Data Processing Terms for Venues
Roles
These terms apply to personal data of a venue's guests (orders, table sessions, loyalty, guest accounts used at that venue) that QRder processes for the venue. For this data the venue is the controller and QRder is the processor. For the venue's own account and billing data QRder is the controller (see the Privacy Policy). By using the service the venue accepts these terms.
Subject and duration
QRder processes this data only to provide the service described in the Terms of Use, for as long as the venue has an account. Kinds of data: order contents, table, optional guest name and phone, loyalty and verification data, notification subscriptions. People concerned: the venue's guests and customers.
Instructions
QRder processes the data only on the venue's documented instructions, which are the use of the features of the service, and as the law requires. If QRder thinks an instruction breaks the law it will tell the venue.
Confidentiality and security
People who access the data at QRder are bound to confidentiality. QRder applies the measures described in the Privacy Policy: encryption in transit and of sensitive fields, per-venue access control, attempt limits, human check and logging.
Sub-processors
The venue allows QRder to use the service providers listed in the Privacy Policy (database, hosting, e-mail, notifications, human check). QRder binds them to data protection duties and stays responsible for them. The venue may object to a new sub-processor on reasonable grounds.
Help with guest rights
QRder helps the venue answer guest requests (access, correction, deletion) with the tools in the service or on request, and forwards requests it receives from guests to the venue where the venue is the controller.
Data breaches
QRder will inform the venue without undue delay after becoming aware of a breach affecting the venue's guest data, with the information it has so the venue can meet its own duties to authorities and guests.
Return and deletion
When an account ends, deletion works as follows. If a guest deletes their account, their orders and bills at the venue stay with the venue for its accounting but are anonymized (no account link, no name, no e-mail, no pickup name or phone). If a venue is deleted, its orders, bills and reports are deleted with it, so the venue should export its reports first; staff accounts that work only at that venue are removed. Data the law requires us to keep is kept for that period. Some data may remain at sub-processors under their policies.
Audits
On reasonable written request QRder gives the information needed to show that it follows these terms, and allows reasonable audits with notice, at the venue's cost and without harming other customers.
Transfers abroad
Data may be processed by providers outside Türkiye and the European Economic Area.
Duties of the venue
The venue must have a legal basis for using guest data, give its guests the information required by KVKK and the GDPR (the privacy policy of QRder can be linked), not ask guests for more data than needed, handle the data it sees in the dashboard lawfully, and, where required, register with VERBİS or keep its own records of processing.