KVKK privacy notice

This notice is for everyone who uses PergePOS or whose records are kept through PergePOS: owners and team members of restaurants, cafés and similar food and beverage businesses; staff who work with a PIN on devices paired to a branch; guests and loyalty members who order or pay through the QR menu; applicants to the partner (dealer) program; visitors of pergepos.com; and anyone who writes to us through the contact form, the quote form or live support.

PergePOS is a product name. The business that provides the service and is referred to as "we" or the data controller in this notice is:

Our position regarding your personal data depends on whose behalf and for what purpose the data is processed.

• Data for which we are the controller. Your PergePOS account (name, e-mail, phone, password), business and branch definitions, billing and subscription details, quote and payment records, partner program applications, support and live support conversations, contact and quote forms, website visits and the records kept for the security of the service. We decide how and for what purpose this data is processed.
• Data for which we are the processor. Records a business enters into PergePOS or that are created in PergePOS while the business operates: staff records (name, role, PIN digest, shift and sales records), guest and loyalty member records (table, order, payment, reservation; phone or e-mail where provided), checks and payment records, customer, account and supplier details. The data controller of these records is the business; we process them only on the business's instructions and to provide the service.

Detailed information for guests is in the guest privacy notice; the relationship between a business and us is governed by the data processing agreement.

Data we process as the controller:

• Identity and contact: first name, last name, e-mail address, phone number.
• Account and transaction security: an irreversible digest of your password, verification codes, session and device details, IP address, sign-in and transaction logs.
• Business and branches: business name and type, branch names and addresses, contact details, team invitations and roles, devices paired to branches.
• Subscription and billing: billing name, Turkish ID or tax number, tax office, address, selected package and add-on modules, number of branches, subscription period, payment status, receipt and quote numbers, time and IP address of the agreement consent. Card details never reach PergePOS; they are collected on the payment institution's page.
• Partner program: identity, contact, tax and bank details from the application form; referral and commission records.
• Support and contact: the content of your message and the business name you provide; business type and number of branches on the quote form.
• PergePOS Assistant usage: the questions you type to the assistant, the answers given and the monthly usage count.
• Marketing permissions: your e-mail and SMS preferences, if you have opted in.
• Cookies: session and preference data; analytics data if you consent (cookie policy).

As the processor, depending on the modules a business uses, the following data is processed:

• Staff: name, role, an irreversible digest of the PIN (the raw PIN is never stored), shift openings and closings, the sales and transactions they perform.
• Guests: table and order details, payment method and amount, order notes; name, phone or e-mail provided for a payment link or a reservation. The QR menu does not require an account; an anonymous guest session tied to the device is used.
• Loyalty members: only with explicit consent; phone number, name, point and campaign activity, digital card details. Permission for marketing messages is collected separately.
• Customer and account records: customer, account and supplier details entered by the business.

PergePOS does not process card data: guests' card payments are taken on the business's payment terminal or on the payment institution's page; PergePOS only receives the result and the amount of the payment.

As the controller we process your data on the following legal bases listed in Article 5 of KVKK:

• Formation and performance of a contract (Art. 5/2-c): account creation and sign-in, business, branch and team management, subscription, payment and invoicing, preparing quotes, running the partner program, answering support requests, mandatory service notices.
• Legal obligation (Art. 5/2-ç): keeping the records required by tax and commercial law, requests from authorised bodies.
• Establishing, exercising or protecting a right (Art. 5/2-e): records that must be kept as evidence in case of a dispute.
• Legitimate interest (Art. 5/2-f): account and service security, blocking abuse, debugging, improving the service through aggregate, non-identifying usage measurement.
• Explicit consent (Art. 5/1): commercial electronic messages and optional analytics cookies. You may withdraw your consent at any time.

For the staff, guest, loyalty and sales records we process as the processor, the purpose and legal basis are determined by the business (e.g. order and payment operations, performance of the employment contract, issuing fiscal documents, running the loyalty program). The business is responsible for informing its staff and guests and for obtaining explicit consent for the loyalty program and marketing messages. Loyalty consent is recorded with its version on the PergePOS screen on behalf of the business.

Your data is collected automatically or semi-automatically from you through the pergepos.com website, the web panel, the mobile app, POS and kitchen devices paired to a branch, QR menu and kiosk screens, payment links, contact and quote forms, live support and e-mail; from the staff, customer and menu records a business enters or imports in the panel; from payment results returned by payment institutions, orders received from online ordering platforms and delivery reports from SMS providers.

Personal data is shared only to the extent necessary and limited to the purpose, with the following categories of recipients:

• Server, database, file storage, backup and e-mail delivery providers.
• Payment institutions for subscription payments (iyzico and Stripe).
• SMS delivery providers (e.g. Netgsm, Twilio). SMS messages sent to guests and loyalty members on behalf of a business go through the business's own provider account.
• Firebase (Google) and Apple notification services for delivering mobile app notifications.
• Artificial intelligence providers: the language model behind PergePOS Assistant answers, reporting insights and the initial draft reply in live support. Only the content needed to fulfil the request is sent; personal data is kept to a minimum and sales data is sent in aggregate, non-identifying form.
• Recipients chosen by the business through the integrations it enables: online ordering platforms, cash register (ÖKC) and e-document integrators, accounting and ERP software. The business is the data controller of these transfers.
• Apple and Google wallet services for guests who add a loyalty card to their phone's wallet; for businesses using a service robot, the robot manufacturer's service (table and task details only, without personal data).
• Public bodies authorised by law, and our legal advisers in case of a dispute.

Some of these providers may host servers outside Turkey. International transfers are made in accordance with Article 9 of KVKK: to countries with an adequacy decision, with appropriate safeguards such as the standard contract published by the Board, or in the incidental transfer cases listed in the Law.

• Account, subscription, quote and billing records: for the duration of the membership and afterwards for the period required by tax and commercial law.
• Security and access logs: for the period required by applicable law.
• Support, contact and quote conversations: at most 2 years after the request is closed, for possible disputes.
• Partner program applications: 1 year if the application is not accepted; if a partner agreement is concluded, for the duration of the agreement and afterwards for the period required by law.
• Business records (staff, guests, loyalty, checks and sales): during the subscription, according to the retention rules set by the business. When the subscription ends, the records are kept read-only for 90 days so they can be exported; after that they are deleted or anonymised, subject to statutory retention obligations. The business may request earlier deletion.
• Loyalty member data: deleted when the member withdraws consent or the business deletes it; the part of point and campaign activity linked to sales records may be kept in anonymised form for the period required by law.
• Marketing permissions: until the permission is withdrawn.

Under Article 11 of KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties it is shared with; to request correction if it is incomplete or inaccurate; to request deletion or destruction when the conditions are met and to have these actions notified to third parties; to object to an outcome against you resulting exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

You may submit your request from your registered e-mail address to info@pergepos.com or in writing to Ahmet Aksungur (Aksungur Yazılım), Karşıyaka Mah. 3923 Sk. Tez Apt. No: 2 İç Kapı No: 1 Kepez / Antalya. Requests are answered free of charge within 30 days at the latest; if the request involves additional cost, the tariff set by the Board may apply. If your request is rejected, the answer is insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board.

You can delete your PergePOS account yourself from the account settings in the app; records subject to statutory retention are kept for that period. You may withdraw the explicit consent you gave to a business's loyalty program at any time by writing to the business or to us.

This notice is updated when necessary. The current version is published on this page; the "Last updated" date at the top of the page applies.