1. Data controllers#
This notice is prepared by Buaze ("Buaze" / "Platform") in its capacity as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"). Contact details:
- Entity: Buaze
- Address: Türkiye
- E-mail: support@buaze.com
- Tax / registration number: [VKN veya MERSIS]
2. Categories of personal data processed#
Depending on your use of the Platform, the following categories may be processed:
- Identity data: first name, last name
- Contact data: e-mail, phone
- Customer transaction data: visit date, table number, branch / location, rating, review text
- Operational security data: IP address, browser / device info, session tokens, timestamps
- Marketing data (subject to separate explicit consent): communication preferences, campaign interactions
3. Purposes of processing#
Personal data is processed in line with KVKK Article 4 principles for:
- Collecting and reporting customer feedback and improving service quality
- Enabling the business to communicate with the customer and resolve complaints
- Operating the platform infrastructure required for service delivery
- Fulfilling legal obligations (tax, contractual, request handling)
- Maintaining information security and preventing abuse
- Marketing, campaign and announcement messaging where you have given explicit consent
4. Legal basis (KVKK Articles 5-6)#
Processing relies on the following legal grounds:
- Art. 5/2-(c): Processing necessary for the conclusion or performance of a contract
- Art. 5/2-(ç): Compliance with a legal obligation
- Art. 5/2-(e): Establishment, exercise or protection of a right
- Art. 5/2-(f): Legitimate interests, provided that fundamental rights and freedoms are not harmed
- Art. 5/1 and 6/2: Your explicit consent, where required (e.g. marketing)
5. Transfers#
Data may be shared with the following parties under KVKK Articles 8 and 9:
- The restaurant / business you interacted with — review and contact data
- Cloud infrastructure providers — hosting and database services
- E-mail provider — notification and marketing
- Payment processor — billing flow only
- Authorised public authorities — under legal obligations
International transfers are not made unless one of the mechanisms in Article 9 of the KVKK as amended by Law No. 7499 (2 June 2024) is satisfied (adequacy decision, undertaking, binding corporate rules or explicit consent). Current provider regions and the applied transfer mechanism are available on request from support@buaze.com.
6. Retention periods#
Data is retained no longer than necessary, in line with applicable law:
- Review and feedback data: throughout the active relationship and 24 months thereafter
- IP addresses: 90 days, then anonymised
- Session / log records: 6 months
- Marketing consent and opt-out records: at least 3 years after the consent ends, as required by ETK
- Billing records: 5 years (Turkish Tax Procedure Law Art. 253)
After the period expires, data is deleted, destroyed or anonymised.
7. Collection methods#
Data is collected — automatically or partially automatically — through the web platform, mobile interface, the QR-code-driven feedback form, e-mail communication, support requests and the payment flow.
8. Your rights (KVKK Article 11)#
Under Article 11 of the KVKK, you may apply to the data controller to:
- Learn whether your data is processed
- Request information if it is processed
- Learn the purpose and whether processing is in line with that purpose
- Know the third parties to whom data is transferred domestically or internationally
- Request correction of incomplete or incorrect data
- Request deletion or destruction within the conditions of KVKK Article 7
- Request that correction / deletion be communicated to recipients
- Object to results derived solely from automated analysis
- Claim compensation for harm arising from unlawful processing
9. How to apply#
You may exercise your rights — pursuant to the Communiqué on Application Procedures — by:
- Sending registered electronic mail to support@buaze.com
- Submitting a wet-signed petition to Türkiye
Applications are answered free of charge within 30 days. A fee set by the Personal Data Protection Authority may apply if the request entails additional cost.
10. Updates#
This notice may be revised in line with regulatory or operational changes. The latest version is always published here; the effective date appears at the top.