Privacy Notice
Details in square brackets will be updated once company registration is complete.
This notice explains how TapOnTable processes personal data through its website, panel, short-link service and coasters, in line with the EU General Data Protection Regulation (GDPR) and Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Controller
The controller is [Company name] ("TapOnTable"), [Registered address]. Contact: kvkk@tapontable.com. Our representative in the European Union under Article 27 GDPR: [EU representative].
2. Data we process
Customers and business contacts
- Identity and contact: name, email, phone number, business name.
- Orders and billing: billing and delivery addresses, order history, support requests and correspondence.
- Payment: amount, date and the last four digits of the card. Full card numbers and security codes are handled by the payment provider and are never stored by us.
- Account security: sign-in records, IP address, session data and, if you sign in with Google, the name, email and account ID Google shares with us.
- Your content: logos, coaster designs, menu and dish photos, menu text.
Guests who scan a coaster
- IP address, browser and device information, referring page, country derived from the IP address, time of the scan and the coaster scanned. We never ask guests for their name, phone number or email.
Prospective customers
- Business name, address, phone number and website published on Google Maps, and records of our contact with the business.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing your account, panel, smart menu and redirects, processing and delivering orders | Contract (1)(b) |
| Invoicing, accounting and statutory retention | Legal obligation (1)(c) |
| Counting scans, weekly reports, preventing abuse and bot traffic, security | Legitimate interests (1)(f) |
| Contacting businesses using publicly available business information | Legitimate interests (1)(f) |
| Sending marketing emails | Consent (1)(a) |
Menu and dish photos you upload are processed by an AI service to suggest item names, descriptions, allergens and translations. This involves no automated decision-making, and every suggestion is shown to you for approval before publication.
4. Recipients and international transfers
We share data with Amazon Web Services (servers in Frankfurt, Germany, including the Amazon Bedrock AI service), Google LLC for Google sign-in and business information, payment providers, couriers, our sales partners, our accountants and legal advisers, and public authorities where required by law. TapOnTable is established in Türkiye. Transfers from the EU to Türkiye and to other third countries are based on the European Commission's Standard Contractual Clauses or other safeguards under Chapter V GDPR.
5. Retention
- Account and order data: for the life of the account, then 10 years as required by commercial and tax law.
- Guest scan records: 90 days, after which only aggregated counts that cannot identify anyone are kept.
- System logs and IP addresses: up to 14 days.
- Marketing consent records: 3 years after consent is withdrawn.
6. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Write to kvkk@tapontable.com. We reply within one month. You may also lodge a complaint with your local supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), and in Türkiye the Personal Data Protection Authority (KVKK).