Privacy Notice (KVKK)

1. Data Controller

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by Zirve Kurye acting as the data controller, within the scope described below.

2. Personal Data Processed

The following personal data is processed on the platform:

• Name, surname, phone number, email address (user account)
• Delivery address, recipient name and phone number (order information)
• Courier real-time location (only while the courier app is open in the foreground; detailed in §7 below)
• Delivery zone and neighborhood information (for courier assignment)
• Invoice image (temporarily sent to an AI service during order creation; explained in §8)
• Transaction history and order records
• Device token information (for push notifications)

3. Purposes of Processing

• Carrying out the delivery service and managing orders
• Courier assignment and management of operational processes
• Creating and securing user accounts
• Performing payment and courier compensation calculations
• Fulfilling legal obligations
• Platform security and error monitoring

4. Sharing of Personal Data

Your personal data may be shared with cloud infrastructure providers (server hosting), push notification service providers, mapping and routing services (Google Maps Platform), the AI service used for invoice reading (Google Gemini API), and, where legally required, competent public authorities. Where data is transferred abroad, the safeguards under Article 9 of the KVKK are applied. See the Data Processing Agreement for the full list of subprocessors.

5. Retention Period

Your personal data is deleted, destroyed, or anonymized once the purpose of processing no longer applies or the legal retention period has expired. Order records are retained for 10 years under applicable legal obligations.

6. Your Rights as a Data Subject

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is being processed
• Request information about processed personal data
• Learn the purpose of processing and whether it is used accordingly
• Know the third parties to whom data is transferred, domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion under the conditions set out in Article 7 of the KVKK
• Object to processing

To exercise your rights, you may email kvkk@zirvekurye.com.

7. Courier Location Data

Real-time location of users of the courier app is processed only while the app is open in the foreground. Location processing stops entirely when the app is backgrounded or closed — no background location tracking is performed.

• Purpose of processing: Optimizing order distribution — assigning orders to the nearest or en-route courier.
• Processing frequency: Location is updated approximately every 30 seconds while the app is open in the foreground.
• Retention: Only the most recent location is stored and overwritten with each update. Location history (breadcrumbs) is not retained.
• Legal basis: KVKK Art. 5/2-(f) — legitimate interest (carrying out delivery operations) and Art. 5/2-(c) — performance of a service contract.
• Declining: If device location permission is denied, the app continues to function; only the en-route order assignment feature is disabled.

8. Automatic Order Creation from Invoice Images

Store users can photograph a printed invoice to automatically fill in order fields. This feature works as follows:

• The invoice image is temporarily sent to a third-party AI service (Google Gemini API) to extract recipient information (name, phone, address, amount).
• The invoice image is not stored on Zirve Kurye servers — only the extracted fields (recipient name, phone, address, invoice amount) are saved as order data.
• Retention of the image by the AI service provider is subject to that provider's own policy; see the Google Gemini API terms of service.
• This feature is optional — order fields can always be filled in manually instead.