Pursuant to Turkish Law No. 6698 on the Protection of Personal Data ('KVKK'), İşlek would like to inform you about the processing of your personal data as data controller and/or data processor.

See our Privacy Policy for our data processing practices across the website and product, and our Cookie Policy for our use of cookies.

Parties

To avoid confusion, this notice defines three distinct parties:

İşlek: The company that develops and operates the digital ordering and loyalty software. We are the data controller for website visitors and end users who join a loyalty program, and the data processor for a Business's staff data.
Business: our commercial customer ("tenant"), such as a café, restaurant, or venue that uses the İşlek software. The Business is the data controller for its own staff data.
Customer / End User: The individual who joins a Business's loyalty program or visits our website. This is who "you" refers to throughout this notice.

Data Controller and Our Role

İşlek is the data controller for the personal data of website visitors and Customers who join a loyalty program. For a Business's staff data, İşlek acts only as data processor; the data controller for that data is the Business itself.

A Business's Own Responsibility

İşlek provides Businesses with technical infrastructure services only: loyalty balance tracking, digital wallet card (Apple Wallet / Google Wallet) issuance, and QR menus. As part of these services, the Business never receives the Customer's real name or email; it can only access the masked display name along with summary data such as balance or visit count (see Our Commitments). İşlek does not carry out any marketing activity on behalf of or for Businesses, and does not share Customer data with a Business in any form that could be used for the Business's own marketing purposes. Every Business using the İşlek software is an independent data controller under KVKK toward its own end customers (those who join its loyalty program); İşlek is not responsible for any additional activity a Business carries out in its own relationship with its customers (e.g. its own campaigns or marketing communications), and fulfilling the disclosure obligation for such activity is the Business's own responsibility.

Categories of Personal Data Processed

Identity information (full name, processed in partially masked form within the loyalty program)
Contact information (email address), processed only transiently during Google/Apple identity verification and never stored in full in our database. If Apple sign-in does not return a name, an irreversibly masked preview of the email is saved as the display name instead.
Security information: (a) for website visitors, the IP address and cookie data collected via Google Analytics; (b) for staff of a Business (tenant) who log into the İşlek software, the IP address and session/log records kept solely to secure that Business's own account (login attempt limiting, suspicious session detection). This data is shown only to that specific Business.

Purpose of Processing

Your personal data is processed solely for providing the service, tracking loyalty balances, generating digital wallet cards (Apple Wallet / Google Wallet), improving service quality, and fulfilling legal obligations.

Transfer of Personal Data

Your personal data may be shared with the cloud hosting and infrastructure providers (domestic/international) required to deliver the service, and with Google/Apple for identity verification. Your data is never shared with or sold to third parties for marketing purposes.

Our Commitments

Signing in with Google or Apple is used solely to verify your identity; we only request your name and email from these providers, and no other data is requested or processed.
Your email address is not kept on a marketing or promotional list, and is not used to send you commercial electronic messages (campaigns, newsletters, etc.).
Your full name is irreversibly masked at the source before it is ever stored (e.g. "Ahmet Yalçın" -> "Ahmet Ya****"); this masking is one-way and cannot be reversed by anyone, including İşlek. The Business (tenant) can only access this masked display name along with loyalty data such as balance or visit count; your real name or email is never transferred to or visible by the Business.

Your Rights Under KVKK

Under Article 11 of KVKK, you have the following rights:

To learn whether your personal data is being processed
To request information if it has been processed
To learn the purpose of processing and whether it is used accordingly
To request correction if processed incompletely or incorrectly
To request deletion or destruction within the conditions set out in KVKK

How to Apply

To exercise the rights above, you can send your request to us at: info@islek.app

Turkish Data Protection Notice (KVKK)