Privacy Policy

1. Data Controller

This Privacy Policy governs how personal data collected through the Birtusla platform — operated by ELEKTRONIX TEKNOLOJI URUNLERI ANONIM SIRKETI (hereinafter "Birtusla" or the "Company") — is processed.

2. Personal Data Collected

The following categories of personal data are collected through the Birtusla platform:

• Identity information: First name, last name
• Contact information: Phone number, email address
• Address information: Delivery address, geolocation (latitude/longitude)
• Order information: Order details, payment method preference, order notes
• WhatsApp profile data: WhatsApp profile name
• Transactional information: Order history, delivery records

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Receiving, preparing and delivering orders
• Sending order status notifications via WhatsApp
• Courier assignment and delivery tracking
• Customer support and communication
• Managing payment processes
• Improving service quality
• Compliance with legal obligations

4. WhatsApp Messaging and Meta Platforms

Birtusla uses the WhatsApp Business API to power its ordering flows. The WhatsApp infrastructure is provided by Meta. Meta acts as a data processor on Birtusla's instructions for certain processing activities, and as an independent data controller under its own privacy policy for others. The relevant entities are:

• Meta Platforms Ireland Limited — the responsible entity for processing concerning users in the European Union
• Meta Platforms, Inc. — the responsible entity for processing concerning users in other regions (US-based)
• WhatsApp LLC — messaging service provider

WhatsApp-related data flows:

• Messages are transmitted through Meta's infrastructure
• Order status notifications (confirmation, preparation, delivery) are sent as transactional messages
• Order and invoice records are retained for the statutory retention period (typically 5 years) under tax legislation (Turkish Tax Procedure Law)
• Message content is retained for a maximum of 6 months from the completion of the related order; at the end of this period it is deleted or anonymized
• Marketing messages are sent only with separate, explicit consent
• All data is processed in accordance with Meta's WhatsApp Business Policy

Cross-border data transfer: In the course of using the WhatsApp Business API, your personal data may be transferred to and processed on servers located outside Türkiye (including in the European Union and the United States) through the Meta entities listed above. Such transfers are carried out pursuant to Article 9 of Law No. 6698 on the Protection of Personal Data (KVKK), based on your explicit consent or other appropriate safeguards stipulated under the Law.

For details on Meta-side data handling, see: Meta Privacy Policy and WhatsApp Privacy Policy.

5. Explicit Consent

When you send your first message to the Birtusla order line, you are asked for explicit consent to process your personal data. The order flow does not start without your approval. You may withdraw your consent at any time.

6. Location Data

For delivery orders, your location information is used solely to determine your delivery address. Sharing location is fully optional; you may instead enter your address as free text. Your location data is not shared with third parties.

7. Data Sharing

Your personal data may be shared with the following parties:

• The business: The business you ordered from (order details, address, phone)
• Courier: Information necessary for delivery (name, phone, address)
• Meta / WhatsApp: As the underlying messaging infrastructure provider
• Legal authorities: When legally required

Your personal data is never sold to third parties for advertising or marketing under any circumstances.

8. Data Retention

Your personal data is retained for as long as required by the purposes for which it is processed. Order data is retained for at least 5 years under Turkish tax legislation. After an active customer relationship ends, your data is anonymized or deleted.

Inbound WhatsApp message content is automatically deleted from the database after 180 days. This deletion is performed by a daily scheduled job and recorded in audit logs.

9. Data Security

Technical and administrative measures are in place to safeguard your personal data. Data is transmitted over encrypted connections (SSL/TLS), access is restricted via authorization, and regular security audits are performed.

Sensitive API credentials (WhatsApp access tokens, app secrets) are encrypted at rest using AES-256-GCM. The encryption master key is stored in environment variables, separate from the database.

Spam and abuse prevention: Excessive messages from the same number within a short time window are automatically rate-limited and silently dropped without response.

10. Your Rights (KVKK Article 11)

Under Turkish Law on the Protection of Personal Data No. 6698 (KVKK), you have the following rights:

• To learn whether your personal data is processed
• To request information about such processing
• To learn the purpose of processing and whether it is used in accordance with that purpose
• To learn the third parties to whom data has been transferred, in Türkiye or abroad
• To request correction of incomplete or inaccurate data
• To request deletion or destruction of your data
• To object to automated decisions that produce an adverse outcome for you
• To claim damages caused by unlawful processing

To exercise your rights, contact info@birtusla.com or elektronix@hs01.kep.tr.

For step-by-step deletion instructions, see: Data Deletion Instructions.

11. Changes

This Privacy Policy may be updated from time to time. Users will be informed of material changes. The current version is always published on this page.