16, Küçükçekmece / İstanbul
Email	destek@qrkarekod.com
Website	qrkarekod.com

2. Categories of personal data

Account data — name, email address, hashed password (never stored in plain text), optional phone number, profile picture (if you sign in with Google), language and interface preferences, two-factor settings.

Security data — sign-in timestamps, device and browser information, a salted hash of your IP address (raw IP addresses are never stored), session records.

QR code and content data — the name, type, destination and design of the codes you create; logos, images and PDFs you upload; content of hosted pages.

Scan analytics — timestamp, country and city (derived from IP, never street level), device type, operating system, browser, referrer, browser language, and a salted hash of the IP address used solely to distinguish unique visitors. This data belongs to the people scanning your codes and is shown to the code owner only in aggregate. Individual scanners cannot be identified.

Billing data — invoice title, national or tax identification number, tax office, address, phone, email, order amount and status, bank transfer receipt if uploaded. We never see, process or store your card details.

Support and request data — support messages, data subject requests, abuse reports.

3. Purposes of processing

Creating and managing your account; providing QR generation, hosting and redirection; producing scan analytics; managing plans and limits; processing orders and issuing invoices; meeting legal retention and reporting obligations; securing the service and preventing abuse and fraud; responding to support requests; improving the service; and, with your explicit consent, sending commercial electronic messages.

4. Legal bases (KVKK art. 5)

Performance of a contract (art. 5/2-c) for account and service delivery; compliance with a legal obligation (art. 5/2-ç) for invoicing and tax records; legitimate interests (art. 5/2-f) for security, abuse prevention and scan analytics; establishment and exercise of rights (art. 5/2-e); and explicit consent (art. 5/1) for marketing messages and non-essential cookies.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.

5. Recipients

Hosting provider Aruba S.p.A. (aruba.it) (İtalya); the licensed payment institution; Google (if you use Google sign-in, the Google Business Review template, or through Safe Browsing checks); email delivery provider; our accountant, for statutory bookkeeping; and competent public authorities where required by law.

5.1. International transfers

The servers hosting the service are located in İtalya (Aruba S.p.A. (aruba.it)), so personal data processed in the system is hosted outside Türkiye. Using Google services may also involve transfers outside Türkiye. Such transfers are carried out under KVKK art. 9 on the basis of an appropriate safeguard published by the Board (standard contract, binding corporate rules or an adequacy decision) or your explicit consent. You can avoid Google sign-in entirely by registering with an email address and password.

6. Retention

Account data: for the duration of membership plus 10 years. Invoices and accounting records: 10 years. Raw scan events: up to 24 months, and within the retention window of your plan. Sign-in and security logs: 2 years. Commercial message consent records: 3 years after withdrawal. Support correspondence: 3 years.

7. Account deletion and QR codes

When you delete your account, your personal data is deleted or anonymised subject to the retention periods above.

Short-code records of the QR codes you created are not deleted. Once a QR code has been printed and distributed, reassigning that code to another user would send unsuspecting third parties to an entirely different destination. Retaining these records is assessed as a legitimate interest under KVKK art. 5/2-f. The retained record consists solely of the short code and the fact that it was withdrawn from use; it is not linked to your identity.

8. Your rights (KVKK art. 11)

You have the right to learn whether your personal data is processed, to request information about it, to learn the purpose and whether it is used accordingly, to know the third parties to whom it is transferred at home or abroad, to request rectification of incomplete or incorrect data, to request erasure or destruction, to request that these actions be notified to third parties, to object to results produced solely through automated analysis, and to claim compensation for damages caused by unlawful processing.

9. How to apply

Submit your request through the form at qrkarekod.com/kvkk-basvuru, by email from the address registered in our system to destek@qrkarekod.com, or in writing to İstasyon Mah. Halkalı İstasyon Cad. Göl Konutları B1 Blok, No: 56/C, İç Kapı No: 16, Küçükçekmece / İstanbul.

Requests are answered free of charge within 30 days at the latest. If your request is refused, the answer is unsatisfactory, or no answer is given in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.