Zabiris QR order privacy notice
This notice is for people who place an order with a restaurant, café or similar business through a Zabiris QR menu. It is prepared under Article 10 of the Turkish Personal Data Protection Law (KVKK) for information only; it does not ask for your consent. The Turkish version prevails: Zabiris QR sipariş aydınlatma metni.
1. Data controller and Zabiris's role
The data controller is the business you order from. The business's name and contact details appear on the menu and in the notice that opens during ordering.
Zabiris provides the QR menu and ordering infrastructure the business uses. Zabiris processes your personal data only on the business's behalf and only to deliver your order to the business, so Zabiris is a data processor. Zabiris does not use this data for its own purposes.
2. Table orders, calling the waiter and asking for the bill
When you place an order at the table via the QR, call the waiter or ask for the bill, no name, phone number or other personal data is requested. Only the table, the chosen items, the order note and the preferred payment method are sent to the business.
The sections below are for delivery orders handled by the business.
3. Data processed for delivery orders
| Data | Description |
|---|---|
| Identity | Your name (the person who will receive the order) |
| Contact | Your mobile phone number |
| Delivery address and location | The written address and directions; the delivery point marked on the map (via your browser's location permission or by placing a pin), and its distance to the business |
| Order contents | Items and their options, the order note, amounts, delivery fee, order date and status |
| Payment type | Cash, card or meal card at the door; for cash, the change-for information. No card details are collected; payment is made on delivery. |
To prevent fake orders, order frequency is limited; connection information (IP address) and similar technical data are used for this purpose. Phone numbers blocked by the business are stored only in a form that cannot be reversed.
No special category of personal data (health, religion, biometrics etc.) is requested.
4. Purposes of processing and legal basis
| Purpose | Legal basis |
|---|---|
| Receiving, preparing and delivering your order to your address | KVKK art. 5/2-c: performance of a contract |
| Calculating the delivery distance and delivery fee | KVKK art. 5/2-c |
| Contacting you about your order (address confirmation, delay, cancellation) | KVKK art. 5/2-c |
| Preventing fake and malicious orders | KVKK art. 5/2-f: legitimate interest of the data controller |
Your data is not used for marketing. No campaign or advertising message is sent to you; no marketing consent is requested in this version.
5. Transfers of personal data
- Your information is sent only to the business you ordered from. The order appears on the business's Zabiris POS screen and receipt; delivery is handled by the business.
- Information is stored on the Zabiris infrastructure, which runs on the servers of the hosting provider used; details are in the Privacy Policy.
- When the Zabiris team helps a business, they see your phone number and address only in masked form.
- Your information is not sold, rented, or shared with third parties for marketing or advertising. It may be shared with authorities only where required by law.
6. How we collect
Your data is collected electronically from the information you enter on the Zabiris QR order form and, if you allow it, from your browser's location feature or the pin you place on the map.
If the "Remember my details on this device" box is ticked, your name, phone number and address are kept for your next order only in your own browser. You can remove this information by unticking the box or by clearing your browser data.
7. Retention
Your name, phone number, delivery address and location are automatically deleted 180 days after the order is delivered or cancelled. This period is intended to allow complaints, returns and disputes to be resolved.
The order amount, items and date are kept for the business's reports in a form that cannot be linked back to you, without any personal data.
8. Your rights under KVKK
Under article 11 of KVKK, by applying to the data controller you have the right to:
- Learn whether your personal data is processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether the data is used for that purpose,
- Know the third parties to whom it has been transferred, domestically or abroad,
- Ask for correction if it is incomplete or inaccurate,
- Ask for erasure or destruction under the conditions in article 7 of KVKK,
- Ask that corrections, erasures or destructions be notified to the third parties to whom the data was transferred,
- Object to a result that arises against you solely from automated analysis of your data,
- Claim compensation for damage caused by unlawful processing.
9. How to apply
Because the data controller is the business you ordered from, please apply to that business first. The business's contact details appear on the menu and in the notice shown on the order screen.
If you cannot reach the business, or you have a question about Zabiris's role as the infrastructure provider, you can write to destek@zabiris.com. We will forward your request to the business concerned and help with the response.
Applications are answered within 30 days at the latest and free of charge; if the request itself causes a cost, a fee set in the KVKK Board's tariff may be charged. If your application is refused, the answer is insufficient or no answer is given within the deadline, you may complain to the Turkish Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.