Legal

KVKK / GDPR privacy notice

Last updated: 21 September 2026

This notice is provided under Article 10 of Turkey’s Law No. 6698 (KVKK) and Articles 13–14 GDPR.

Controller: SERCAN ALYURT · menumax.com.tr
Contact: info@menumax.com.tr · sercanalyurt@gmail.com · WhatsApp +90 850 346 83 26
Address: Yıldırım Beyazıt Mahallesi, Candemir Sokak No:4, 59500 Çerkezköy / Tekirdağ, Türkiye

1. What we process and why

Account and venue: name, email, business name, country, menu content — to perform the QR-menu contract.
Payments: plan, amount, currency, status, error code, iyzico reference. Card data is not stored here. Legal basis: contract and legal duty (invoicing).
QR scan counters: daily/monthly counts per venue — to apply the free-plan quota (contract).
Statistics (consent cookie): page path, which menu (venue), traffic source / referring host, country and language cookie, device class, HMAC hashes of a random visitor id and IP. Purpose: see where visitors came from, which menus they opened, and where checkout failed. Legal basis: consent (GDPR Art. 6(1)(a)). If you refuse, the site and menus still work; we do not keep those summaries.

2. Recipients

iyzico processes checkout data. Hosting and email providers run the service. We do not sell data to ad networks.

3. Retention

Analytics records are kept up to 14 months, then deleted. Account, invoice and payment records follow the contract and tax-law periods.

4. Your rights

Access, rectification, erasure, restriction, objection, withdrawal of consent, and (where GDPR applies) portability. Withdrawal does not affect processing that was lawful before. Write to info@menumax.com.tr. You may complain to the Turkish DPA (KVKK) or your EU supervisory authority.

5. Cookies

See the Cookie Policy. You can change your choice via “Cookie settings” in the footer. Privacy policy: Privacy Policy.