This Privacy Notice is issued under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1. The data controller

Nivorbit Teknoloji Limited Şirketi (Nivorbit Teknoloji Limited Sirketi), a limited liability company registered in Türkiye, Sarıcaeli Köyü, Sarıcaeli Küme Evleri No: 29 İç Kapı No: 109, Merkez / Çanakkale · MERSİS 0631151313600001 · Trade registry Çanakkale / 9575 · Tax office/no Çanakkale VD 6311513136 · Phone +90 533 399 64 86

For your Punchla account, your app preferences and your visit to punchla.com, the company above is the data controller. Every business whose card you carry is a separate data controller for its own loyalty programme; Punchla processes punches, rewards and visit records as a data processor on that business's instructions.

2. The data we process

Identity and contact: name, e-mail address, telephone number, birthday (if you give one).

Transaction security: sign-in records, session and device information, IP address.

Customer transactions: punches, rewards, time of visit, branch visited, amount spent (where the business enters it).

Marketing: notification permissions and the notification token.

For business owners and staff, additionally: business name and branch addresses, invoicing and delivery details, plan and payment outcome, trial record.

Your card details never reach Punchla; payment is taken on the licensed payment institution's own page.

3. Why we process it

To open your account and verify you at sign-in; to run the loyalty card and work out reward entitlement; to keep the card current in your wallet and deliver card updates; to deliver the campaign notifications you have allowed; to provide, invoice and deliver the service to businesses; to answer support requests; to keep the service secure and prevent abuse; to meet our legal obligations.

4. How we collect it, and the legal grounds

Data is collected electronically through the app, the platform, the website and the NFC device on the counter. Legal grounds: performance of a contract (KVKK Art. 5/2-c); compliance with a legal obligation — invoices and accounting records (Art. 5/2-ç); legitimate interests — security, prevention of abuse and improvement of the service (Art. 5/2-f); explicit consent for campaign notifications and marketing cookies (Art. 5/1).

5. Transfers

Hetzner Online GmbH (Falkenstein, Germany) for hosting; Apple Inc. and Google LLC for wallet cards and notifications; a licensed payment institution for payments (iyzico in Türkiye); Paddle.com Market Limited (London, United Kingdom), our online reseller and the Merchant of Record for orders from businesses in every market except Türkiye, for payment, tax and invoicing; our provider for e-mail delivery; competent public authorities only upon a lawful request. Transfers abroad are made under Article 9 of the KVKK, on the standard contract published by the Board and notified to it.

6. How long we keep it

Account and card data: while the account is open; deleted or anonymised within 30 days of the account being deleted.

Invoices and accounting records: 10 years, as the law requires.

Sign-in and audit records: 2 years.

Trial record: not the e-mail address itself but an irreversible digest of it (HMAC) made with a secret key held on our server, kept after the account is deleted. Its purpose is to stop the free trial being taken again and again by opening and closing accounts (Art. 5/2-f). It contains no address, name or other detail, cannot identify you and is used for nothing else, marketing included.

When a business leaves, the punch records of its programme are deleted or anonymised on that business's instructions.

7. Your rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties to whom it is transferred at home or abroad; to request correction where it is incomplete or wrong, and erasure or destruction where the conditions are met; to request that these steps be notified to the third parties the data was transferred to; to object to a result against you produced solely by automated analysis; and to claim compensation where unlawful processing causes you loss.

Send your request to privacy@punchla.com or by the means set out in the Communiqué on the Procedures and Principles of Application to the Data Controller; requests are answered within 30 days at the latest. There is no charge, unless the response requires a separate cost, in which case the tariff set by the Board may apply.

8. Effect

When this notice is updated, the new version is published on this page. Effective date: Sep 29, 2026