KVKK Privacy Notice

1. Data Controller

Data controller details for services under the Pratix brand are verified and published from the central Business Information area of the management dashboard. Pratix may process personal data as a controller or, depending on the service, as a processor for QR Menu, Online Reservations, dashboard management, subscriptions, payments, support and associated digital services.

2. Whose Data May Be Processed?

Personal data concerning the following groups may be processed within Pratix services:

• Visitors to the Pratix website.
• Customers and business owners who create dashboard accounts.
• Business managers, staff and dashboard users.
• Customers of businesses using QR Menu or Online Reservations.
• People submitting support, contact, payment, refund or cancellation requests.
• Visitors using free tools, demo links or public application pages.

3. Categories of Personal Data

• Identity information: first name, surname, username and business representative details.
• Contact information: email, phone, support contact details and address.
• Customer and business information: business name, locations, brand details, tax/billing preparation details, plans and subscriptions.
• User and permission information: dashboard role, business/location permissions, user status and activity history.
• Financial and payment information: payment status, order number, amount, currency, payment purpose, refund and cancellation request records. Pratix does not store credit card details.
• QR Menu data: categories, products, prices, descriptions, images, languages, themes, tags, allergens and publishing settings.
• Online Reservations data: booking date, time, party size, customer name, phone, email, notes, tags, status and user activity information.
• Support and request data: support messages, reasons for requests, activity notes and outcome records.
• Transaction security and technical data: IP address, session information, browser/device details, access logs, error records, security and audit records.
• Marketing and communication permissions: commercial electronic message preferences and campaign or announcement permissions.

4. Purposes of Processing

Personal data may be processed for the following purposes:

• Creating accounts, authenticating users and providing dashboard access.
• Providing QR Menu, Online Reservations and other Pratix SaaS services.
• Managing businesses, locations, users, roles, plans and subscriptions.
• Tracking payments, renewals, refunds, cancellations, invoices and accounting.
• Operating reservations, customer profiles, notifications, SMS/email and reporting on behalf of businesses.
• Responding to support requests, investigating technical problems and ensuring customer satisfaction.
• Performing security checks and preventing misuse, bots, spam and unauthorized access attempts.
• Fulfilling legal obligations, responding to official requests and retaining audit records.
• Improving service quality, product experience and system performance.
• Sending commercial messages, announcements and campaign information where explicit consent or legally valid permission exists.

5. Collection Methods

Personal data may be collected electronically through website forms, dashboard registration and login screens, payment screens, payment provider notifications, support requests, email/SMS communications, cookies, public QR Menu and reservation pages, technical logs and internal activity records.

6. Legal Grounds

Personal data may be processed under the relevant provisions of KVKK on the following legal grounds:

• Processing is necessary to establish or perform a contract.
• Compliance with the data controller’s legal obligations.
• Processing is necessary to establish, exercise or protect a right.
• Legitimate interests, provided the data subject’s fundamental rights and freedoms are not harmed.
• Processing is expressly provided for by law.
• Explicit consent where required.

7. Transfers of Personal Data

Personal data may be shared with third parties to a limited extent for service delivery, payment processing, SMS/email, hosting and infrastructure, AI-powered features, technical support, security, accounting, invoicing and legal obligations.

• Payment providers: payment collection, verification, refunds and transaction security.
• SMS and email providers: reservation, payment, system and support notifications.
• Hosting, infrastructure and security providers: service operation and protection.
• AI services: description suggestions, content editing or image enhancement in eligible plans.
• Service providers used for accounting, invoicing and financial processes.
• Authorized public institutions, judicial bodies and official authorities.

8. International Transfers

Some infrastructure, email, security, AI, analytics or hosting services used by Pratix may run on servers outside Türkiye. Where such a transfer is necessary, KVKK and relevant legislation are taken into account; explicit consent or appropriate legal transfer mechanisms may be required.

9. Payment and Card Information

Credit card numbers, expiry dates and CVV details are not stored in Pratix systems, viewed manually or held in its database. Payments are handled through PayTR or the relevant payment provider’s secure infrastructure. Pratix may retain only necessary transaction data, such as payment results, order numbers, payment status, refund/request status and accounting records.

10. Cookies and Technical Identifiers

The Pratix website and dashboard may use cookies or similar technologies for session management, security, user preferences, performance measurement and service quality. Essential cookies may be necessary for dashboard operation. Where analytics or marketing cookies are used, information and preference mechanisms may be provided in accordance with applicable legislation.

11. Retention Period

Personal data is retained for as long as required for its processing purpose and applicable statutory retention periods. Subscription, payment, refund, invoice, accounting, security and audit records may be kept longer as required by law.

Upon account closure, suspension or a deletion request, some personal data may be anonymized or made inaccessible; payment, invoice, security and legal records may nevertheless be retained for the required period.

12. Data Security

Pratix applies reasonable technical and administrative measures to prevent unauthorized access to personal data, data loss, misuse and security breaches. These may include role-based access, session management, password hashing, logging, permission checks, security audits and infrastructure protection.

13. Data Subject Rights

Under Article 11 of KVKK, data subjects have the following rights:

• To learn whether their personal data is being processed.
• To request information if their personal data has been processed.
• To learn the processing purpose and whether data is used accordingly.
• To know the third parties to whom data is transferred domestically or abroad.
• To request correction of incomplete or inaccurate data.
• To request deletion or destruction where permitted by legislation.
• To request notification of corrections, deletions or destruction to third parties receiving the data.
• To object to adverse outcomes resulting from analysis solely by automated systems.
• To claim compensation for damage caused by unlawful processing.

14. How to Apply

Requests under KVKK for information, correction, deletion, anonymization, identification of recipients, objections or other rights may be sent to info@pratix.net . Applications should include the applicant’s full name, contact details, subject of the request and information to assist identity verification.

When assessing an application, Pratix may consider account ownership, the applicant’s identity, statutory retention obligations, payment/invoice records and technical security requirements.

15. Updates

This KVKK Privacy Notice may be updated as products develop, new modules are added, or legal or technical requirements arise. The current text takes effect from the date it is published on pratix.net.