Privacy Notice

GDPR · This notice follows the EU General Data Protection Regulation; your data is kept in the EU region (Germany).

This notice is issued under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. 1. Data controller Punchla is operated by Nivorbit Teknoloji ([address], MERSİS: [MERSİS no]), established in Türkiye. Nivorbit is the data controller for your Punchla account (your phone number, the cards in your wallet, your app preferences) and your visit to punchla.com. Each business whose card you carry is a separate data controller for its own loyalty programme; Punchla processes stamp, reward and visit records on that business's behalf and instructions, as a data processor. 2. Data we process and why Your phone number and verification code: to open your account and verify you at sign-in. Stamps, rewards, visit time and branch: to run your loyalty card, calculate your reward and keep the card in your wallet up to date. Device and wallet identifiers (Apple Wallet / Google Wallet pass ID, push token): to add the card to your wallet and deliver card updates. Campaign notifications: only if you have given that business permission. For business owners and staff, additionally name, e-mail, phone, business, billing and delivery details and the payment result: to open the account, invoice, ship the device and provide support. Your card details never reach Punchla; payment is completed on iyzico's page. 3. How we collect it and the legal basis Data is collected electronically through the app, the platform, the website and the NFC device on the counter. Legal bases: forming or performing a contract (KVKK Art. 5/2-c), meeting our legal obligations — invoicing and accounting records (Art. 5/2-ç), our legitimate interests — security, abuse prevention and service improvement (Art. 5/2-f). Campaign notifications and marketing rely on your explicit consent (Art. 5/1), which you can withdraw at any time. 4. Sharing and transfers abroad Your data is shared with: the business whose card you carry (only its own programme data); Hetzner Online GmbH for hosting (Falkenstein, Germany — servers in the EU (Germany)); iyzico Ödeme Hizmetleri A.Ş. for payments (business accounts only); Apple and Google to deliver wallet passes and notifications; and public authorities where legally required. Transfers to Hetzner, Apple and Google are transfers abroad, made under KVKK Art. 9 by signing the standard contract published by the Personal Data Protection Board and notifying the Board. 5. Retention We keep your data for as long as your account is open. When you delete your account, your data is erased or anonymised within 30 days, except invoicing and accounting records we must keep by law (10 years). When a business leaves Punchla, the stamp records of its programme are erased or anonymised on the business's instruction. 6. Your rights (KVKK Art. 11) You have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose and whether it is used accordingly, to know the third parties it is shared with, to request correction if incomplete or inaccurate, to request erasure or destruction, to have these actions notified to the third parties, to object to a result against you produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing. You can download your data or delete your account in the app. Send requests to privacy@punchla.com or in writing to the postal address above; we reply within 30 days at the latest. If you are not satisfied, you may complain to the Personal Data Protection Board.