KVKK Privacy Notice

This English version is provided for convenience. In case of any discrepancy, the Turkish version prevails. Read the Turkish version

1. Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, "KVKK"), your personal data is processed by the data controller whose identity details are given below:

Name	Özer Güzel / Gelen Medya
Tax No	4530769425
Address	Atatürk Mahallesi Ali Kemali Caddesi No:8 D:8 Merkez/Erzincan 24000
Email	bilgi@genu.tr

2. Personal Data Processed

Data of Platform Users

Data Category	Personal Data
Identity	First name, last name
Contact	Email address
Transaction Security	IP address, session information, browser type
Financial	Billing name, billing address, billing email; the tax identification number for corporate invoices and the Turkish national identity number (T.C. kimlik numarası) for individual invoices. The full card number and CVV are never transmitted to Genu servers; only the last four digits of the card, the card brand and the stored card token used for recurring payments are returned by the payment provider, and these are stored.
Business Information	Business name, address, phone number, table and floor layout (entered by the user)

Data of Staff Accounts

Data Category	Personal Data
Identity	Name / nickname (entered by the business owner; the staff member's real identity is not necessarily transmitted to Genu)
Role and Authority	Waiter, kitchen, cashier or manager
Authentication	PIN code (stored with a one-way hash)
Transaction Security	Session information, bill/order/payment transaction records
Shifts and Timekeeping	Shift plan, clock-in/clock-out times and working time records. If the business uses Genu’s AI Assistants, staff roles, shift hours and sales totals may be transferred to Genu’s AI provider without names, under a pseudonymous label (e.g. “Garson-1” (Waiter-1)); staff names are not sent to this provider. If the business has connected its own AI client (MCP), staff names, roles, shift plans and working-hour records may be transferred to the AI provider chosen by the business; the data controller for this transfer is the business (see 5. Transfer of Personal Data).

With respect to staff data, Genu acts in its capacity as data processor; the data controller is the relevant business.

Data of End Users (Business Guests)

Data Category	Personal Data
Contact (optional)	Name and phone number. Obtained from those who fill in the feedback form or guests who choose to log in to the menu with WhatsApp. It is always possible to use the menu without logging in.
Authentication (optional)	On WhatsApp login, the user identifier generated by WhatsApp specifically for our business (BSUID) and the browser identifier of the device used to log in
Location and Address (optional)	Delivery addresses saved for home delivery orders and location information shared by the guest themselves
Order	Selected products, table number, special notes and the preparation/delivery times of the order. When used without logging in, it contains no identity information; the business may add a name and phone number to an order it takes by phone or on the premises. If the guest has logged in, the order history is linked to the guest account.
Loyalty and Business Record (optional)	Points/rewards history, favourites, invitation (referral) relationship; debit/credit entries if they have been recorded as a guest in the business's current-account ledger
Identity Sharing with the Business (by preference)	The name, phone number, birthday (day and month only) and the delivery addresses used in orders placed with that business of guests who turn on the “Let the business recognise me” preference in the menu are visible in clear in the customer record of the business they order from. This preference is off by default, is not a condition for logging in or placing an order, and can be withdrawn at any time from the menu account. While it is off, the business sees only the masked phone number and anonymous order statistics. Sharing is limited to the business ordered from; it is not disclosed to other businesses on the Platform.
Support Record View	When you open a support request or write to our WhatsApp line, the Genu support team sees your record in order to resolve the request: your name, phone number, registration date, consent preferences, how many orders you have placed at which businesses, and the date, amount and status of your recent orders. Private notes and tags the business keeps about you are not included in this view; the data controller for them is the relevant business. The same view is also opened, with its justification recorded and only by authorised Genu employees, for responding to your application under KVKK, for security and abuse investigations and for requests from competent authorities. This view is not used for commercial purposes and is not transferred to businesses.
Customer Information Recorded by the Business	For orders it takes by phone or on the premises, the business may record in Genu the guest's name, one or more phone numbers, one or more delivery addresses (optionally with their location), birthday, and notes and tags relating to the order; the history, amounts and durations of the orders linked to this record are visible together with the record. This record is visible only to that business's authorised staff; it is not shared with other businesses and is not linked to the guest's Genu menu account. The data controller for this data is the relevant business; Genu acts in its capacity as data processor. The record is deleted 2 years after the last order or the last update; a record on which the business has placed a remote-order restriction is kept for as long as the restriction remains in place. The order itself is kept for the statutory retention period. No WhatsApp message is sent to the numbers in this record through Genu’s infrastructure.
Orders Placed on Behalf of Someone Else	When a delivery order is placed on behalf of someone else, the name and phone number of the person who will receive it are transmitted to the business only for the delivery of that order. No message is sent to this person, and no account or customer record is created for them. The person entering the information declares that they have informed the recipient. Information kept on a saved address is deleted when the address is deleted or 1 year after its last use.
Reservation Record	When you make a table reservation with a business by phone, the business's staff record your name, your phone number if any, the number of people, the time and any note in the system. A phone number is not mandatory. This record is visible only to that business's staff and is automatically deleted 1 year after the reservation time.
Incoming Call Record	If a Caller ID device is connected to the business's phone line via the Genu printer agent, the number the call came from and the time of the call are recorded. This record is visible only to that business's staff and is automatically deleted after 30 days.
WhatsApp Conversations	The content of messages you send to Genu’s WhatsApp line or to a WhatsApp line a business uses through Genu (text, photos, audio, documents, location), your WhatsApp profile name, message dates and the delivery status of replies sent to you. These conversations are seen and answered by the Genu support team; they are automatically deleted after 1 year.
Remote Order History	Per business, the number of rejected, cancelled and uncollected pickup/delivery orders and the order confirmation record (which order you confirmed and when). Used only at the relevant business for the remote-order restriction and not shared between businesses. Legal basis: legitimate interest (KVKK Art. 5/2-f).
Notes Kept by the Business	The business may keep free-text notes and tags about its own guest. The data controller for this content is the relevant business.
Student Verification (optional)	Student certificate information and Turkish national identity number (T.C. kimlik numarası) temporarily obtained during verification from those who wish to benefit from the student discount; deleted once verification is completed
Usage	Menu view statistics (anonymous)

Data of the Business's Business Partners and of Third Parties in Documents

The business may keep records relating to its suppliers and expenses in Genu in order to run its preliminary accounting. With respect to this data, the data controller is the relevant business; Genu acts in its capacity as data processor.

Category	Data
Supplier Current-Account Record	Name / trade name, tax number and tax office, phone, email, address, the business's debt and payment entries towards the supplier
Expense Document Image	The image of the invoice, receipt or voucher uploaded by the business. Data such as the subscriber name, address or subscriber number may appear on the document; this data is not transferred to the expense record and remains only in the image of the document.

3. Purposes of Processing

Creating and managing the user account
Establishing and performing the service contract
Running the hospitality operations modules (menu, waiter, kitchen/KDS, cashier)
Staff role/authority management and PIN-based secure access
Carrying out payment transactions and issuing invoices
Fulfilling legal and administrative obligations
Ensuring the security and integrity of the Platform
Providing technical support and customer service
Improving service quality (anonymous analytics)
Product news and campaign notifications, subject to obtaining explicit consent

4. Legal Bases

Processing Activity	Legal Basis under KVKK Art. 5
Account creation, service provision	Establishment or performance of a contract (Art. 5/2-c)
Invoice and tax records	Fulfilment of a legal obligation (Art. 5/2-ç)
Platform security, access logs	Legitimate interest (Art. 5/2-f)
Preparation and delivery of pickup and delivery orders and order status notifications	Establishment or performance of a contract (Art. 5/2-c)
Analytics cookies, marketing notifications	Explicit consent (Art. 5/1)
The guest's name, phone number, birthday and the addresses of the orders placed with that business remaining visible in the business's customer record after the order as well	Explicit consent (Art. 5/1)
Processing the name and phone number of the recipient (order on behalf of someone else)	Establishment or performance of a contract (Art. 5/2-c)
Transfer of business data and staff data to the AI client connected by the business itself (MCP)	The data controller for the transfer is the business; Genu carries out the transfer as data processor in line with the instruction the business gives from the panel in its capacity as data controller (Art. 12/1)

5. Transfer of Personal Data

Domestic Transfer

Your personal data is not transferred to third parties in Türkiye except in cases of legal obligation. iyzico Ödeme Hizmetleri A.Ş. is informed, in a KVKK-compliant manner, within the scope of the data that is mandatory for payment transactions.

Transfer Abroad

Recipient	Country/Region	Purpose	Safeguard
Convex Inc.	EU (Ireland)	Database and infrastructure	SCCs / SOC 2
Vercel Inc.	USA / EU	Hosting of the website and panels, cookieless page usage measurement	SCCs
Meta Platforms Ireland Ltd.	EU (Ireland)	Guest login via WhatsApp, transmission of order and notification messages	SCCs
Google Ireland Ltd.	EU (Ireland) / USA	Consent-based analytics measurement (Google Analytics). AI services (Gemini): menu content and images for menu import, translation, product information and image enhancement; the document image uploaded by the business for expense document reading; menu, tables, total sales and end-of-day figures and shift information for Genu Assistant, Genu Assistant · Merkez, Genu Pazarlama and the end-of-day summary (staff appear only under a pseudonymous label — e.g. “Garson-1” (Waiter-1) — and with their role; the mapping between the label and the real name stays on the Genu server, and staff names are not sent); the menu and the question written by the guest for the guest menu assistant. Guest personal data, staff names and data originating from WhatsApp are not sent. On the free usage tier, Google may use the content sent to develop and improve its own services.	SCCs
Resend Inc.	USA	Sending transactional emails (login verification code, end-of-day report)	SCCs
Cloudflare Inc.	USA / global	Bot protection on form and login screens (Turnstile)	SCCs

Transfers abroad are carried out pursuant to Article 9 of KVKK within the framework of international data transfer safeguards (Standard Contractual Clauses, adequacy decision, etc.).

AI Client Connected by the Business Itself

The business may connect an AI client of its own choice (e.g. ChatGPT, Claude) to Genu through the AI Client Connection (MCP). This connection is optional, off by default, and is set up only with the explicit approval of the business's authorised person from the panel. While the connection is open, the business's own business data and staff data (name, role, shift and working-hour records) may be transferred to the AI provider chosen by the business, in Türkiye or abroad. The recipient of this transfer is determined by the business, not by Genu; the data controller for the transfer is the relevant business, and the provider's terms of use and privacy terms are between the business and the provider. Genu sets up the connection in line with the business's instruction, keeps its scope limited to the data categories listed in the Privacy Policy, and disconnects it immediately when the business so wishes. Neither personal data of guests (end users) nor any data originating from WhatsApp is transferred within the scope of this connection.

6. Retention Periods

Data Type	Retention Period
Account and profile data	For as long as the account is active + 2 years
Invoice, payment and accounting records	10 years (Turkish Commercial Code (Türk Ticaret Kanunu) Art. 82)
Order and bill records	10 years (Turkish Commercial Code Art. 82)
Customer information recorded by the business	2 years from the last order or the last update (kept for as long as a remote-order restriction remains in place)
Name and phone number of the recipient in an order placed on behalf of someone else	When the address is deleted or 1 year from the last use
Order confirmation drafts	30 days
Staff shift, timekeeping and personnel records	10 years from the end of the employment relationship (Law No. 5510, Art. 86)
Current-account records	10 years from the last entry (Turkish Commercial Code Art. 82)
Expense records and document images (invoices, receipts)	10 years from the document date (Turkish Commercial Code Art. 82)
Deleted expense record and document image	30 days from deletion
Document upload that is not saved	1 day
Transaction and audit records (financial/administrative)	10 years
Access and operation logs	1 year
Email address and IP address in log records	1 year; thereafter the email address is not recorded and the IP address is stored in truncated form
Feedback data	2 years
Support requests and correspondence	2 years from closure of the request
Contact form messages	2 years
WhatsApp conversations	1 year
Table reservations	1 year
Waiting list record	1 year
Incoming call record (Caller ID)	30 days
Login verification code records	30 days
Login attempt counter (IP address)	1 day
Desktop application diagnostic logs	30 days
AI assistant chat history	1 year
Commercial electronic message and sharing-with-business consent records	3 years from the end of the consent's validity (Law No. 6563)
Analytics data (anonymous)	Indefinitely (after being anonymised)

Data whose retention period has expired is deleted by automated daily jobs. Records whose retention is mandatory under the legislation (financial documents, timekeeping, consent records) are kept until their statutory period expires even upon your deletion request; they are deleted when that period expires.

7. Rights of Data Subjects

Under Article 11 of KVKK you have the following rights:

To learn whether your personal data is processed
If it has been processed, to request information about it
To learn the purpose of processing and whether it is used in accordance with that purpose
To know the third parties to whom it is transferred in Türkiye or abroad
To request its rectification if it is incomplete or inaccurate
To request its erasure or destruction under the conditions set out in Article 7 of KVKK
To request that the above actions be notified to the third parties to whom it has been transferred
To object to a result to your detriment arising from analysis exclusively by automated systems
To claim compensation for damage suffered due to unlawful processing

8. How to Apply

You may choose one of the following channels to exercise your rights:

Email: Send an email to bilgi@genu.tr with the subject line "KVKK Başvurusu" (KVKK Application).
Post: You may apply with a petition bearing your wet signature to Atatürk Mahallesi Ali Kemali Caddesi No:8 D:8 Merkez/Erzincan 24000.

Applications will be answered within 30 days at the latest after your identity has been verified. The response is free of charge; however, if the process requires an additional cost, the tariff determined by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) applies.

Your right to lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) (kvkk.gov.tr) is also reserved.