Privacy Notice (KVKK)
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform you about the personal data processed on the MasterQR platform (“Platform”).
1. Data controller
- Company
- MasterQR
- Website
- https://masterqr.tr
When businesses using the Platform upload content and data about their own customers, the business is the data controller for that data and MasterQR acts as the data processor.
2. Personal data we process
Business account users
- Identity and contact: full name, e-mail address, preferred language.
- Customer transactions: business name, subscription and plan details, invoicing details (company name, tax office and number, address), payment records. Card details are processed by the payment institution and are never stored on the Platform.
- Security: an irreversible hash of your password (the password itself is never stored), the two-factor secret (encrypted), session tokens and an audit trail of account actions.
People who scan QR codes or visit Platform pages
- Visit statistics: time of visit, device class (iOS, Android, desktop), browser information, language, and the referring page for QR scans. Your IP address is not stored in our database.
- Security logs: to prevent abuse, IP addresses are processed for a limited time in server access logs and rate-limiting counters.
- Survey answers: collected anonymously. Please do not write identifying information in open-ended answers.
3. Purposes
- providing the Platform, creating and managing accounts and subscriptions,
- invoicing and meeting legal obligations,
- account and information security and abuse prevention,
- giving businesses aggregated, non-identifying visit statistics and improving the service,
- handling support requests and sending service notifications (e.g. e-mail verification, password reset).
4. Collection method and legal bases
Data is collected electronically through sign-up and account forms, payment flows and visits to Platform pages. Legal bases under KVKK Art. 5/2: (c) performance of a contract, (ç) compliance with legal obligations, (e) establishing, exercising or defending a right, and (f) legitimate interests (e.g. security, aggregated statistics) provided your fundamental rights are not harmed.
5. Transfers
Limited to the purposes above, data may be shared with our hosting provider (servers located in Türkiye), the payment institution, the e-mail delivery provider and competent public authorities upon request. Any use of a provider located abroad is carried out in accordance with KVKK Art. 9.
6. Retention
Data is kept while your account is open and for the periods required by law (e.g. invoices and commercial records), then deleted, destroyed or anonymised. Backups are kept for at most 14 days.
7. Your rights (KVKK Art. 11)
You may ask whether your data is processed and request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties it is transferred to, request correction, deletion or destruction and notification of these actions to recipients, object to adverse results from solely automated analysis, and claim compensation for damages caused by unlawful processing. Account holders can download a copy of their data and delete their account from the Security page in the panel.
8. How to apply
You can submit requests through the data controller’s contact channels, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests are answered free of charge within 30 days at the latest.