This is a translation. The Turkish text is the legally binding version. This English rendering is published so that you can understand how Verbitir handles your personal data — a notice you cannot read does not inform you. It is a close-meaning translation and not a legal instrument. Where the two differ, the Turkish KVKK Aydınlatma Metni prevails.
Statutory terms are left in Turkish on purpose. Words such as açık rıza, meşru menfaat and veri sorumlusu have defined meanings under Turkish law that no English word carries exactly; the English in brackets describes them, it does not translate them.
KVKK Privacy Notice
1. Lawful basis (hukuki dayanak)
Within the framework of Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), Verbitir relies on four principal lawful bases: açık rıza (explicit consent), the formation of a contract, legal obligation, and meşru menfaat (legitimate interest). The basis on which each category of data is processed is set out in the detailed table below.
2. Data minimisation
Verbitir does not collect more data than is strictly necessary to provide the service. On the consumer side, no data is requested beyond a telephone number, a name, and the visit records required for the loyalty flow.
3. Compliance with KVKK decision 2026/266
Full compliance is maintained with the requirement introduced by KVKK decision 2026/266 that loyalty verification be carried out on the device. Opening a consumer account through a web browser is blocked.
4. Article 11 rights (DSAR)
You may at any time request access, rectification, erasure, restriction of processing, and data portability. Requests are answered within 30 days.
5. Cross-border data transfer
Your personal data are processed by service providers established outside Türkiye, on servers located outside Türkiye; under KVKK Article 9 this constitutes a transfer of data abroad. We identify the recipients not one by one by company name but as recipient groups, according to the function they perform; for each group the country the data goes to, the purpose of the transfer and its hukuki dayanak (lawful basis) are set out below. Your right under KVKK Article 11(1)(ç) to know the third parties your data has been transferred to, in Türkiye or abroad, is unaffected; on a request sent to legal@verbitir.com the identity of the relevant recipients will be given to you. The transfers that actually take place today are: (1) providers of website hosting and domain name (DNS) management — the United States; so that the site can be delivered to you, your connection records (server logs, including your IP address) are processed on that infrastructure, together with a cookieless aggregate visit measurement that does not identify you and lets us see how the site is used; that measurement runs in all cases, independently of your cookie choice. (2) Providers of corporate email infrastructure — the European Union and/or the United States; when you write to us by email, your message and contact details are stored on that infrastructure so that we can reply. Which of the two regions the data is held in is being confirmed, and will be stated here as a single country as soon as it is. (3) Providers of form infrastructure — the European Union; so that we can receive your merchant application and your waitlist sign-up. Your application can reach us only through that infrastructure; the form additionally carries an açık rıza box which has to be ticked for the form to be submitted. (4) Providers of meeting-scheduling infrastructure — the United States; so that we can receive your request for an investor meeting and place it in our calendar, and only when you yourself follow the booking link on our site: opening the page processes your connection records on that infrastructure, and completing the booking processes your name, email address, time zone and chosen meeting time. If you prefer to send your investor enquiry by email instead, your data is processed on the infrastructure described at group (2) above. (5) Web analytics: Google Ireland Limited (Ireland) and Google LLC (the United States); so that we can measure our visitor statistics, analytics identifiers and interaction data that do not contain your name, email address or telephone number and do not directly identify you are transferred; your IP address also reaches Google as a technical part of that transfer and is used to determine your approximate location. This transfer takes place only if you press “Accept” in our cookie notice; unless you press it the transfer does not take place at all, and you may withdraw a consent you have given at any time through the “Cookie preferences” link at the foot of the page. We name the analytics service, unlike the other recipient groups: this transfer turns on a choice put to you at a separate step and revocable at any time, and for açık rıza to be valid it must relate to a specific subject and be informed — a consent given without knowing who the data goes to is not an informed consent. For the necessary infrastructure services no such separate choice is put in front of you, so we identify the recipients by group and by country; your right to learn their identity is unaffected, as stated above. No transfer of account, loyalty or order data takes place yet: the cloud infrastructure that would hold such data has not been built, and no user account has been opened. When the service launches, that data will be processed by cloud infrastructure providers established in the European Union, for the purpose of hosting your account, loyalty and order records and delivering the service to you; its hukuki dayanak and the transfer mechanism to be applied will be stated in this section before the service launches. The hukuki dayanak for this processing is: the açık rıza you give at a separate step in the cookie notice and when submitting a form; for infrastructure services such as site hosting, domain name management and corporate email, and for the cookieless aggregate visit measurement, our meşru menfaat (legitimate interest) in this website being delivered to you and your correspondence being answered (KVKK Article 5(2)(f)); and for the scheduling infrastructure, our meşru menfaat in acting on the booking request you yourself sent us. A transfer abroad requires, in addition to these bases, a separate safeguard under KVKK Article 9: the law looks first for a yeterlilik kararı (adequacy decision); failing that, for one of the appropriate safeguards such as a standart sözleşme (standard contractual clauses) or a taahhütname (undertaking); açık rıza is an exception available only where none of those routes can be provided, and only for occasional (arızi) transfers. This section therefore does not yet state definitively which mechanism each recipient group relies on; which of the yeterlilik kararı, standart sözleşme or taahhütname mechanisms applies will be settled with the approval of external legal counsel, and this section will be updated accordingly.
6. Retention periods
The table below shows retention periods and their legal bases by type of data.
7. Data breach response
Where a data breach is identified, Verbitir notifies the Kurul (the KVKK Board) within 72 hours and informs affected users without delay.