Notice on the Processing of Location Data

Notice on the Processing of Location Data

We use your location when you verify a product. Below we explain plainly why we do this, where your information stays, and who sees what.

How does your location protect you?

xBarkod verification does not only check whether a QR or PIN code exists in the system. Unusual situations — such as the same label being used in places far apart within a short time — are also evaluated. For example, the same label being verified in Istanbul and Berlin on the same day is an important security signal that the label may have been copied. This information is a large part of what protects you from counterfeits.

Manufacturers can also see which regions their products reach, which helps them identify where counterfeiting concentrates.

Legal ground

Your location data is processed for reliable verification of product authenticity, detection of copied labels and misuse attempts, and protection of platform security. This processing is based on Article 5/2-f of Law No. 6698: processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms.

When is it collected?

• Only while you are verifying a product.
• Background location tracking is never performed.
• Your location is not collected while you are not using the app.

Why can't verification work without location?

xBarkod's verification system uses a security model that evaluates the QR/PIN data together with the time and geographic consistency of the verification. Without current location data, the geographic consistency check cannot be completed and the system cannot produce a reliable authenticity result. Therefore, verification cannot be started or completed when access to device location is not provided.

Who sees what?

• The manufacturer: sees information only at province and district level.
• xBarkod: keeps the scan record with more detailed location for counterfeit investigation. Only authorised personnel can access these records and every access is logged.
• Your location is never used for advertising or sold to third parties.

This processing is not based on explicit consent

Processing of location data for this purpose is based on the legitimate interest ground explained above, not on your explicit consent; therefore there is no separate "withdrawal of consent" action. You may choose not to grant, or later revoke, location access on your device; in that case no new location is collected, but the authenticity verification service cannot be used. You may exercise your rights under Article 11 of KVKK at any time.

For questions: kvkk@xbarkod.com