Data processing agreement

This page shows the English summary. The full, binding text is in Turkish. Read the full Turkish text

• Roles: the café (Merchant) is the data controller (veri sorumlusu) for its customers' data. Stampul is the data processor (veri işleyen) and acts only on the café's instructions (KVKK Art. 3, Art. 12/2).
• Data: first name, optional phone number, card and stamp history, device/pass identifiers (push tokens), and marketing-consent records. No special-category data.
• Purposes: running the stamp card, sending pass updates, sending promotions only to customers who opted in, and giving the café reports about its own customers.
• Stampul promises: no use of customer data for its own purposes, no cross-café profiles, confidentiality of staff, security measures (encryption, access control, logs, backups), help with customer requests, and notice to the café without delay and within 24 hours of a breach so the café can meet the Board's 72-hour expectation.
• Sub-processors: listed in Annex 2 (hosting, push, e-mail/SMS, etc.). Stampul gives 30 days' notice before adding one; the café may object and terminate.
• Transfers abroad: some sub-processors are abroad (e.g. hosting in Germany, Apple push in the US). Stampul uses the KVKK standard contracts (Art. 9, as amended by Law 7499) and notifies the Board within 5 business days. ⚖️
• End of contract: customer data is exported on request and deleted or anonymised within 30 days of account closure, except data Stampul must keep by law.
• ⚖️ The whole split only holds if Stampul never uses end-customer data for its own purposes. If the product adds network features (a customer seeing cards from many cafés, network marketing), this agreement must be revisited.