This Policy and privacy notice covers visitors, prospects, account users and purchasers who interact directly with Garivio. It is provided under Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the GDPR and other mandatory data-protection law.
1. Data controller
For the website, enquiries, Garivio accounts, subscriptions and billing, the data controller is the provider identified in our Distance Sales Agreement. That page is the canonical location for the provider's registered identity and office.
Privacy requests can be sent to privacy [at] garivio.com or to the registered office stated there.
2. When Garivio is a processor
A customer business is normally the controller of the employee, guest and customer information it enters into Garivio to run its venue. Garivio processes that tenant data on the business's documented instructions under the service agreement and data-processing terms. Questions about data entered by a venue should first be directed to that venue.
3. Data, purposes and legal bases
- Website and security: request logs, IP address, device/browser information, language and theme preference are processed to deliver the site, remember requested settings, prevent abuse and investigate faults. The bases are Garivio's legitimate interests under KVKK Art. 5/2(f) and, where applicable, legal obligations.
- Contact and demo requests: name, email, business name, enquiry subject and message are processed to reply, qualify the request and take steps toward a contract. The bases are KVKK Art. 5/2(c) and legitimate interests under Art. 5/2(f).
- Product updates: email address, subscription time, confirmation and unsubscribe record are processed only when updates are requested. The basis is explicit consent under KVKK Art. 5/1; consent can be withdrawn at any time without affecting earlier lawful processing.
- Account and service: identity/contact details, login and security records, authorised business membership, configuration and support history are processed to create, secure and perform the service contract. The bases are KVKK Art. 5/2(c), establishment/exercise/protection of rights under Art. 5/2(e), and legitimate interests under Art. 5/2(f).
- Orders, billing and payments: purchaser and invoice identity (an individual's Turkish ID number, or a company's tax number and tax office), address, products, amount, currency, payment status, provider reference, refund/dispute status and legally required financial records are processed to form and perform the contract, collect payment, prevent fraud, issue documents and meet tax/accounting duties. The bases are KVKK Art. 5/2(c), legal obligation under Art. 5/2(ç), and Art. 5/2(e).
We do not use personal data for a materially incompatible purpose without providing the required new notice and legal basis.
4. Optional Sign in with Google
If you choose Sign in with Google, Google authenticates you and may provide Garivio with your stable Google account identifier, email address, email-verification status and basic profile information such as your name and profile picture. Garivio uses this information only to authenticate you, protect account access, find an already linked sign-in method, initialize an empty Garivio profile picture as described below and, where the verified email matches an existing Garivio account, ask that account owner to approve linking explicitly.
Garivio retains the Google account identifier, provider and verified-email details, linking status, authentication timestamps and related security records. If your Garivio profile has no picture, Garivio may copy the picture supplied by Google once and store that copy as your Garivio profile picture; it never replaces an existing picture, does not retain the Google picture URL, and will not restore the picture after you change or remove it. Your name is not overwritten from Google. Short-lived authentication and linking records are deleted under the security-retention schedule described below.
Google sign-in is optional. We do not request or access your Gmail messages, contacts, Google Drive files or other Google service content, and Google does not receive your Garivio password. You may continue using your Garivio email and password. Your interaction with Google is also governed by Google's Privacy Policy.
5. Payment processing
Garivio never receives your card details: they are entered only on the payment page of the provider that takes the payment.
- Website, in Türkiye — iyzico. Card details are entered on iyzico's secure page and handled by iyzico. If you save a card for automatic renewal, iyzico stores it and gives us a token; we keep only the card's brand, last four digits and expiry date. We keep the transaction identifiers, result, amount and limited payment metadata needed for accounting, support, fraud handling, refunds and disputes. Our e-Arşiv and e-Fatura invoices carry your billing identity and are reported to the Turkish Revenue Administration (GİB) as the law requires.
- Website, outside Türkiye — Paddle. Paddle.com is the Merchant of Record for these orders and processes your name, e-mail, billing address, payment and tax details as an independent controller under Paddle's privacy notice. Paddle shares with us the order, subscription and contact details we need to provide and support the service.
- App Store and Google Play. Apple or Google processes the purchase under its own privacy policy. We receive the store's purchase and subscription records — product, term, status and transaction identifiers, but no card details — to switch on what you bought.
Never send full card details by e-mail or through a contact form. Each payment provider acts under its own privacy and regulatory obligations for the payment data it controls.
6. Recipients and transfers
We do not sell personal data. Relevant data may be disclosed, only as needed for the stated purpose, to:
- hosting, infrastructure, security, communications, email and authorised support providers;
- Google, when you voluntarily use Google as an authentication provider;
- iyzico and participating banks/card schemes for payment, fraud, refund and dispute processing;
- Paddle, for website orders placed outside Türkiye, where Paddle is the Merchant of Record;
- Apple and Google, for purchases made in the App Store or Google Play;
- the Turkish Revenue Administration (GİB) and our e-invoicing provider, for legally required e-Arşiv and e-Fatura invoices;
- accountants, auditors and professional advisers bound by confidentiality; and
- courts, regulators, tax authorities and other public bodies where lawfully required.
If a service provider processes data outside Türkiye, the transfer is made only where a KVKK Art. 9 transfer mechanism and any other legally required safeguard applies. Information on the relevant recipient group and transfer mechanism can be requested through the privacy contact above.
7. Collection methods
Data is collected electronically when you browse the site, submit a form, subscribe, create or use an account, choose an enabled external authentication provider such as Google, place an order, pay through iyzico or Paddle, buy in the App Store or Google Play, contact support or when authorised systems generate service/security records. Explicit consent, where required, is requested separately from this notice and is not bundled with acceptance of the service.
8. Retention
We retain each record only for its purpose and any mandatory limitation, tax, accounting, payment, distance-sale and evidence period. Enquiries are deleted or anonymised when they are no longer reasonably needed for the relationship; newsletter contact data is kept until unsubscribe, with a minimal suppression record retained to respect the request; account data is kept for the subscription and the applicable post-contract legal period; payment and invoice records are kept for the statutory financial and transaction-record periods. Linked Google identifiers are retained while the sign-in method remains linked. External-authentication transactions are deleted after 7 days, account-link requests after 30 days and related authentication-security events after 365 days. Data is then securely deleted or anonymised unless a legal claim, investigation or preservation duty requires longer retention.
9. Your rights and application route
Under KVKK Art. 11 you may ask whether your data is processed; request information, correction or deletion where the legal conditions apply; learn the purpose, recipients and transfers; object to a result produced exclusively by automated analysis; and claim compensation for unlawful processing. Where the GDPR applies, its access, rectification, erasure, restriction, portability, objection and complaint rights also apply.
Send a request identifying the right and enough information to verify the requester to privacy [at] garivio.com or the registered office linked in section 1. Do not send card security data. We answer within the legally required period; a fee is charged only where law permits it. You may also complain to the Turkish Personal Data Protection Authority or another competent supervisory authority.
10. Cookies and security
Essential preference storage and any configured cookieless, aggregate analytics are described in the Cookie Policy. We do not use advertising or cross-site tracking pixels on this site. Technical and organisational safeguards are summarised in our Security overview.
11. Changes
We update this notice when processing changes. The date above identifies the current version. Material changes are announced through an appropriate channel before they take effect where law requires it.
Questions? Email privacy [at] garivio.com, or read our Terms of Service.