Privacy Policy
In brief
- Vevez is operated by VEVEZ UK LIMITED (United Kingdom), which is responsible for the data of everyone who uses Vevez.
- We process only the data needed for the service. We do not sell your data or share it with advertising networks.
- Your orders, reservations and messages are passed to the business concerned; the business is also itself responsible for them.
- You enter your card details on the payment institution's secure page; Vevez does not see your card number.
- You can delete your account in the app, access your data, and ask for it to be corrected or deleted: info@vevez.com.
This policy explains how your personal data is processed when you use the Vevez mobile app, the web menu (QR menu), Vevez websites and business tools. It has been prepared within the framework of the European Union General Data Protection Regulation (GDPR), UK data protection legislation (UK GDPR) and the rules of the countries in which we provide services. For countries whose legislation requires additional information, that information is in section 14.
1. Who are we?
Data controller: VEVEZ UK LIMITED, company no. 16278245, 124 City Road, London EC1V 2NX, United Kingdom ("Vevez", "we"). You can contact us about any matter at info@vevez.com.
Our representatives:
- European Union (GDPR Art. 27): [EU representative: name and address].
- Türkiye (data controller's representative under Turkish data protection law): Türkeli Arge Teknoloji Sanayi ve Ticaret A.Ş., Batı Mah. İsmetpaşa Cad. No: 46/1, Pendik, İstanbul.
The roles of Vevez and the business: Vevez is the data controller for your account, the operation of the app and the web menu, security, messaging, translation and reviews. The business you order from or make a reservation with is a separate data controller for the order and reservation information passed to it. When businesses use Vevez tools such as the till, order management and the customer list, Vevez processes that data on behalf of the business and on its instructions.
2. What data do we collect?
Information you give us: first name, surname, nickname, e-mail address, telephone number, password (only a non-reversible hash is stored), profile photo, addresses, language and currency preference, order contents and notes, your messages, reservation details, your reviews, ratings and photos, your invoice details and the photo of an invoice, business card or tax certificate that you upload to fill them in, and the requests you send us.
Information generated when you use the service: order and payment records (amount, result, the payment institution's transaction number), your points balance at businesses, your device's location if you allow it, device ID, device model and operating system, notification token, IP address, and session and error logs.
Information from others: the name, e-mail address and account ID that Google or Apple sends when you sign in with those services; transaction results from payment institutions; information that the business enters into the system on your behalf (for example, a table order or invoice details).
Information we do not ask for: We do not ask for special categories of data, such as data on health, religion or ethnic origin. The allergen information on the menu belongs to the products. If you have an allergy, tell the business's staff directly.
3. Why and on what legal basis do we use data?
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| To open your account and verify your identity (an SMS code to your phone, a verification code to your e-mail) | Performance of a contract |
| To pass your order and reservation to the business, show you their status and send you notifications | Performance of a contract |
| Collection of your payment by a licensed payment institution; refunds and disputes | Performance of a contract; legal obligation |
| To translate your messages and notes automatically into the other party's language | Performance of a contract |
| To show businesses near you and the map | Performance of a contract; for location, the permission you give on your device |
| Issuing the invoice in your name; reading invoice details from the photo you upload | Performance of a contract; legal obligation |
| To publish reviews, accept only reviews based on a real order and remove content that breaks the rules | Performance of a contract; legitimate interest (trustworthy reviews) |
| Security of the service, fraud prevention, debugging and improvement of the service | Legitimate interest |
| Accounting, tax and compliance with requests from official authorities | Legal obligation |
| To answer your requests and complaints and to handle legal claims | Performance of a contract; legal obligation; legitimate interest |
| Measuring how our website is used and improving it (Google Analytics, only if you give cookie consent) | Explicit consent; you can withdraw it at any time through "Cookie settings" |
| Campaign and promotional messages (only if you give consent) | Explicit consent; you can withdraw it at any time |
Where we rely on legitimate interest, you can object to that processing. We do not make any decision about you that is based solely on automated processing and that significantly affects you.
4. Who do we share data with?
- Businesses: the business you order from, make a reservation with or exchange messages with sees the information needed for that purpose.
- Vevez group companies: Vevez España S.L. (Spain), Türkeli Arge Teknoloji Sanayi ve Ticaret A.Ş. (Türkiye). For operating the service, support and software development, to the extent necessary.
- Service providers: they act only on our instructions.
Service Provider Location Servers, storage, search Microsoft Azure EU (the Netherlands), United Kingdom, USA Database DataStax EU (the Netherlands), USA Online payment Stripe; payment institutions licensed in Türkiye Country of the payment institution Telephone verification SMS Twilio United States Push notifications Google Firebase, Apple United States Translation, maps and addresses Google Cloud USA, EU Reading information from invoice and business card photos OpenAI United States Website visit statistics (only with your consent) Google Analytics (Google Ireland Limited, Google LLC) EU, USA E-mail and e-invoicing E-mail and e-invoicing service providers Depends on the service - Payment institutions: the institution that collects your payment is also a data controller in its own right for fraud prevention and its own legal obligations.
- Courier companies: if the business sends your takeaway order through a courier service, your name, telephone number, address and note, for the delivery.
- Official authorities: only where there is a legal obligation or a valid request.
- Corporate changes: if the Vevez service is transferred to another company, the data passes to the acquiring company together with the safeguards in this policy; we will notify you in advance.
5. International data transfers
Vevez provides services worldwide; your data is processed in the EU, the United Kingdom and the USA. For transfers between the EU and the United Kingdom, adequacy decisions exist on both sides. For transfers to the USA and to other countries without an adequacy decision, we rely on the EU–US Data Privacy Framework or its UK Extension where the recipient participates in it, and otherwise on the European Commission's standard contractual clauses and the UK International Data Transfer Agreement (IDTA). For transfers from Türkiye, we use standard contracts in accordance with Article 9 of the Turkish Law No. 6698 and notify the Turkish Personal Data Protection Authority. You can request a copy of these documents from info@vevez.com.
6. How long do we keep data?
| Data | Retention period |
|---|---|
| Account and profile information | For as long as your account is open. When you delete your account, your name, contact details and profile photo are deleted or anonymised so that they no longer identify you. |
| Order, payment and invoice records | For the period required by accounting and tax legislation (up to 10 years, depending on the country). Even if you delete your account, these records are kept until the legal period ends. |
| Messages, notes, reservations | For as long as needed for the service and for possible disputes; then deleted or anonymised. |
| Reviews and ratings | Until you delete them or close your account. Once your account is deleted, your reviews may remain in anonymous form. |
| System and security logs | General logs are kept for a short time and payment logs for longer; unless there is a legal requirement, for no more than 13 months. |
| Business and representative application forms | Until the application is decided; at most 12 months if it does not go ahead. |
7. Deleting your account
You can delete your account in the app at any time: My Profile > Modify Profile > Delete Account. If you cannot access the app, send an e-mail with the subject "Account deletion request" to info@vevez.com, either from the e-mail address registered to your account or stating your telephone number. Once we have verified your identity, we will delete your account within 30 days at the latest. Records that we are legally required to keep are retained for the periods set out in section 6.
8. Your rights
Depending on the rules of the country where you live, you have the right to access your data and obtain a copy of it, to request the correction of inaccurate data, to request erasure, to request the restriction of processing, to receive your data in a portable format, to object to processing based on legitimate interest and to direct marketing, and to withdraw any consent you have given. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.
Send your requests to info@vevez.com. We may ask for additional information to verify your identity. We respond to your request within one month; for complex requests this period may be extended within legal limits, and if it is, we will tell you. Where your country has its own application procedures and time limits, they are set out in section 14.
9. Complaints
If you have a complaint about your data, write to us first at info@vevez.com. We will acknowledge receipt of your complaint within 30 days, investigate it and respond without undue delay. You can also contact a data protection authority at any time: the Information Commissioner's Office (ico.org.uk) in the United Kingdom, the Turkish Personal Data Protection Authority (kvkk.gov.tr), or the data protection authority of the EU country where you live.
10. Children
A Vevez account is for people aged 18 or over. Anyone can view the QR menu without opening an account. If we learn that someone under 18 has opened an account, we will close the account. Vevez does not carry out targeted advertising aimed at children.
11. Security
We encrypt your data in transit (HTTPS), store your password in non-reversible form and ensure that only people who need the data for their duties can access it. Your card details never reach Vevez servers; they are processed on the payment institution's secure page. No system is completely risk-free; if a breach affecting your data occurs, we will notify the relevant authority within the period required by law and, where required, you.
12. Cookies and similar technologies
The cookies and similar technologies we use on our websites and in the web menu are described in the Cookie Policy. On our website, and only if you consent, we collect visit statistics with Google Analytics. Vevez does not carry out tracking for advertising purposes.
13. Changes to this policy
We update this policy when our service or the legislation changes. We announce significant changes in the app or by e-mail before they take effect. The current version is always on this page.
14. Country-specific information
The data protection legislation of some countries requires certain information to be given, in a certain form, in addition to the information in this policy. This section contains that additional information for users in those countries. If your country is not listed here, the other sections of this policy apply to you.
14.1 Türkiye: privacy notice under Law No. 6698
In brief
- When you use Vevez, the data controller for your personal data is VEVEZ UK LIMITED; its representative in Türkiye is Türkeli Arge Teknoloji Sanayi ve Ticaret A.Ş.
- We process your data to pass your order to the business, to have your payment collected, to let you communicate with the business in your own language and to run the service securely.
- We do not ask for special categories of personal data, such as health data, and we do not sell your data.
- To exercise your rights, you can write to info@vevez.com; we answer your application free of charge within 30 days at the latest.
This section is the privacy notice prepared under Article 10 of the Turkish Law No. 6698 on the Protection of Personal Data ("the Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, to inform the people who use the Vevez mobile app, the web menu (QR menu) and the websites in Türkiye. It is not a contract and does not ask for your consent. The Cookie Policy explains cookies.
14.1.1 Data controller and representative in Türkiye
Data controller: VEVEZ UK LIMITED, company no. 16278245, 124 City Road, London EC1V 2NX, United Kingdom. E-mail: info@vevez.com.
Data controller's representative: Türkeli Arge Teknoloji Sanayi ve Ticaret A.Ş., MERSİS 0877043560100001, Batı Mah. İsmetpaşa Cad. No: 46/1, Pendik, İstanbul. KEP: turkeliargeteknoloji@hs01.kep.tr.
VERBİS registration: [VERBİS registration number].
14.1.2 What data do we process, for what purpose and on what legal basis?
The table below shows each processing activity, together with the data it uses and its legal basis under Article 5 of the Law.
| Processing activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Account creation and sign-in | First name, surname, nickname, e-mail address, telephone number, a non-reversible hash of your password, verification codes, language and currency preference; when you sign in with Google or Apple, the identifier of your account with that service | To open your account, verify your identity and remember your preferences | Establishment and performance of a contract (Art. 5(2)(c)) |
| QR menu and ordering | Order contents, product notes, table or service point, amount, date and time, business; if you ordered with an account, your account | To pass the order to the business and show you its preparation and delivery status | Performance of a contract (Art. 5(2)(c)) |
| Online payment | Payment amount, result and the payment institution's transaction number. You enter your card details on the payment institution's secure payment page; Vevez does not see or store your card number or security code. | Collection of the payment by a licensed payment institution; handling of refunds and disputes | Performance of a contract (Art. 5(2)(c)), legal obligation (Art. 5(2)(ç)) |
| Messaging and translation | Your messages with the business, your order and reservation notes | To let you communicate with the business; automatic translation of what you write into the other party's language | Performance of a contract (Art. 5(2)(c)) |
| Reservation | Name, number of people, date and time, note | To pass the reservation to the business and notify you of its status | Performance of a contract (Art. 5(2)(c)) |
| Reviews, ratings and points | Your rating, your review, photos you add, your nickname; your points balance at businesses | To publish reviews, to accept only reviews based on a real order, and to run the business's points programme | Performance of a contract (Art. 5(2)(c)), legitimate interest (Art. 5(2)(f)) |
| Location and address | Your device's location, if you allow it; addresses you enter | To show businesses near you and the map, and to make it easier for you to enter addresses | Performance of a contract (Art. 5(2)(c)). You can turn off location permission at any time in your device settings. |
| Invoice details | Billing name, tax number, address, contact details; the photo of an invoice, business card or tax certificate that you upload to fill these in | Issuing the invoice in your name | Performance of a contract (Art. 5(2)(c)), legal obligation (Art. 5(2)(ç)) |
| Notifications | Device ID, notification token, device model | To send order, reservation and message notifications | Performance of a contract (Art. 5(2)(c)) |
| Security and system logs | IP address, device and app information, session and transaction logs | Security of the service, prevention of misuse and fraud, fixing errors, record-keeping obligations under the legislation | Legal obligation (Art. 5(2)(ç)), legitimate interest (Art. 5(2)(f)) |
| Requests and complaints | Your contact details, the content of your request and the correspondence | To answer your requests and to protect rights in possible disputes | Performance of a contract (Art. 5(2)(c)), legal obligation (Art. 5(2)(ç)), establishment, exercise or protection of a right (Art. 5(2)(e)) |
| Website visit statistics | Only if you give cookie consent: the pages you visit, where you came to the site from, device and browser type, approximate location (country, city), cookie identifier | To understand how our website is used and to improve it | Explicit consent (Art. 5(1)). You can withdraw your consent at any time through "Cookie settings" at the bottom of every page. |
| Business application form | Business name, type, city, e-mail address | To contact the business that wants to use Vevez | Establishment of a contract (Art. 5(2)(c)) |
Special categories of personal data: We do not ask for special categories of data, such as data on health, religion or ethnic origin. The allergen information on the menu belongs to the products; it is not data about you. Please do not write health information in your messages and notes; if you have an allergy, tell the business's staff directly.
Commercial electronic messages: If we want to send you campaign or promotional messages, we will do so only with consent that you give separately and that is registered in the Commercial Electronic Message Management System (İYS). Not giving consent does not affect your use of the service.
14.1.3 How is personal data collected?
We collect your data electronically, by automated means, through the following channels: the Vevez mobile app, the web menu (QR menu), Vevez websites, the information that Google or Apple sends us when you sign in with those services, transaction results from payment institutions, and information that the business you order from enters into the system (for example, an entry recorded for your table, or invoice details).
14.1.4 To whom is personal data transferred?
- The business you order from or make a reservation with: to prepare your order, honour your reservation and reply to you. With respect to this information, the business is itself a separate data controller.
- Vevez group companies: Vevez España S.L. (Spain), Türkeli Arge Teknoloji Sanayi ve Ticaret A.Ş. (Türkiye); for operating the service, support and software development, to the extent necessary.
- Our service providers (data processors): servers and databases (Microsoft Azure, DataStax), payments (Stripe and payment institutions licensed in Türkiye), telephone verification SMS (Twilio), push notifications (Google Firebase, Apple), translation and maps (Google), reading information from invoice and business card photos (OpenAI), website visit statistics (Google Analytics, only with your consent), and e-mail and e-invoicing services. These companies process your data only on our instructions and in order to provide services to us.
- Courier companies: if the business sends your takeaway order through a courier service, your name, telephone number, address and note, for the delivery.
- Authorised public institutions and bodies, and judicial authorities: only upon requests that they are legally authorised to make.
14.1.5 Transfers abroad
The data controller is established in the United Kingdom, and Vevez's servers are located in the European Union (the Netherlands), the United Kingdom and the United States. Your personal data is therefore transferred abroad. We make these transfers in accordance with Article 9 of the Law: where there is no adequacy decision of the Personal Data Protection Board for the recipient country, we sign with the recipient the standard contract announced by the Board and notify the Turkish Personal Data Protection Authority of it within five business days of signature. The data transferred and the purposes of the transfer are limited to those set out in 14.1.2 and 14.1.4.
14.1.6 Your rights under Article 11 of the Law
You have the right to: learn whether your personal data is processed; request information about it if it has been processed; learn the purpose of the processing and whether the data is used in line with that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request its rectification if it is incomplete or inaccurate; request its erasure or destruction under the conditions set out in the Law, and request that these actions be notified to the third parties to whom it has been transferred; object to an outcome against you that results from the analysis of your data exclusively by automated systems; and claim compensation for damage if you suffer damage because of unlawful processing.
You can delete your account in the app at any time: Profile > Edit profile > Delete account.
14.1.7 How to apply
You can submit your application in Turkish, clearly stating your identity and your request, by one of the following means:
- By a petition bearing a wet-ink signature, delivered by hand or through a notary to the address of our representative in Türkiye: Türkeli Arge Teknoloji Sanayi ve Ticaret A.Ş., Batı Mah. İsmetpaşa Cad. No: 46/1, Pendik, İstanbul;
- By registered electronic mail (KEP) to turkeliargeteknoloji@hs01.kep.tr;
- By e-mail to info@vevez.com, signed with a secure electronic signature or a mobile signature;
- By e-mail to info@vevez.com from the e-mail address registered in your Vevez account.
We conclude your application free of charge as soon as possible, depending on its nature, and within 30 days at the latest. If the action also involves a cost, we may charge only the fee in the tariff set by the Personal Data Protection Board. If you find our response insufficient, or do not receive a response in time, you may lodge a complaint with the Personal Data Protection Board.
14.1.8 Updates
We update this section when our service or the legislation changes. The current text is always on this page; we also announce important changes in the app.