Privacy notice under Turkish Law No. 6698 (KVKK)

1.Data controller and scope

This privacy notice has been prepared by QrRota Yazılım ve Teknoloji A.Ş. (“QrRota”, the “Company”, “we” or “us”), in its capacity as data controller, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

This notice covers the processing of the personal data of persons who visit the qrrota.com website, create a QrRota account, join or are invited to a workspace as a team member, purchase a paid subscription, contact us or report abuse, as well as of persons who scan QR codes created with the QrRota infrastructure.

2.Our role as data controller and data processor

Depending on the type of data it processes, QrRota acts in one of two capacities:

• As data controller: we determine the purposes and means of processing for data relating to accounts, workspaces, team membership, subscriptions, payments, invoicing, the free trial, email communication and consent records, support and abuse reports, moderation and official order records, and the connection (traffic) records we keep under Law No. 5651. Most of this notice concerns this data.
• As data processor: for scan data obtained when QR codes created by our customers are scanned, and for content our customers add to their QR codes (for example the name, phone number and email address on a business card QR code), the data controller is the customer who owns the QR code. QrRota processes this data as a data processor within the meaning of Article 3(1)(ğ) of the KVKK, only on the customer’s instructions and under the service agreement, in order to provide the service.

We do not use data we process as a data processor for our own commercial purposes, we do not sell it and we do not process it for advertising. The only exception to this principle is the limited processing needed to keep the service secure and to detect and prevent abuse (for example redirects that spread phishing or malware): we keep a record of the automated security checks we run on QR codes’ destination links, and when a QR code is put under review, blocked, reported, appealed or named in an official order, we keep a copy of its content at that moment as data controller, for our own legal obligations and to protect our rights. Customers who present QR codes to their own audience are responsible for meeting their own information obligations towards the people who scan them.

3.Categories of personal data processed

We do not intend to process special categories of personal data within the meaning of Article 6 of the KVKK. We ask our customers not to include special categories of personal data in QR code content or destination links.

4.Information about QR code scans

When you scan a QrRota QR code, your device reaches our redirect service through a short link and you are redirected to the destination set by the QR code owner. In the process:

• Scan data never contains your raw IP address. For scan analytics the IP address is used only at the moment of the scan, to determine your approximate location (country, region, city) and to generate the visitor identifier. The visitor connection records Law No. 5651 requires do keep your IP address, separately from scan data and encrypted, for one year (deleted in monthly batches, so within 13 months at the latest) (see “Connection (traffic) records”).
• The visitor identifier is derived by hashing the IP address and browser information (user agent) with a secret key known only to us, using the HMAC (keyed hash) method. Your IP address cannot be recovered from this value; however, because it is pseudonymous data, it is protected as personal data.
• The identifier is used to count unique scans, to separate out bot traffic and, in A/B tests, to send the same person to the same variant on every scan (consistent assignment).
• No cookies are placed on your device and no information is stored on it during a scan. Scan data is not used for advertising, profiling or matching with other customers’ data.

If you are the person who scanned the QR code: The data controller for your scan data is the business or person that published the QR code. We recommend that you address any requests under the KVKK to them first. If you cannot identify the QR code owner, you can write to destek@qrrota.com, stating the short link you scanned; we will forward your request to the customer concerned and provide the assistance required of us as data processor. If you notice a harmful or misleading redirect, you can report it to us at the same address.

5.Connection (traffic) records

As a hosting provider under Law No. 5651, QrRota must keep traffic data (Article 5(3) of the Law). QrRota Yazılım ve Teknoloji A.Ş. is the data controller for these records, which are kept separately from scan data:

• Purpose: to meet the obligation to keep traffic data under Article 5(3) of Law No. 5651 and to answer requests from judicial bodies and other authorities entitled by law; to keep accounts and our infrastructure secure.
• Legal ground: processing is necessary for the data controller to comply with a legal obligation (KVKK Article 5(2)(ç)).
• Retention: one year, then deleted automatically (visitor connection records in monthly batches, within 13 months at the latest). Deleting your account does not shorten this period.
• Security: in account activity and visitor connection records the IP address, port and browser information (and, in account activity records, the email address) are encrypted with AES-256; the other fields, such as the time, the requested address and the response status, are stored unencrypted. The database doesn’t allow these records to be changed, and daily cryptographic seals check their integrity. Access is limited to named, authorized staff (in the admin panel, with two-step verification), and every view and export is logged. Server access logs are compressed into hourly files and encrypted so that they can only be opened with a key that is kept offline, never on the server; the current hour, until it is encrypted, is kept in a file only the server administrator can access. Only the authorized person who holds the key can open these files.
• Transfers: only on a decision of a judicial body or a formal request from an authority entitled by law, and only within its scope. These records are not shared with the customers who own QR codes and are never used for analytics, marketing or profiling.

6.Purposes of processing

• Creating your account, verifying your identity and managing your account
• Providing dynamic QR codes, short links, smart routing and scan analytics
• Managing workspaces and team memberships, sending invitations, and applying roles and permissions
• Running subscriptions and the free trial (including granting the trial only once per user, workspace and email address), taking payments, and issuing e-invoices or e-archive invoices
• Sending transactional notifications about the service (email verification, password resets, team invitations, payment and subscription notices) and tracking their delivery
• Handling support requests, suggestions and complaints
• Ensuring information security; preventing unauthorized access, fraud and misuse of the service; stopping short links from being used for phishing and malware (checking destination links against threat lists and Google Web Risk, an AI-assisted first review of suspicious or reported codes, reviewing abuse reports, blocking codes and suspending accounts where necessary, and reviewing appeals)
• Measuring the service’s performance, finding and fixing errors in the app, and improving the service (using aggregated, anonymous data wherever possible)
• Complying with legal obligations (including keeping traffic data and carrying out removal, access-blocking and information orders of competent authorities under Law No. 5651, and keeping invoices and records of consent to commercial messages), providing information to competent authorities, and protecting our rights in potential disputes

Informational emails about using your account (product tips, a notification when your code is first scanned, the monthly scan report) can be turned off in the dashboard under Settings → Notifications. Commercial electronic messages for marketing purposes are sent only if you give separate consent under Law No. 6563 on the Regulation of Electronic Commerce; you can withdraw your consent at any time, free of charge (see Commercial email consent).

7.Method of collection and legal grounds

Your personal data is collected by automated or partly automated means through forms on the website and dashboard, the “Sign in with Google” and “Sign in with Apple” features, the iyzico payment form, the redirect service, strictly necessary cookies, the abuse report form and email correspondence, and is processed on the following legal grounds set out in Article 5 of the KVKK:

• Establishment or performance of a contract (Article 5(2)(c)): opening your account, providing the service, administering your subscription and payments, and sending transactional notifications.
• Compliance with a legal obligation (Article 5(2)(ç)): invoicing and record-keeping obligations under Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102, obligations under Law No. 6502 on Consumer Protection and the Distance Contracts Regulation, keeping consent records under Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages, the obligation to keep traffic data (connection records) under Article 5(3) of Law No. 5651, and decisions and requests of competent authorities.
• Establishment, exercise or protection of a right (Article 5(2)(e)): retaining records to be used as evidence in potential disputes (for example abuse reports, moderation records and copies of reviewed QR codes).
• Legitimate interest (Article 5(2)(f)): ensuring information security, preventing misuse (bot protection, security checks of destination links, an AI-assisted first review of suspicious or reported QR codes, stopping the free trial from being used again and again), fixing errors in the app and improving the service, provided that this does not harm your fundamental rights and freedoms.
• Explicit consent (Article 5(1)): only where none of the legal grounds above applies, for example for commercial electronic messages for marketing (together with your consent under Law No. 6563) or for occasional transfers abroad where the safeguards in Article 9 of the KVKK cannot be applied. You may withdraw your explicit consent at any time; withdrawal takes effect for the future.

For scan data that we process as a data processor, the legal ground is determined by our customer as the data controller. Such processing typically relies on the customer’s legitimate interest in measuring the effectiveness of its campaigns and communications.

8.Transfers of personal data

Your personal data may be transferred to the following recipients in line with Articles 8 and 9 of the KVKK, and only to the extent necessary for the purpose concerned:

In addition, members of a workspace can see the names, email addresses and roles of the other members of that workspace. Customers who own QR codes access the scan data of their own QR codes through the dashboard. The identity of a person who reports abuse is not shared with the owner of the QR code.

We sign agreements with our sub-processors that include data security obligations under Article 12 of the KVKK, and we share only the data that is needed. We never sell your personal data to third parties. No data is sent to the public threat lists and the IP geolocation database we download for abuse checks. The instant alerts our admins get through the team messaging service Slack contain only things like a short link’s short name, internal IDs and a category; no names, email addresses, IP addresses or content are sent.

9.Transfers abroad

To provide the service, your personal data is transferred to service providers in the following countries:

• Germany and the European Union: Hetzner Online GmbH (hosting and backups; all data processed in the service), Amazon Web Services (sending and receiving emails; Frankfurt data center, part of a US-based group) and, if used, Sentry’s European Union data region (error reports).
• United States: Resend, Inc. (only if used as our backup email provider), Cloudflare, Inc. (bot protection), Google LLC (Web Risk checks and, if you choose it, Sign in with Google), Anthropic, PBC (AI-assisted first review of suspicious or reported QR codes) and Apple Inc. (if you choose it, Sign in with Apple).
• Various countries: while the AI-assisted first review is on, only the domain names of destination links, to domain registration lookup (RDAP) services (rdap.org and the registry the domain belongs to).

These transfers are made in accordance with Article 9 of the KVKK, as amended by Law No. 7499, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad:

• Where the Personal Data Protection Board (the “Board”) has issued an adequacy decision for the country, international organization or sector to which the data is transferred, the transfer is based on that decision.
• In the absence of an adequacy decision, one of the appropriate safeguards is provided, such as the standard contract announced by the Board, binding corporate rules, or a written undertaking approved by the Board. Standard contracts are notified to the Personal Data Protection Authority within five business days of their signature.
• Where there is neither an adequacy decision nor an appropriate safeguard, we rely, for incidental transfers only, on the exceptions listed in Article 9(6) of the KVKK (for example, your explicit consent, or the transfer being necessary for the performance of a contract concluded with you).

iyzico is a licensed payment and electronic money institution operating in Türkiye; payment data is processed by iyzico within the framework of its own obligations.

10.Retention periods and destruction

We retain your personal data for as long as required by the purpose of processing and for the periods prescribed by the relevant legislation. Records whose period has ended are deleted by daily automated jobs:

• Account and workspace data: for as long as your account and the workspace remain open. When your account is deleted, your account data and the workspaces where you were the only member are deleted from our active systems immediately; copies remaining in backups are permanently destroyed at the end of the regular backup cycle (within 10 days at most). Team invitations that are no longer open (accepted, cancelled or expired) are deleted after 90 days.
• Free trial record: the record linked to the user who started the trial and to the workspace is deleted when that account or workspace is deleted. To stop the trial being used again with the same email address, a one-way fingerprint (HMAC) of your email address made with a secret key is kept for 3 years from the start of the trial, even if the account is deleted (legitimate interest, Article 5(2)(f)).
• Scan data: Scan events are kept for at most 3 years, regardless of the workspace’s plan, and are deleted automatically at the end of that period. The analytics history shown in the dashboard is limited by plan: 30 days on the Starter plan, 1 year on the Pro plan and 3 years on the Business plan. After an upgrade, history within the retention period becomes visible. During the 14-day free Pro trial, the Pro visibility period applies. When a paid subscription or trial ends, QR codes keep working and scans continue to be recorded. When a QR code or workspace is deleted, the related scan data is deleted as well.
• Session records: for the duration of the session (a period of up to 30 days, renewed with use). When the session ends or you sign out, the session is invalidated; ended session records are deleted within 7 days.
• Connection (traffic) records: account activity records, visitor connection records and server access logs are kept for one year under Article 5(3) of Law No. 5651 (visitor connection records within 13 months at the latest) and then deleted automatically. Deleting the account does not shorten this period.
• Invoice, payment, subscription and distance contract records: 10 years from the end of the calendar year in which they were made, under Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102 (Article 82), even if the workspace or the account is deleted. When a workspace is deleted, only the billing details needed for accounting (full name or company name, address, Turkish ID or tax details) are kept with the payment records; the email address and phone number are deleted. Checkouts that were never completed are deleted after one year.
• Records of consent to, and refusal of, commercial electronic messages: 3 years after the consent ends; kept with the email address only, even if the account is deleted. Deleting the account ends the consent.
• Email records: the record of emails sent (recipient, kind, subject, result; no content) for one year. Records of addresses that bounced or reported our email as spam are kept for as long as an account uses the address and deleted 90 days after no account does.
• Support correspondence and incoming emails: emails brought into our admin panel are kept for one year from receipt once handled; those linked to an official order are kept with that order’s record. The raw incoming emails, attachments included, are kept by our email service provider for 30 days from receipt. Correspondence in our support inbox is kept after the request has been resolved for as long as necessary to protect our rights, taking general limitation periods into account.
• Abuse reports, moderation records (including the record of automated security checks, AI first-review records and appeals) and official orders: kept without deletion as evidence for potential disputes and requests from competent authorities; deleting the account or the QR code does not delete them. A reporter’s email address is deleted 90 days after the report is closed (one year after the report at the latest).

Data whose retention period has expired is deleted, destroyed or anonymized under our periodic destruction processes, in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.

11.Your rights under Article 11 of the KVKK

Under Article 11 of the KVKK, you may apply to the data controller to:

• learn whether your personal data is being processed;
• request information about the processing if your personal data has been processed;
• learn the purpose of the processing and whether your personal data is used in line with that purpose;
• know the third parties in Türkiye or abroad to which your personal data has been transferred;
• request the rectification of your personal data if it is incomplete or inaccurate;
• request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
• request that any rectification, erasure or destruction be notified to the third parties to which your personal data has been transferred;
• object to a result to your detriment arising from the analysis of the processed data exclusively through automated systems (for example a QR code paused by our automated checks; an admin also reviews every code paused automatically, and you can send this objection with the Appeal button on the code’s page in the dashboard too); and
• claim compensation for any damage you suffer as a result of the unlawful processing of your personal data.

You can update account details such as your name and email address under Settings in the dashboard, and delete your QR codes and their scan data yourself. You can delete your account yourself under Settings → Profile → Delete account, or ask us to delete it at destek@qrrota.com. Records the law requires us to keep stay for the periods in “Retention periods and destruction” above.

12.How to submit a request

You may submit requests concerning your rights in Turkish, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of the following methods:

• by a petition bearing your wet signature, delivered in person or through a notary public to QrRota Yazılım ve Teknoloji A.Ş., Maslak Mah. Büyükdere Cad. No:255, 34485 Sarıyer / İstanbul;
• by sending it to destek@qrrota.com from your registered electronic mail (KEP) address, or signed with a secure electronic signature or mobile signature; or
• by sending it to destek@qrrota.com from the email address you have previously provided to us and that is registered in our systems.

Your application must include your first name, last name and, if the application is made in writing, your signature; for Turkish citizens, your Turkish ID number (for foreign nationals, your nationality, passport number or, if any, identification number); your residential or business address for service of notices; your email address for notifications, if any; your phone number; and the subject of your request. Any relevant information and documents should be attached to the application.

We will resolve your application free of charge as soon as possible, depending on the nature of the request, and within 30 days at the latest. If the action requires an additional cost, a fee may be charged in accordance with the tariff set by the Board. We may ask for additional information to verify your identity.

If your application is rejected, you find our response insufficient or we do not respond in time, you may file a complaint with the Board within 30 days of learning of our response and, in any event, within 60 days of the date of your application (Article 14 of the KVKK).

13.VERBIS and changes to this notice

Our obligation to register with the Data Controllers’ Registry Information System (VERBIS) is assessed in accordance with the criteria set by the Board; once we fall within the scope of this obligation, our registration details can be viewed publicly through VERBIS.

We may update this privacy notice to reflect changes in our processing activities or in the legislation. The current version is always published on this page, and we will also announce material changes by email or through a dashboard notification. We also recommend that you read our Privacy Policy, which explains in plain language how we protect your data, and our Cookie Policy.

This English version is provided for convenience only; in the event of any conflict or inconsistency between this version and the Turkish version, the Turkish version prevails.