Privacy Policy
Provider / seller details
- Legal name
- [eklenecek]
- MERSIS no.
- [eklenecek]
- Tax office
- [eklenecek]
- Tax no.
- [eklenecek]
- Address
- [eklenecek]
- Phone
- [eklenecek]
- [eklenecek]
- KEP (registered email)
- [eklenecek]
What data we process
We process the name (optional) and email you provide when creating a card, plus your stamp balance, transaction records and any optional visit rating/comment you give. We do not build advertising profiles.
Purpose and legal basis
Data is processed to run the loyalty program (performance of a contract) and, with your explicit consent, to send promotional messages. You can withdraw consent at any time.
Storage and transfers
Data is stored on infrastructure hosted in the EU (Ireland). Dokun acts as a data processor on behalf of the business that issued your card, which is the data controller. Your data is not shared with ad networks.
Your rights
You may request access, correction, export and deletion of your data. Contact the issuing business or us to exercise these rights.
Verification at the counter
Stamps and rewards are only booked with the card holder's knowledge and consent: by default, the QR code on your card is scanned at the counter. If that isn't possible, staff enter a single-use 6-digit code that only appears on your card page and is valid for 5 minutes. For every transaction we record the staff member, time and verification method (QR / code); you can see your history on your card page. Customer search at the counter shows masked details only (initials, a***@g***.com).
Business accounts (owners and staff)
For business owners and staff using Dokun we process name, email, mobile number (SMS login and verification), business and location details, role/permission data and billing details (legal name, tax number, billing address). Payment card details are entered in iyzico's secure payment form; they are never sent to or stored by Dokun. Dokun is the data controller for this data; legal bases are the conclusion and performance of the contract (KVKK Art. 5/2-c), legal obligations (tax and commercial law, Art. 5/2-ç) and our legitimate interest in service security (Art. 5/2-f).
Security logs
To protect accounts, prevent abuse and investigate incidents we keep login and activity logs: IP address, device and browser information (user agent), time of login and action, and the acting user. These logs are kept for 12 months and then deleted or anonymized; they may be retained longer while an investigation or legal request is pending. The legal basis is legitimate interest. Only authorised people can see them (owners for their own business, Dokun administrators for security reviews).
Service providers and transfers
We use sub-processors for hosting, notifications, email, SMS, bot protection and payments; the current list and transfer countries are in the Data Processing Agreement (/legal/dpa). The main database is hosted in the EU (Ireland). Transfers abroad follow KVKK Art. 9.
Retention and requests
Account data is kept while the account is open; invoices and accounting records for the statutory period (10 years under Turkish tax and commercial law). Send requests under KVKK Art. 11 to the email or KEP address on this page; they are answered free of charge within 30 days.