Data Protection Notice (KVKK / GDPR)

Effective date:** 27 July 2026 **Website: carqrapp.com

This notice explains how CarQR processes your personal data through the mobile app, website, and public QR alert pages. It is issued under Article 10 of Turkish Law No. 6698 ("KVKK") and aligns with the EU/UK GDPR transparency obligations.

1. Data controller

Your personal data is processed by Taha Bayar (sole proprietorship — "CarQR") as the data controller.

• Data controller: Taha Bayar (sole proprietorship)
• Address: Bademlidere, 259. Cad. Eren Apt., Çankaya / Ankara

(full address shared on request)

• Tax office: Dikimevi (Türkiye)
• Email:** info@carqrapp.com · **Phone: +90 537 643 11 23

Lumina Digitale, which provides app development and infrastructure services, is a data processor under KVKK — not the controller.

2. Categories of personal data

• Identity / contact: email address; a vehicle-specific public

contact number only if separately entered by the owner.

• Vehicle data: vehicle nickname, type, colour, QR slug, alert

preferences.

• Transaction security: device notification (FCM) token; an

irreversibly hashed form of your IP address and user-agent; a hashed form of the anonymous device id minted on the public scan page.

• Notification history: predefined alerts sent/received,

timestamps, status.

• Shipping data (Premium/Ultimate physical products only): name,

delivery address, delivery phone.

• Customer / subscription: purchase status, plan and renewal

info. We do not** store card data: web payments run through the **iyzico** payment provider; any in-app purchases are billed by the **Apple App Store / Google Play.

CarQR never automatically shows the owner's account, sign-in or delivery phone to a scanner. Only if the owner separately enters a vehicle-specific number and explicitly consents after being told that anyone scanning the QR may see, copy and call it will that number be displayed.

3. Purposes of processing

• Delivering the vehicle-alert service (QR scan → owner notification).
• Account creation, authentication, and security.
• Preventing abuse, harassment, and spam (rate-limiting, device

blocking).

• Producing and shipping Premium/Ultimate physical products (QR

sticker, car scent).

• Managing subscriptions and purchases.
• Publishing an optional vehicle contact number on the public QR page

with the owner's separate explicit consent, and removing it on withdrawal.

• Sending marketing notifications only with your explicit consent.

4. Legal bases (KVKK art. 5–6 / GDPR art. 6)

• Performance of a contract: account, alert service, physical

product delivery, subscription.

• Legitimate interest: security, abuse prevention, service

improvement.

• Legal obligation: tax, accounting, e-commerce law.
• Explicit consent: through separate consent flows, for marketing

notifications and for publishing an optional vehicle contact number on the public QR page.

5. Recipients and international transfers

Data is shared, only to the extent necessary to provide the service, with:

• Infrastructure / hosting: Google Firebase / Google Cloud

(authentication, database, messaging, functions). Data may be processed on Google servers outside Türkiye (EU and/or US regions).

• Bot protection: Cloudflare Turnstile (verification token only;

no content is shared).

• Shipping / fulfillment: for physical orders, only the delivery

name/address goes to the contracted courier and print supplier.

• Payment service provider:** **iyzico for web payments; card data

is never stored by the seller. Any in-app purchases are billed by the Apple App Store / Google Play.

• Authorities: where legally required.
• QR scanners / the public internet: only the public contact number

separately approved by the owner. Recipients may be globally accessible and indeterminate; the number may be copied or screenshotted.

International transfers are carried out under KVKK art. 9 as amended by Law No. 7499 (in force 1 June 2024) / GDPR Chapter V: on the basis of an adequacy decision, or failing that, appropriate safeguards (standard contractual clauses, binding corporate rules, undertakings), or one of the derogations in art. 9. Firebase / Google Cloud transfers fall within this scope.

6. Collection method

Data is collected electronically — automatically and semi- automatically — when you use the app/website, create an account, add a vehicle, manually enter an optional public number and tick its separate consent box, when your QR is scanned, and when you order a physical product.

7. Retention

• Account and vehicle data: while the account is active.
• Public contact number and consent record: until consent is withdrawn or

the vehicle/account is deleted. The number is stored only on the vehicle consent record and the public API stops returning it on withdrawal; the withdrawal timestamp may be retained for a limited period where necessary.

• Notification history: a reasonable period for service delivery

(short by default; 6–12 months on Ultimate).

• Security/log data: limited period for abuse investigation.
• Tax/accounting records: the period required by law.

On account deletion, data outside legal retention duties is deleted or anonymised.

8. Your rights (KVKK art. 11 / GDPR art. 15–22)

You may: learn whether your data is processed; request information and access; learn the purpose and whether it is used accordingly; know the recipients; have inaccurate/incomplete data corrected; request erasure or destruction; request that corrections/erasures be notified to recipients; object to outcomes produced solely by automated analysis; and claim compensation for damages. EU/UK users also have data-portability and the right to lodge a complaint with a supervisory authority.

9. How to exercise your rights

You may submit your request: from the email address registered in our system to info@carqrapp.com; by signed letter to the address above; or via secure/mobile electronic signature. Including the email address linked to your CarQR account helps us verify the request. Requests are answered within 30 days (KVKK art. 13).

For deletion specifically, see the Data Deletion Request document.

---

Note: CarQR is not an emergency service, law-enforcement/towing service, or a guaranteed communication channel.