Data Protection Notice (GDPR & KVKK)

This notice supplements our Privacy Policy and is provided under the EU/UK General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law No. 6698 (KVKK).

1. Controller and contact

Menünden is the controller of account and billing data and the processor of restaurant guest data entered through a restaurant's QR menu. Contact for data protection requests: [email protected]

2. Categories of personal data

• Identity and contact data (name, email, phone) of account holders and staff.
• Transaction data (orders, payment status, table sessions) and billing data.
• Technical data (IP address, device and browser information, security logs).
• Guest data entered via a restaurant's QR menu (order contents, optional notes/reviews, and a phone number only when the restaurant uses loyalty).

3. Purposes and legal bases

Providing the Service and billing (contract); security and fraud prevention, and improving the Service (legitimate interests); tax and accounting duties (legal obligation); optional communications and, where required, optional features (consent).

4. Recipients and international transfers

Hosting and infrastructure providers, payment providers (for example Stripe, PayTR, iyzico), message delivery providers, professional advisers and competent authorities. Where data leaves your country we use appropriate safeguards (such as standard contractual clauses).

5. Retention

For as long as your account is active and as required by law afterwards (for example invoices); then deleted or anonymised.

6. Your rights

You may request access to your data, correction, deletion, restriction, objection, portability, and withdraw consent at any time; you may also complain to your supervisory authority (in Türkiye, the KVKK Board). Account holders can submit access/deletion requests from the dashboard (Data & Privacy); everyone can write to [email protected]. We respond within 30 days.

7. Automated decisions

We do not make decisions that produce legal or similarly significant effects solely by automated means.