KVKK Privacy Notice (Türkiye)
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
1. Data controller
Under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Obligation to Inform, your personal data in connection with Masip POS is processed by the following data controller.
| Data controller | Hasan Akgül (an individual developing software products under the Pingel brand; “Pingel”) |
|---|---|
| Location | Istanbul, Türkiye |
| [email protected] | |
| Web | pingel.dev |
2. Controller and processor roles
For data the business enters about its own staff and customers, the business is the controller and Pingel is a processor acting only on its behalf and instructions. For business owners' account, payment and contact data, Pingel is the controller.
3. Data, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data Name, e-mail, phone, role, PIN (hashed) and sign-in times of owners and staff | Creating your account, signing you in, providing the service and service notices | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Business and transaction records Business name, address, tax details; menu, tables, bills, orders, payments, cash and stock movements | Providing the POS service, reporting, backing up data | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | During the subscription; 30 days for export after it ends, then deletion |
| Data about the business's customers Customer name, phone, address, order history, points/coupons entered by the business | Running orders and loyalty on the business's behalf (as processor) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | As instructed by the business; deleted 30 days after the subscription ends |
| AI inputs Smart Waiter spoken-order transcript, menu photo/text | Turning spoken orders and menus into structured data (Google Gemini) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | Processed at the time of the request; raw audio is not stored |
| Device and notification data Device ID, printer pairings, push token | Kitchen/printer routing and sending notifications | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | Until the device is removed |
| Payment and billing data Name/organisation, phone, e-mail, chosen plan, amount, reference code, payment notice date, sender name/IBAN (from the bank statement) | Taking the purchase request, matching the bank transfer, activating the plan, keeping income and accounting records | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Compliance with a legal obligation (KVKK Art. 5(2)(ç)) | 10 years under Turkish tax and commercial law |
| Agreement and consent records Documents you accepted, their versions, date and time | Proving that the agreement was concluded and you were informed | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 10 years after account closure (limitation period) |
| Contact and support Name, e-mail, message content | Answering your questions and requests | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 2 years after the conversation ends |
| Technical and security logs IP address, browser/device info, request time, error logs | Running the service, keeping it secure, preventing abuse and attacks, obligations under Law No. 5651 | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Expressly provided for by law (KVKK Art. 5(2)(a)) | Hosting provider logs 30 days; records under Law 5651 for the statutory period (1–2 years) |
| Usage statistics Pages visited, session duration, approximate location (country/city), device type, cookie ID | Anonymised statistics to improve the site (Google Analytics) — only if you consent | Your explicit consent (KVKK Art. 5(1)); you may withdraw it at any time | 14 months in Google Analytics |
4. Method of collection
We collect personal data electronically, partly by automated means, through the forms you fill in, the actions you take in your account, the e-mails you send us and the technical information your browser or device sends automatically (including cookies and similar technologies).
5. Recipients and purposes of transfer
Your personal data is transferred, limited to the purposes above and in line with KVKK Arts. 8 and 9, to the following suppliers that provide the technical infrastructure (some located abroad):
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Google Gemini API (Google LLC) | AI features: the text or transcript you submit is processed | United States |
| Firebase Cloud Messaging (Google) | Push notifications (if you allow them) | EU and/or US |
| Google reCAPTCHA / Firebase App Check | Bot and abuse protection | United States |
| E-posta hizmet sağlayıcısı (SMTP) | Transactional e-mail | EU and/or US |
| Banks | Receiving and verifying bank-transfer payments | Türkiye |
| Google Analytics 4 (Google Ireland Ltd., Google LLC) | Visit statistics — only with your consent | EU and/or US |
Transfers abroad rely on appropriate safeguards under KVKK Art. 9 (standard contracts, providers' data protection commitments) and, for occasional transfers without them, the exceptions in Art. 9(6). Data may also be disclosed to authorised public bodies and courts on request and as required by law. Your data is never sold.
6. Your rights under KVKK Art. 11
- to learn whether your personal data is processed;
- to request information if it is processed;
- to learn the purpose and whether it is used accordingly;
- to know the third parties in Türkiye or abroad to whom it is transferred;
- to request correction if incomplete or inaccurate;
- to request deletion or destruction under Art. 7;
- to request that corrections and deletions be notified to recipients;
- to object to an adverse outcome resulting solely from automated analysis;
- to claim compensation for damage caused by unlawful processing.
7. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request with your name, (for written requests) signature, address or e-mail for notification and the subject of your request from the e-mail address registered with us to [email protected], with a secure electronic or mobile signature, or in writing. We conclude requests free of charge within 30 days; if the action involves an additional cost, the fee set by the Board may apply. If your request is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.