Privacy Notice

Privacy Notice

Data Controller: xBarkod Teknoloji A.Ş. ("xBarkod")

In accordance with Law No. 6698 ("KVKK"), we inform you about the processing of your personal data.

This is a notice, not an agreement; it is not submitted for your approval.

1. Personal Data Processed

• Identity and Contact: Name, phone number, email address (if provided)
• Transaction Security: IP address, device information, session data, scan records
• Location Data: Device location during product verification (see section 4)
• Points and Coupons: Points earned/spent, coupons received

No payment is taken through the mobile app; therefore no card or payment data is processed.

2. Purposes of Processing

• Providing product verification and anti-counterfeiting services
• Membership and account management
• SMS identity verification (OTP)
• Operating the points programme and delivering coupons
• Providing customer support
• Fulfilling legal obligations
• Counterfeit investigation and platform security

3. Data Transfers

• SMS service provider (Netgsm — OTP verification)
• Cloud infrastructure providers (Heroku, AWS — data storage)
• Notification infrastructure (Expo Push — device push token)
• The product's manufacturer (province/district level information of the verification event only)
• Authorized public institutions (when legally required)

4. Location Data

We use your device location during product verification. A detailed explanation is provided in the "Notice on the Processing of Location Data". In summary:

• Location is collected only while you verify a product; background tracking is never performed.
• The legal ground is legitimate interest under KVKK Art. 5/2-f (counterfeit detection and platform security). This processing is not based on explicit consent.
• The manufacturer sees only province and district level information.
• Your location is never used for advertising or sold to third parties.

5. Legal Grounds

Your data is processed under Article 5/2 of KVKK: performance of a contract, legal obligations, and legitimate interests. Commercial electronic messages are sent only with your separate consent, which you may withdraw at any time.

6. Storage and Security

• Server location: Europe (EU) region — Heroku platform
• Encryption: Passwords stored as bcrypt hashes; traffic encrypted with HTTPS (TLS 1.2+)
• Retention: Active account duration + statutory retention periods after deletion
• Detailed location records are accessible only to authorised personnel and every access is logged

7. Your Rights

Under Article 11 of KVKK you may learn whether your data is processed, request information and correction, request deletion, object to automated decisions, and claim compensation. You can review your permissions, turn off marketing messages, and delete your account from the "My Agreements and Permissions" section in the app.

8. Children's Privacy

xBarkod services are not directed at individuals under 18. We do not knowingly collect data from users under 18.

9. Contact

To exercise your rights, write to kvkk@xbarkod.com. Your request will be resolved within 30 days at the latest.