Privacy Policy

1. Data Controller

The data controller for personal data processed through GetQRMenus is Asetral, operating via https://asetral.com. For privacy enquiries, contact contact@asetral.com.

For general product or support questions unrelated to data protection, you can also reach us at contact@getqrmenus.com.

2. Scope and Roles

We provide a platform for venue owners to publish digital menus. Venue owners are responsible for the menu content they publish. Guests who scan a QR code to view a menu generally do not need to create an account.

This policy applies to venue owner accounts, platform administration, and technical processing related to public menu pages.

3. Personal Data We Collect

We may process the following categories of data:

• Account data: email address, authentication identifiers, and account timestamps when a venue owner registers.
• Business and menu content: venue name, slug, contact details, menu items, images, and configuration you choose to publish.
• Technical data: IP address, browser type, device information, access logs, and cookies or similar technologies necessary to operate and secure the service.
• Website analytics: aggregated page views and usage metrics via Google Analytics 4, when enabled, to understand how the public site is used and improve the service.
• Communications: messages you send to us by email regarding support or enquiries.
• Guest interactions (when enabled by a venue): table identifiers from QR scans, call-waiter requests, star ratings, and optional comments submitted without creating a guest account. Venues control whether these features are enabled.

4. Purposes and Legal Bases (KVKK)

Under the Turkish Personal Data Protection Law (KVKK, Law No. 6698), we process personal data based on the following grounds, as applicable:

• Performance of a contract: to provide account access, menu hosting, and related platform features.
• Legitimate interests: to maintain security, prevent abuse, improve reliability, deliver optional guest features (such as staff alerts and feedback) at a venue's request, and protect our rights.
• Legal obligation: where required by applicable law or regulatory request.
• Explicit consent: where required for optional processing, such as marketing communications if ever offered separately.

5. Hosting and International Transfers

Our infrastructure may use cloud providers located outside Türkiye, including services operated by Google (Firebase) and Vercel. Where personal data is transferred abroad, we rely on appropriate safeguards and contractual measures consistent with KVKK requirements.

6. Data Retention

We retain account and menu data for as long as your account is active or as needed to provide the service. After account closure, we may retain certain records for a limited period where required for legal, security, or dispute-resolution purposes.

7. Security

We implement administrative, technical, and organisational measures designed to protect personal data against unauthorised access, loss, or misuse. No method of transmission over the Internet is completely secure; we cannot guarantee absolute security.

8. Your Rights

Under KVKK, data subjects may have the right to learn whether data is processed, request information, ask for correction or deletion where applicable, object to certain processing, and lodge a complaint with the Personal Data Protection Authority of Türkiye (KVKK Kurumu).

To exercise your rights, contact contact@asetral.com. We may need to verify your identity before responding.

9. Sub-processors

We use trusted infrastructure providers, including Google Firebase (authentication, database, storage), Google Analytics 4 (website usage statistics, when configured), Google Forms (optional subscriber list, when you subscribe on our site), Formspree (contact form delivery), and Vercel (application hosting), solely to operate and improve the platform.

10. Changes

We may update this Privacy Policy from time to time. The latest version will be published on this page with a revised date. Continued use of the service after changes take effect constitutes acceptance of the updated policy where permitted by law.