KVKK Disclosure Notice

Last updated: July 10, 2026

This notice is given under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK). Where it differs from our general Privacy Policy, this notice governs for people in Türkiye.

1. Who processes your data

The data controller is Atlodin LLC, a company established in the United States at the address shown above. Scanlayer is its product.

We have not yet appointed a representative in Türkiye. Until we do, requests under KVKK reach us directly at the contact address above, and we answer them on the same terms.

2. Which notice applies to you

Scanlayer has two kinds of user, and our role differs between them:

• Account holders — people who sign up, create QR codes and pages, and see analytics. For their data we are the data controller.
• Guests — people who scan someone else's code and land on a menu, an event album, a booking form. For most of that data the account holder decides why it is collected and we process it on their behalf; for the scan analytics and for keeping the service secure, we are the controller ourselves.

3. What we collect

From account holders: name, email address, password (stored only as a hash), interface language, and the records of what you create, your subscription and your payments.

From guests who scan a code: the time of the scan, a one-way hash of the IP address rather than the address itself, browser, operating system, device type, browser language, approximate country, region and city, the referring address, and any campaign parameters in the link.

Where a feature asks for it: name, email address, telephone number, free-text messages, uploaded photographs, booking details, and survey answers — that is, whatever the feature the account holder chose to publish requires.

Two collections deserve naming separately, because they go further than the rest:

• Table sessions used by the menu ordering feature keep the same one-way hash, not the address. It is used to keep a table's session together and to score an order for fraud risk.
• Where a guest grants it, a menu order records precise latitude and longitude with an accuracy figure, and the order is given an automated risk score. No order is refused by that score alone; a person decides.

4. Why we process it, and on what legal basis

• To provide the service, to create your account and to run your pages and codes — necessary for the performance of a contract (KVKK Art. 5/2-c).
• To bill you, keep accounting records and meet tax obligations — a legal obligation of the controller (Art. 5/2-ç).
• To measure scans, prevent abuse and fraud, keep the service secure, and improve it — our legitimate interests, where they do not override your fundamental rights (Art. 5/2-f).
• To send marketing messages, where we send them at all, and to place non-essential cookies — your explicit consent, which you may withdraw at any time (Art. 5/1).

We collect all of it electronically: through the website and the mobile app, through the page a scanned code opens, and through our servers' own logs.

5. Who we share it with

• The account holder whose code you scanned, for the data their feature collects from you.
• Our hosting and infrastructure providers, who store and move the data on our instructions.
• Our payment provider, for subscription payments. We never see or store your card number.
• Our email provider, to deliver the messages the service sends.
• Where an account holder has switched on their own analytics or advertising tag on a page, that provider receives what the tag collects. That choice is the account holder's, not ours, and it is made per page.
• Courts and public authorities, where the law requires it.

We do not sell personal data.

6. Transfer abroad

This one matters, so we state it plainly: we are not established in Türkiye and neither are our servers. Every piece of data described here is processed outside Türkiye — in the United States, where the controller is incorporated, and in the European Union, where the servers run.

Transfers of this kind are governed by Article 9 of the KVKK, which since the 2024 amendment permits them on an adequacy decision, on appropriate safeguards such as standard contractual clauses filed with the Authority, or on one of the narrow exceptions. If you need to know which basis applies to a particular transfer, ask us at the contact address above and we will tell you.

7. How long we keep it

• Scan records are deleted outright after 395 days.
• Table session records have their visitor hash and browser string erased after 180 days.
• Account data is kept while the account exists, and afterwards only as long as accounting and limitation periods require.
• Data a feature collected for an account holder — bookings, survey answers, photographs, subscriber lists — is kept until they delete it or close the account. They decide, and we act on their instruction.

8. Your rights under Article 11

You may ask us whether we process your data; what we have done with it; why; to whom it was transferred, at home or abroad; to correct it if it is wrong or incomplete; to delete it; to have corrections and deletions passed on to anyone we transferred it to; to object to a result produced solely by automated analysis; and to claim compensation for damage caused by unlawful processing.

Write to us at [email protected]. We answer within thirty days at the latest, and free of charge unless the request requires a disproportionate cost. If our answer does not satisfy you, you may complain to the Personal Data Protection Authority (KVKK) within the periods the law sets.

So that we answer the right person, tell us the email address or the page the request concerns. For a scan we cannot identify you from the record alone — the IP address is hashed, which is the point of hashing it — so we may need you to tell us enough to find what you are asking about.

9. Cookies

What we set, what it is for, and how to refuse the non-essential ones is in our Cookie Policy.

10. Changes

We update this notice when what we do with data changes. The date at the top is the version you are reading.