This Policy and privacy notice covers visitors, prospects, account users and purchasers who interact directly with Garivio. It is provided under Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the GDPR and other mandatory data-protection law.
1. Data controller
For the website, enquiries, Garivio accounts, subscriptions and billing, the data controller is the provider identified in our Distance Sales Agreement. That page is the canonical location for the provider's registered identity and office.
Privacy requests can be sent to privacy [at] garivio.com or to the registered office stated there.
2. When Garivio is a processor
A customer business is normally the controller of the employee, guest and customer information it enters into Garivio to run its venue. Garivio processes that tenant data on the business's documented instructions under the service agreement and data-processing terms. Questions about data entered by a venue should first be directed to that venue.
3. Data, purposes and legal bases
- Website and security: request logs, IP address, device/browser information, language and theme preference are processed to deliver the site, remember requested settings, prevent abuse and investigate faults. The bases are Garivio's legitimate interests under KVKK Art. 5/2(f) and, where applicable, legal obligations.
- Contact and demo requests: name, email, business name, enquiry subject and message are processed to reply, qualify the request and take steps toward a contract. The bases are KVKK Art. 5/2(c) and legitimate interests under Art. 5/2(f).
- Product updates: email address, subscription time, confirmation and unsubscribe record are processed only when updates are requested. The basis is explicit consent under KVKK Art. 5/1; consent can be withdrawn at any time without affecting earlier lawful processing.
- Account and service: identity/contact details, login and security records, authorised business membership, configuration and support history are processed to create, secure and perform the service contract. The bases are KVKK Art. 5/2(c), establishment/exercise/protection of rights under Art. 5/2(e), and legitimate interests under Art. 5/2(f).
- Orders, billing and payments: purchaser and invoice identity, address, tax details, plan, amount, currency, payment status, provider reference, refund/dispute status and legally required financial records are processed to form and perform the contract, collect payment, prevent fraud, issue documents and meet tax/accounting duties. The bases are KVKK Art. 5/2(c), legal obligation under Art. 5/2(ç), and Art. 5/2(e).
We do not use personal data for a materially incompatible purpose without providing the required new notice and legal basis.
4. Payment processing
When paid checkout is enabled, online payments are processed by iyzico. In the hosted iyzico payment flow, card credentials entered into the provider's secure form are handled by iyzico; Garivio receives and retains the transaction identifiers, result, amount and limited payment metadata needed for accounting, support, fraud handling, refunds and disputes. The current marketing Contact form does not collect card details or complete a paid order. Never send full card details by email or through a contact form. iyzico acts under its own privacy and regulatory obligations for the payment data it controls.
5. Recipients and transfers
We do not sell personal data. Relevant data may be disclosed, only as needed for the stated purpose, to:
- hosting, infrastructure, security, communications, email and authorised support providers;
- iyzico and participating banks/card schemes for payment, fraud, refund and dispute processing;
- accountants, auditors and professional advisers bound by confidentiality; and
- courts, regulators, tax authorities and other public bodies where lawfully required.
If a service provider processes data outside Türkiye, the transfer is made only where a KVKK Art. 9 transfer mechanism and any other legally required safeguard applies. Information on the relevant recipient group and transfer mechanism can be requested through the privacy contact above.
6. Collection methods
Data is collected electronically when you browse the site, submit a form, subscribe, create or use an account, place an order, use an enabled iyzico payment flow, contact support or when authorised systems generate service/security records. Explicit consent, where required, is requested separately from this notice and is not bundled with acceptance of the service.
7. Retention
We retain each record only for its purpose and any mandatory limitation, tax, accounting, payment, distance-sale and evidence period. Enquiries are deleted or anonymised when they are no longer reasonably needed for the relationship; newsletter contact data is kept until unsubscribe, with a minimal suppression record retained to respect the request; account data is kept for the subscription and the applicable post-contract legal period; payment and invoice records are kept for the statutory financial and transaction-record periods. Data is then securely deleted or anonymised unless a legal claim, investigation or preservation duty requires longer retention.
8. Your rights and application route
Under KVKK Art. 11 you may ask whether your data is processed; request information, correction or deletion where the legal conditions apply; learn the purpose, recipients and transfers; object to a result produced exclusively by automated analysis; and claim compensation for unlawful processing. Where the GDPR applies, its access, rectification, erasure, restriction, portability, objection and complaint rights also apply.
Send a request identifying the right and enough information to verify the requester to privacy [at] garivio.com or the registered office linked in section 1. Do not send card security data. We answer within the legally required period; a fee is charged only where law permits it. You may also complain to the Turkish Personal Data Protection Authority or another competent supervisory authority.
9. Cookies and security
Essential preference storage and any configured cookieless, aggregate analytics are described in the Cookie Policy. We do not use advertising or cross-site tracking pixels on this site. Technical and organisational safeguards are summarised in our Security overview.
10. Changes
We update this notice when processing changes. The date above identifies the current version. Material changes are announced through an appropriate channel before they take effect where law requires it.
Questions? Email privacy [at] garivio.com, or read our Terms of Service.