GDPR / KVKK Privacy Notice
v2.0·
1. Data Controller
In accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the GDPR, Bosvara OÜ ("Davetin"), incorporated in Estonia, acts as the Data Controller regarding the personal data processed through the Davetin.app platform ("Service").
Contact: info@davetin.app
Address: Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia
This Privacy Notice applies to your personal data processed in your capacity as an Account Holder (registered user/agency) using Davetin.app. Regarding the Guest Data you upload to the platform, Davetin's role is explained separately in Section 7.
2. Categories of Processed Personal Data
In your capacity as an Account Holder, the following categories of your personal data are processed:
• Identity Information: First name, last name
• Contact Information: Email address, phone number (if applicable)
• Customer Transaction Information: Account activity, purchase/subscription records
• Financial Information: Billing information (processed via Stripe; your card details are not stored by Davetin)
• Transaction Security Information: Password (hashed), IP address, session/log records
• Marketing Information: Cookie records, usage analytics (if you provide consent)
3. Purposes and Legal Grounds for Processing Personal Data
Your personal data is processed within the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK, for the following purposes:
| Processing Purpose | Legal Ground (KVKK Art. 5) |
|---|---|
| Creating your account, providing your access to the Service | Directly related to the establishment or performance of a contract (Art. 5/2-c) |
| Executing payment/billing transactions | Performance of a contract and legal obligation (Art. 5/2-c, Art. 5/2-ç) |
| Managing requests and complaints, customer support services | Performance of a contract / legitimate interest (Art. 5/2-c, Art. 5/2-f) |
| Improving service quality, usage analytics | Legitimate interest of the data controller (Art. 5/2-f) |
| Executing information security processes, fraud prevention | Legitimate interest of the data controller (Art. 5/2-f) |
| Fulfilling legal obligations (tax, accounting, regulatory compliance) | Explicitly stipulated by laws / legal obligation (Art. 5/2-a, Art. 5/2-ç) |
| Marketing communications (email newsletters, etc.) | Explicit consent (Art. 5/1) |
4. Method of Personal Data Collection
Your personal data is collected electronically, through fully or partially automated means, when you register on the Davetin.app web/mobile platform, use your account, make payments, and communicate with us via customer support channels.
5. Parties to Whom Personal Data May Be Transferred and Purposes of Transfer
Your personal data may be transferred to the following parties, limited to the realization of the purposes stated above and in compliance with the conditions specified in Articles 8 and 9 of the KVKK:
• Payment service provider (Stripe) — for the purpose of executing payment transactions,
• Cloud hosting and infrastructure providers (AWS, etc.) — for the purpose of securely storing data,
• Email/communication infrastructure providers (Resend, AWS SES, etc.) — for the purpose of delivering transactional notifications,
• Authorized public institutions and organizations — for the purpose of fulfilling legal obligations, only upon legal request,
• Legal, financial advisory, and auditing consultants — for the purpose of fulfilling legal obligations.
6. Cross-Border Data Transfer
Bosvara OÜ is a company incorporated in Estonia, a member of the European Union, and the technical infrastructure (servers, databases) of the Service is located within the borders of the European Union (e.g., AWS eu-central-1 region).
Therefore, your access to the Service from Turkey and the processing of your personal data by Davetin require your personal data to be transferred to and stored on servers located in the European Union, outside of Turkey.
In accordance with Article 9 of the KVKK, the cross-border transfer of personal data is possible; (i) with the explicit consent of the data subject, or (ii) in the presence of adequate protection in countries declared by the Personal Data Protection Board ("Board"), or if an adequate protection is committed to and the Board's permission is obtained.
By accepting the Explicit Consent Text presented while registering on Davetin.app and/or when starting to use the Service, you give your explicit consent for your personal data to be transferred to, processed, and stored on servers located in the European Union (such as Estonia and/or EU countries like the AWS eu-central-1 region) for the purposes described above. You may withdraw this consent by closing your account or contacting us; however, in this case, it may not be possible for you to use the Service.
7. Davetin's Role Regarding Guest Data
Regarding the first name, phone number, email address, RSVP status, dietary preferences, and plus-one information ("Guest Data") belonging to your guests that you upload to the platform for the purpose of sending invitations:
• You (Account Holder/Agency) bear the title of Data Controller under the KVKK,
• Davetin is in the position of a service provider (Data Processor) acting solely on your instructions regarding this data.
Before uploading your guests' personal data to the platform, it is your responsibility to provide the necessary privacy notice under the KVKK and obtain their explicit consent if necessary (especially for communication via WhatsApp/SMS). Davetin does not provide any legal advice to Account Holders in this regard.
8. Your Rights Under Article 11 of the KVKK
In accordance with Article 11 of the KVKK, we would like to state that you have the following rights by applying to the Data Controller:
a) To learn whether your personal data is processed,
b) To request information if your personal data has been processed,
c) To learn the purpose of processing your personal data and whether they are used appropriately for their purpose,
ç) To know the third parties to whom your personal data is transferred domestically or abroad,
d) To request the rectification of your personal data in case of incomplete or incorrect processing,
e) To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK,
f) To request notification of the operations carried out pursuant to subparagraphs (d) and (e) to third parties to whom your personal data has been transferred,
g) To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,
ğ) To demand the compensation of the damage in case you suffer damage due to the unlawful processing of your personal data.
Method of Application
To exercise your rights above, you may submit your request in writing, along with documents verifying your identity, to info@davetin.app. Your application will be concluded free of charge within 30 (thirty) days at the latest depending on its nature; if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
9. Data Security Measures
Davetin takes appropriate technical and administrative measures, including encryption (at rest and in transit), access authorization controls, and regular security audits, to prevent the unlawful processing of and access to your personal data, and to ensure data preservation.
10. Changes to the Privacy Notice
This Privacy Notice may be revised in line with changes in legal regulations or updates to the Service. The current text will always be accessible via Davetin.app.
11. Contact
For your applications under the KVKK: info@davetin.app
Bosvara OÜ (Data Controller)
Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551