Privacy Notice under Turkish data protection law.

1. Data controller

• Company: YGMR Danışmanlık Limited Şirketi
• Address: Yeşilova Mah. 1. Değer Sk. No:28 İç Kapı No:3 Küçükçekmece/İstanbul
• Central registration system (MERSİS) number: 0953096784700001
• Tax office and number: Küçükçekmece Vergi Dairesi / 9530967847
• Phone: 0850 346 69 51 (weekdays 09:00–18:00)
• Email: kvkk@ygmr.com.tr
• Privacy requests and support: kvkk@ygmr.com.tr

2. Where we are the controller and where we are the processor

• Data we control: the account data of people who hold a login account, security and consent records, and what is sent through the forms on the website.
• Data we process for others: data that restaurants, cafes and bars using MenuPos (each a "Business") enter into the Service about their staff, customers and suppliers, or that arises in the Service from their work (sales, attendance, courier location, customer cards). The Business concerned is the controller of this data; we process it on its behalf and on its instructions (KVKK Articles 3 and 12).
• If you work for a Business or are its customer, please first apply to the Business about the records it keeps; if your request reaches us, we pass it on to the Business and let you know.

3. The data processed and why

• Account data: full name, email address, optional phone number, a hash of the password, language preference, two-step verification details; to open the account, sign in and protect the account.
• Security records: sessions, sign-in attempts, IP address, browser or app details (user agent) and the audit trail of who did what; to protect the Service against misuse and to investigate incidents.
• Consent records: the version of the text accepted, the time, the channel and the IP address; to prove that obligations were met.
• Staff data (on behalf of the Business): full name, phone number, role and branch, a hash of the PIN, staff badge, attendance records and, if the Business enters them, pay and notes; to link sales and attendance to the person.
• Customer data (on behalf of the Business): name, phone number, email, national ID or tax number, delivery address, account and loyalty movements, messaging consents; to deliver orders, issue invoices and run the customer account.
• Sales and fiscal records (on behalf of the Business): orders, payments, refunds, register and stock movements, fiscal receipt and e-document numbers; each record carries the staff member and the device that made it.
• Device data: platform, model, operating system and app version, last seen time and IP address, pairing details and, when notifications are on, the push token; to recognise the device, warn about outdated versions and deliver notifications.
• Diagnostics: log files and a status summary (sync queue, printers, fiscal device, versions) the device sends when support or the Business asks for them; to solve the problem, deleted after 30 days.
• Payment: subscription payments are taken on the page of a licensed payment institution; card details do not reach us and are not stored. Order, invoice and approval details are kept.
• Website forms: full name, business name, email, optional phone number and message on the demo and quote form; email and optional name, business name and note on the account and data deletion form; only to answer the request.

4. What the apps access

• Owner: works with a login account. If you wish, you can open the app lock with a fingerprint or face recognition; your phone performs this check and biometric data does not reach us.
• Waiter: works with a login account, or with a PIN on a phone the Business has paired. The camera opens only when you choose to scan a product barcode; the image is processed on the device, and is neither sent nor stored.
• Courier: works with a login account, or with a PIN on a paired phone. Location is collected only while your shift is open and you are not on a break, and continues while the screen is off (with a persistent notification on Android). A location point holds latitude, longitude, accuracy, speed, time and battery level; it is shared with your Business to manage deliveries and suggest routes. If the Business sends the customer a tracking link, the latest position also appears on that link while the delivery is on its way. Points are deleted at the end of the period the Business sets (30 days by default). The camera opens only to scan the code on the package slip; the image is not stored.
• Till: works with a PIN on a device the Business has paired; it asks for no location, camera or contacts permission. Sales records and verification details are also kept on the device so that selling can continue when the internet is down.
• Caller ID: if the Business uses this feature, an Android helper app installed on the order line passes the number of an incoming call to the till. The number is stored sealed and the record is deleted at the end of the period the Business sets (90 days by default).
• None of our apps reads your phone's contacts, shows advertising or tracks you for advertising.
• QR menu: what a guest writes for an order, a table request, a reservation or feedback goes to the Business concerned; attempts per IP address are limited to prevent misuse.
• The website uses no cookies and does not track visitors. The business panel uses only the cookies needed for the session and the language.

5. How data is collected and the legal grounds

Data is collected electronically through the apps, the panel, the website forms and devices, automatically or as you enter it. Legal grounds (KVKK Article 5/2):

• Making and performing a contract (item c): account, subscription, support.
• Legal obligation (item ç): keeping invoice, accounting and fiscal records, requests by competent authorities.
• Establishing, exercising or protecting a right (item e): consent records, audit trail.
• Legitimate interest (item f): security records, preventing misuse, diagnostics.
• Explicit consent (Article 5/1): only optional processing such as commercial electronic messages; you can withdraw your consent at any time.
• For data processed on behalf of a Business, the Business determines the legal ground as the controller.

6. Transfers

• Companies whose services we use to run the Service: hosting (servers), email delivery, SMS delivery (when the two-step verification code by SMS is chosen), push notifications, payment institution. Only the data the service requires is passed on.
• Where the servers are: in data centres in Türkiye.
• Email delivery: an email delivery provider (EU/US).
• Mobile notifications: a mobile notification provider (US).
• Integrations the Business chooses itself: food delivery platforms, e-document integrators, fiscal device and payment device providers; the Business is the controller for these transfers.
• Competent public authorities: where there is a legal obligation, as far as requested.
• For services that require a transfer abroad, the conditions and safeguards of KVKK Article 9 are followed.
• We do not sell personal data or share it for advertising.

7. Security

Fields such as customer and staff phone numbers, customer email, national ID numbers and delivery addresses are stored encrypted (sealed) in the database with AES-GCM, and a one-way blind index is used for searching. Only hashes of passwords and PINs are kept. Connections are encrypted. Each Business’s data is separated at database level. Staff access is limited by roles and permissions; revealing details such as a full phone number is written to the audit trail.

8. How long data is kept

• Account data: while the account is open. When the account is deleted, the name, email, phone number, password and two-step verification details are deleted at once; ended session records are removed within 30 days at the latest.
• Sales and fiscal records: kept under Article 253 of the Tax Procedure Law No. 213 (5 years) and Article 82 of the Turkish Commercial Code No. 6102 (10 years). These records are not deleted and cannot be changed; fields linked to a person are anonymised and the rows stay.
• Courier location points: set by the Business, 30 days by default (between 1 and 365 days).
• Call records: set by the Business, 90 days by default (between 1 and 730 days).
• Diagnostics records: 30 days.
• Consent records and the audit trail: kept to prove that obligations were met and cannot be changed; if the account was deleted, "Deleted user" appears instead of the name.
• At the end of the period, data is deleted, destroyed or anonymised (KVKK Article 7).

9. Deleting your account and data

• You delete your login account yourself in the Owner, Waiter and Courier apps (Account or Settings › Delete account) or in the panel (My account › Security). You confirm your password and the deletion happens at once.
• If you are the only owner of a Business, you first make someone else an owner or choose to close the Business. If you choose to close it, a 30-day waiting period starts; during it you can change your mind and export the data. At the end of the period, the personal data of staff and customers is anonymised, devices are revoked and your account closes; sales and fiscal records stay for the legal period.
• Staff who sign in only with a PIN have no login account of their own. They ask their employer to remove their staff record, and write to us if they cannot reach the Business.
• If you cannot get into your account, use the form on menupos.net/en/account-and-data-deletion. You confirm with the link sent to your address; the request is processed after a 30-day waiting period or answered within 30 days at the latest.

10. Children

The Service is meant for businesses and is not directed at children. We do not knowingly collect account data from children.

11. Your rights

Under KVKK Article 11 you have the right to learn whether your personal data is processed, to ask for information about it, to learn whether it is used for its purpose, to know who it was passed to, to have it corrected if it is incomplete or wrong, to have it deleted or destroyed where the conditions are met and to have those recipients told, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing.

You can send your request to kvkk@ygmr.com.tr; it is concluded as soon as possible according to its nature, within 30 days at the latest (KVKK Article 13).

12. Changes

When this text changes it takes a new version number and is published on this page; if you have an account, the new version is shown to you once when you sign in.