KVKK privacy notice.

This notice has been prepared by Anıl Reyhanoğulları ve Bünyamin Reyhanoğulları Adi Ortaklığı, as data controller, under Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

We do not aim to process special categories of personal data (KVKK Art. 6).

• Creating and managing accounts, authentication — establishment and performance of a contract (Art. 5/2-c)
• Taking, preparing and handing over orders; processing payments and refunds — establishment and performance of a contract (Art. 5/2-c)
• Issuing financial documents, keeping accounting and tax records — legal obligation (Art. 5/2-ç)
• Payment security and fraud prevention — legitimate interest (Art. 5/2-f) and legal obligation (Art. 5/2-ç)
• Running the loyalty programme — performance of a contract (Art. 5/2-c)
• Producing readings at your request — explicit consent (Art. 5/1) and performance of a contract (Art. 5/2-c)
• Service security, error detection and measuring service quality — legitimate interest (Art. 5/2-f)
• Necessary notifications about order status and account actions — performance of a contract (Art. 5/2-c)
• Campaign and marketing notifications — explicit consent (Art. 5/1)
• Responding to authorities and protecting rights in legal disputes — legal obligation (Art. 5/2-ç), establishment and protection of a right (Art. 5/2-e)

Your personal data is collected electronically, by fully or partly automated means, when you create an account, order and pay, scan QR codes and use other features of the App; payment results are collected by electronic notification from PayTR.

Limited to the purposes above, your personal data may be transferred to:

• PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. and the relevant banks, for payments and refunds;
• cloud database, server, notification and authentication infrastructure providers;
• an artificial-intelligence service provider, with limited text information, only to produce readings;
• our accountant and, where legally required, competent public institutions.

Some infrastructure providers may have servers abroad; transfers abroad are made on the basis of the safeguards in KVKK Art. 9 and/or your explicit consent. Your data is never sold or shared for marketing.

• Account and loyalty data: while the account is active; deleted or anonymised within a reasonable technical period after the account is deleted.
• Order, payment and financial records: 10 years under the Tax Procedure Law and Turkish Commercial Code.
• Distance sales agreement and pre-information confirmation records: at least 3 years under the Distance Contracts Regulation.
• Reading photos: never stored on servers.

By applying to the data controller you may: learn whether your personal data is processed and request information if so; learn the purpose of processing and whether it is used accordingly; know the third parties it is transferred to; request correction if it is incomplete or inaccurate; request deletion or destruction under KVKK Art. 7; request that these actions be notified to third parties it was transferred to; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

Send your request in writing, with information verifying your identity, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, to coffeekoordinat@gmail.com or to Çiğdede Mah. Mehmet Aslan Cad. No: 201 D: 1, 31800 Samandağ / Hatay. Your application is answered free of charge within 30 days at the latest. If your application is rejected or the answer is insufficient, you have the right to complain to the Personal Data Protection Board.