Privacy Notice
Version 1 · Effective date: 25 September 2026
This notice tells you how Quarified Ltd, which provides the Quarified service, processes your personal data as a data controller. It is given under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, and under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
This notice is information only. It does not ask for your approval, acceptance or consent.
1. Data controller
- Company: Quarified Ltd
- Email for data protection requests: kvkk@quarified.com
Quarified Ltd is a company incorporated in England and Wales. We have not appointed a data protection officer, as the law does not require one for our processing; please use the email address above for any data protection question.
As a data controller not established in Turkey, Quarified Ltd appoints a data controller representative in Turkey under Article 16 of the KVKK and publishes the representative's details in this section.
2. Who this notice covers
This notice covers the personal data we process on our own behalf about:
- visitors to our website;
- people who fill in the demo request form on our website;
- owners, managers and billing contacts of restaurants that use our service;
- restaurant staff who sign in to the panel (for account security only);
- people who send us a data protection request, query or complaint.
For the data of guests who order, call a waiter or leave a comment through a restaurant's QR menu, the restaurant is the data controller. Quarified Ltd processes that data on the restaurant's behalf and on its instructions, as a processor, and the restaurant's own privacy notice applies. Likewise, the employing restaurant is the controller for data about the orders and tables its staff handle.
3. What we process, why, and our lawful bases
| Who | Personal data | Purpose | Lawful basis |
|---|---|---|---|
| Website visitors | Security data: IP address, date and time of access, requested address, browser details | Keeping the service secure, preventing abuse and attacks, keeping the traffic records required by Turkish Law No. 5651 | UK GDPR Art. 6(1)(c) legal obligation and 6(1)(f) legitimate interests; KVKK Art. 5(2)(ç) and 5(2)(f) |
| Demo form users | Name; phone number and email; restaurant name; your message | Answering your request, arranging a demo and making you an offer | UK GDPR Art. 6(1)(b) steps before entering into a contract and 6(1)(f); KVKK Art. 5(2)(c) and 5(2)(f) |
| Owners, managers and billing contacts of customer restaurants | Identity, contact, job title and role; contract, invoice and payment records; correspondence | Entering into and performing the contract, invoicing, support, statutory record keeping, managing legal claims | UK GDPR Art. 6(1)(b), 6(1)(c) and 6(1)(f); KVKK Art. 5(2)(c), 5(2)(ç) and 5(2)(e) |
| Panel users (restaurant staff) | Name; email; security data: a one-way hash of the password, session cookie, failed sign-in attempts, IP address, activity records | Keeping accounts secure, preventing unauthorised access and password guessing, sending password reset emails, technical support | UK GDPR Art. 6(1)(c) (security of processing) and 6(1)(f); KVKK Art. 5(2)(ç) (data security under Art. 12) and 5(2)(f) |
| People who make a request or complaint | Identity, contact, the content of the request and correspondence | Handling your request and being able to show we did | UK GDPR Art. 6(1)(c) and 6(1)(f); KVKK Art. 5(2)(ç) and 5(2)(e) |
Where we rely on legitimate interests, our interest is running a secure service and answering the requests people send us. We have weighed this against your rights and freedoms and concluded it does not override them. You can object at any time (section 8).
Giving us your details in the demo form is voluntary, but without a way to reach you we cannot answer your request. Panel account details are needed for the account to work.
We do not intend to process health, religious or other special category data. Please do not include such information in forms or messages.
We do not use your personal data for advertising, profiling or decisions based solely on automated processing.
4. How we collect personal data
We collect personal data electronically, partly by automated means: through the forms on our website, the account and sign-in screens, email and phone correspondence, the contract process, and the access and security records our servers keep automatically. Our use of cookies and local storage is described in the Cookie and Local Storage Policy.
5. Who receives personal data
We share personal data only as far as needed for the purposes above, with:
| Recipient | Country | Purpose |
|---|---|---|
| Our server hosting provider | Germany (Frankfurt) | The servers the website and application run on |
| Neon, Inc. (on Amazon Web Services) | Germany (Frankfurt); company based in the USA | The database holding customer and user accounts |
| Resend, Inc. | USA | Sending password reset and demo request emails |
| Cloudflare, Inc. | USA and global network | Domain name (DNS) service, and storing and serving menu images |
| Our business email provider | European Union and/or USA | Holding the emails we send and receive |
| Our legal, tax and accounting advisers | United Kingdom and Turkey | Meeting legal and tax obligations, protecting our rights |
| Competent public authorities and courts | United Kingdom and Turkey | Requests and obligations arising under law |
6. International transfers
Quarified Ltd is established in the United Kingdom and our service providers are in the European Union and the USA, so personal data you provide from Turkey is transferred abroad.
Under UK GDPR, transfers to the European Union and the European Economic Area rely on the UK adequacy regulations. Transfers to the USA rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge) where the recipient is certified, and otherwise on appropriate safeguards: the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard using the email in section 1.
Under KVKK Article 9, these transfers rely first on appropriate safeguards such as the standard contracts published by the Turkish Personal Data Protection Board, which are notified to the Personal Data Protection Authority within five business days of signing. Transfers through the demo request form also rely on the explicit consent you give under KVKK Article 9(6)(a) after being told of the possible risks; its scope is set out in the Explicit Consent Text.
7. How long we keep personal data
| Data | Retention |
|---|---|
| Demo requests that do not become customers | 12 months from the last correspondence |
| Contracts, invoices and accounting records | For the contract term and at least 6 years after it ends (UK law); at most 10 years, having regard to limitation periods |
| Panel user accounts | While the account is open; deleted within 3 months of the account being closed |
| Panel activity records | 24 months |
| Security records (sign-in attempts and similar) | 12 months |
| Traffic (access) records | At least 1 and at most 2 years, under Turkish Law No. 5651 |
| Requests and complaints | 3 years after the request is closed |
When a retention period ends, the data is deleted, destroyed or anonymised in periodic destruction runs held at intervals of no more than six months, as the Turkish Regulation on the Deletion, Destruction or Anonymisation of Personal Data requires.
8. Your rights
Under UK GDPR you have the right to:
- access your personal data and receive a copy;
- have inaccurate or incomplete data corrected;
- have your data erased;
- restrict how we use your data;
- receive your data in a portable format and have it sent to another controller;
- object to processing based on legitimate interests;
- withdraw consent at any time, where we rely on it, without affecting processing that took place before;
- not be subject to decisions based solely on automated processing that significantly affect you.
Under KVKK Article 11 you also have the right to learn whether your data is processed and for what purpose, to know the third parties in Turkey or abroad it is transferred to, to ask that corrections and deletions are passed on to those third parties, to object to an outcome against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing.
9. How to make a request or complaint
Send your request to kvkk@quarified.com. We may ask for information to confirm your identity. We answer free of charge within one month under UK GDPR and within 30 days under KVKK. Requests under KVKK may also be made in writing to our registered office, or with a secure electronic or mobile signature, as the Communiqué on the Procedures and Principles of Application to the Data Controller sets out.
You have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). If you are in Turkey, you may complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your request.
If you write to us as a guest of a restaurant, we pass your request without delay to the restaurant, which is the controller, and help it answer you.
10. Changes and language
When we change this notice, we publish the new version on this page with its version number and effective date.
If the Turkish and English versions differ, the Turkish version prevails for data subjects in Turkey.