KVKK Privacy Notice

1. Data we process, purposes and legal grounds

Identity and profile: first and last name, username, date of birth, gender (optional), profile photo, bio, interests and Instagram username (optional). Purpose: opening your account and showing your profile; enforcing the minimum age of 18 (Additional Article 4 of Law No. 5651). Legal grounds: establishment and performance of a contract (Art. 5/2-c), legal obligation (Art. 5/2-ç).

Contact: phone number and e-mail address. Purpose: sending sign-in and verification codes, notifications about your account and transactions, answering support requests. Legal ground: Art. 5/2-c.

Location: your device’s current location, only when you allow it and while you use the app, never in the background. Purpose: showing venues near you and verifying that a check-in happens at the venue. Your location coordinates are not stored on our servers; only the venue you checked in at and the time are recorded. This also covers your friends seeing, depending on your privacy settings, only which venue you are at; ghost mode turns this off completely. Legal ground: Art. 5/2-c.

In-app activity (customer transactions): check-ins, likes, saved venues and lists, reviews and ratings, photos you share, friendships, blocks, profile visits and notifications. Purpose: providing Zivvy’s social and discovery features. Legal ground: Art. 5/2-c.

Messages: the content of your messages, sender, recipient and time, message requests, your message and venue chat settings, the people you restricted and the venue where a venue chat started. Purpose: providing messaging between users and (if you turn it on) venue chat; preventing harassment, unwanted messages and abuse; reviewing reported messages; meeting lawful requests from competent judicial and administrative authorities. Legal grounds: performance of the contract (Art. 5/2-c), legal obligation (Art. 5/2-ç), establishing, exercising or protecting a right (Art. 5/2-e) and legitimate interest (Art. 5/2-f).

Transaction security and traffic data: when sessions start, refresh and end, IP address, app and device information (user agent), the kind and time of actions such as sending a message, checking in, writing a review or uploading a photo (not their content), your device’s push notification token and account activity logs. Purpose: account security, preventing abuse and fraud, delivering notifications to your device, and keeping traffic data as a hosting provider under Article 5(3) of Law No. 5651. Legal basis: legal obligation (Art. 5(2)(ç)), legitimate interest (Art. 5(2)(f)).

Reports and moderation records: reports you make or that are made about you, the reported content and the action taken. Purpose: enforcing community rules, removing unlawful content and responding to requests from the competent authorities. Legal grounds: Art. 5/2-ç, establishing, exercising or protecting a right (Art. 5/2-e), Art. 5/2-f.

Gift transactions: the item you treat someone to, the venue, the recipient, your note, the amount, the date, the payment result, your card type and last four digits (your card number never reaches Zivvy or the venue), and the name, e-mail, phone number and IP address passed to the payment institution. Purpose: selling, delivering and refunding gifts, accounting and tax obligations. Legal grounds: Art. 5/2-c, Art. 5/2-ç.

Treats: the item, the venue, the sender and the receiver of a treat you send or receive, your note, the dates it was sent, expires and was used, and the number of sending attempts refused in a day. To decide whether you can send or receive a venue’s treat, your check-in records at that venue are used (for the sender, check-ins on at least three different days; for the receiver, no earlier check-in there); if you hide your check-ins from your friends you cannot be sent a treat, and when a treat cannot be sent the sender is not told why. Purpose: sending the treat, using it at the venue and preventing misuse. Legal grounds: Art. 5/2-c, Art. 5/2-f.

Business accounts: the authorised person’s name and contact details; registered business name, address, tax certificate, tax or Turkish ID number, IBAN; subscription and payment records. Purpose: verifying the business, providing the business panel, paying gift amounts out to the venue, subscriptions and invoicing. Legal grounds: Art. 5/2-c, Art. 5/2-ç.

Website visitors: an approximate city derived from your IP address by our hosting provider (used to show venues in your city on the home page, not stored), cookies strictly necessary for the site to work, and visit counting without cookies (the page’s address, the page you came from, approximate location, device and browser details; kept as aggregated statistics that don’t identify the visitor). See the Cookie Policy. Legal ground: Art. 5/2-f.

Website visit measurement (only if you accept in the cookie bar on the site): a random ID given to your browser, the pages you view, the page you came from, your device and browser details, and your IP address and the approximate location derived from it. Purpose: measuring how the site is used and improving it. Legal ground: explicit consent (Art. 5/1); you can withdraw it at any time as described in the Cookie Policy.

Error records (website, Business Panel and app): when a software error occurs, the error’s text and where it occurred are recorded. On the site this comes with the page’s address (without the part after the question mark) and the site’s version; in the app, with the app’s version and technical details of your device (model, operating system version, screen size, memory state, language setting). Your name, account, IP address, cookies and a trail of what you did are not added to this record. An error report from the app is sent from your device straight to the provider; your IP address is transmitted in the process but not stored. Purpose: finding and fixing errors and keeping the service secure and running. Legal ground: Art. 5/2-f.

2. How we collect data

We collect your personal data electronically, by automated and partly automated means: from forms in the app and on the website, from your browser when you visit the website (through analytics cookies if you accept them), from the app or the site when a software error occurs, from Google or Apple when you sign in with them, from your device’s location service when you allow it, during phone verification, from transaction results returned by the payment institution, and, if you buy Zivvy+ in the app, from the subscription status we receive from Apple (App Store) or Google (Google Play).

3. Who we transfer data to

Other users: your profile, reviews and photos; your location only to the people you choose in your privacy settings and only at venue level.

Businesses: only aggregated, anonymous statistics (in groups of at least 5 people). When a treat or gift is sent to you or by you, its details (the item, the sender’s username and note) are shared with the venue when it is used at the till.

Our service providers (data processors): Supabase (database, sign-in and file storage; servers in Ireland), Vercel (website hosting and visit counting without cookies; USA), Expo (app notifications and checks for app updates, during which your device’s IP address is sent; USA), Google Firebase Cloud Messaging (delivering Android notifications, which passes on your notification token and the notification’s content; USA), Mapbox (maps; USA), Resend (e-mail delivery; USA), Sentry (Functional Software, Inc.; records of software errors on the website and in the app; servers in Germany), Meta Platforms Ireland Limited (verification codes by WhatsApp; Ireland) and, only if you accept analytics cookies on the site, Google LLC (website visit measurement with Google Analytics; USA); only as far as the service requires.

Payment providers: a licensed payment institution established in Türkiye for gift and business plan payments. If you buy Zivvy+ in the app, you pay through Apple (App Store) on iPhone and through Google (Google Play) on Android. To match the purchase to your account we pass that company only your Zivvy account’s ID code (a randomly generated code); from it we receive only your subscription’s status.

Competent public authorities and courts: when required by law. Traffic data and existing message records are transferred only on a lawful request from a competent judicial or administrative authority, limited to the person and period requested; every transfer is logged.

These transfers are based on the legal grounds in Art. 5/2-c, ç, e and f; the transfer for Google Analytics is based on your explicit consent (Art. 5/1).

4. Our providers and the countries where data is processed

To provide the service we use the providers listed above; your data is sent to these companies and processed in the countries named: Supabase (servers in Ireland), Sentry (servers in Germany), Vercel, Expo, Mapbox and Resend (USA).

When you verify your phone, the code is sent by WhatsApp: your phone number and the code go to Meta Platforms Ireland Limited. Meta may process them in data centres in Ireland, the USA, Denmark and Sweden, and keeps messages for up to 30 days. If you don’t use WhatsApp, you can sign in by e-mail.

If you accept analytics cookies on the site, information about your visit is sent to Google LLC (USA) for the Google Analytics service; if you don’t accept, this transfer does not take place.

These transfers are made only to the extent the service requires.

If you choose to sign in with Google or Apple, sign-in takes place through your account with these companies (United States).

If you buy Zivvy+ in the app, the purchase takes place through your account with Apple or Google (USA), on these companies’ own systems; your Zivvy account’s ID code is passed to these systems as well.

App notifications never carry the content of your messages; they only show who they are from.

5. Retention periods

Account and profile data, your check-in history, reviews and lists: while your account is open. Messages: while your account is open and for at most 1 year from when they were sent. When you ask to delete your account, all of it is permanently deleted within 30 days.

Notifications: 180 days (60 days once read). Profile visits: 60 days. Unused notification tokens: 120 days. Unanswered invitations: 30 days.

E-mail delivery logs, in-app activity logs and report records: up to 2 years. Records of staff actions and of deletions: 3 years. Error records: up to 90 days.

Traffic data (session and activity records, IP address and time; never content): 1 year under Article 5(3) of Law No. 5651. If you delete your account, these records and the details identifying your account (username, member number, first and last name, phone, e-mail) are kept with restricted access only until that period ends, then deleted.

Payment, gift and invoice records: for the period required by law (10 years under the Turkish Commercial Code); if your account is deleted, with the link to your identity removed. Treat records: for as long as your account is open (so that the rule of one treat per venue can be applied); if you delete your account, with the link to your identity removed. The daily number of refused sending attempts: 30 days.

When the period ends or the reason for processing no longer applies, your data is deleted, destroyed or anonymised.

6. Your rights (KVKK Art. 11)

You have the right to: a) learn whether your personal data is processed, b) request information if it has been processed, c) learn the purpose of processing and whether the data is used for that purpose, ç) know the third parties in Türkiye or abroad to whom it has been transferred, d) request correction if it is incomplete or inaccurate, e) request its deletion or destruction under the conditions of KVKK Art. 7, f) request that the actions under (d) and (e) be notified to the third parties to whom it was transferred, g) object to a result against you arising from analysis exclusively by automated systems, ğ) claim compensation if you suffer damage because of unlawful processing.

7. How to apply

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in writing with a wet signature to Umurbey Mah. Tariş Cad. No: 5 C Konak / İzmir by post or by hand, signed with a secure electronic or mobile signature, or from the e-mail address registered to your Zivvy account, to kvkk@zivvy.live, or from your own KEP (Turkish registered e-mail) address to kontratakteknoloji@hs01.kep.tr. Your application should state your name, your Turkish ID number (or nationality and passport number if you are not a Turkish citizen), your address, your contact details and your request.

We will conclude your application free of charge within 30 days at the latest; if the process involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or it is not answered in time, you can complain to the Personal Data Protection Board under KVKK Art. 14.