Privacy Policy
KVKK Disclosure Notice
Last updated: September 2026
Data Controller
The data controller within the meaning of Turkey’s Personal Data Protection Law No. 6698 (KVKK) is Dawrak. Contact: legal@dawrak.live
1. Data We Collect
From business operators (registered users):
- Name, email address, and password hash (for authentication).
- Business name, type, city, phone number, and address.
- Session tokens.
From end customers (queue participants):
- First name.
- Phone number (optional — entered voluntarily by the customer).
- Queue position, timestamps, and push notification subscription token (only if the customer opts in).
From customers who book remotely (booking link):
- Name, phone number, and email address (all required for a booking).
- Booking time, optional group size and note, check-in and attendance timestamps.
- Missed-booking record: when a business has strikes on, a missed booking is recorded against a one-way hash of the phone number for that business only; the number itself is not stored in the record.
Automatically collected:
- IP address (used for rate limiting and security purposes only).
- Browser user-agent string.
2. Purposes and Legal Basis
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Providing the queue management service | Performance of a contract |
| Account authentication and security | Performance of a contract |
| Preventing abuse and fraud | Legitimate interest |
| Complying with legal obligations | Legal obligation |
| Sending customer push notifications | Explicit consent |
| Sending booking confirmations, reminders, and cancellation notices by email | Performance of a contract |
| Recording missed bookings so a business can ask for confirmation from repeat no-shows | Legitimate interest |
3. Data Retention
- Queue entry data (customer names, phone numbers, positions) is deleted according to the business's history-retention setting — the default is 7 days.
- Booking data (name, phone, email, booking time) follows the same retention setting once the booking is served, cancelled, or missed. Upcoming bookings are kept until then.
- Missed-booking records are kept for the business's strike window (7 to 365 days) and deleted after 365 days at the latest. The business can waive them earlier.
- Account data is retained until the account is deleted.
- Push notification tokens are deleted when the associated queue entry reaches a terminal state or when the subscription is withdrawn.
- IP addresses used for rate limiting are stored in memory only and are not persisted.
4. Data Transfers
We host Dawrak on servers located within the European Economic Area and/or Turkey. We do not sell, rent, or share your personal data with third parties for their own commercial purposes.
5. Your Rights Under KVKK (Art. 11)
You have the right to:
- Learn whether your personal data is being processed.
- Request information about the nature and scope of processing.
- Learn the purpose of processing and whether it is used in accordance with its stated purpose.
- Know the domestic or foreign third parties to whom your data is transferred.
- Request correction of incomplete or inaccurate data.
- Request deletion or destruction of your data.
- Object to an automated decision that is to your detriment.
- Request compensation for damages arising from unlawful processing.
6. How to Exercise Your Rights
To exercise any of the rights listed above, contact us at legal@dawrak.live. We will respond within 30 days. We may ask you to verify your identity before processing your request.
7. Cookies
We use only strictly necessary cookies: a session cookie for business logins, a per-queue ticket cookie that lets a customer return to their own place or booking, and a language cookie. We do not use tracking, advertising, or analytics cookies.
8. Children
Dawrak is not intended for use by children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the Last updated date shown at the top. Your continued use of the service after changes take effect constitutes acceptance.
10. Contact
For privacy-related questions or to submit a KVKK data-subject request: legal@dawrak.live