KVKK Clarification Text · davetliler.com

Data controller

PLANİS MÜHENDİSLİK DANIŞMANLIK İNŞAAT SANAYİ VE TİCARET LİMİTED ŞİRKETİ is the controller responsible for processing your data. The address, MERSIS number, and remaining identity details are on the Contact page.

Send any question about this text to info@davetliler.com.

What you give us as a host

Account: your name, your email address, and an irreversible hash of your password. If you sign in with Google, the account identifier, email address and verification status, name, profile photo, and account language Google passes to us.
Invitation content: the name of the occasion, its date, time, venue, schedule, the words you write, and the design you pick.
Location search: the text you type when you search for a venue or an address, the country derived from your IP address and, if you allow location access, your device’s location. This applies to visitors who search without an account as well.
Payment and invoicing: name, surname, email, and billing address. We also record your IP address at the time of payment, the country derived from it, and your browser’s time zone. Your card details never reach us; the payment is processed on the infrastructure of iyzico, a licensed payment institution.
Messages: when you write to us by email or on WhatsApp, your email address or phone number, your WhatsApp name, and whatever you share in the conversation.
Technical records: session data, error records, security logs, and a session recording with form fields masked.

What you give us as a guest

Opening an invitation never asks you to create an account. When you send an RSVP we record your name, your answer, and how many people are coming if you say so. Email, phone, and a note are optional and can be left blank.

Your RSVP is shown only to the host of that invitation. It is not used for any other purpose and not linked to any other invitation.

Legal grounds and purposes

Your personal data is processed on the grounds set out in article 5 of the law, listed below with the purposes each one covers. Consent is not among them, so no consent step appears when you register or send an RSVP.

Establishment and performance of a contract (art. 5/2-c): opening the account, building the invitation, and publishing it; answering your questions and support requests; fetching the results of your location search and ranking nearby ones first.
Compliance with a legal obligation (art. 5/2-ç): issuing the invoice and keeping financial records.
Establishment, exercise, or protection of a right (art. 5/2-e): defending against legal claims and retaining evidence.
Legitimate interests of the controller (art. 5/2-f): passing RSVPs to the host, security, abuse prevention, debugging, and visitor counting.

How the data is collected

Personal data is collected by wholly or partly automated means, in electronic form. The primary source is the forms you fill in: when you register, when you build the invitation, at the payment step, and when you send an RSVP. Messages you send us by email or on WhatsApp are collected the same way.

Beyond that, session, security, and error records are generated automatically by our systems as you use the site. When you search for a location, the country is derived from your IP address, and your device’s location is read from your browser if you allow it. If you choose to sign in with Google, Google passes us your account identifier, email address and verification status, name, profile photo, and account language. We do not store Google OAuth access or refresh tokens.

We do not collect any of the special categories of personal data defined in article 6 of the law.

Who we share it with

We work with the providers below to run the service, and share your data with no one else. Where a request comes from an authority empowered by law, we examine the basis for it and provide only what the law requires.

iyzico: taking payments and handling refunds. Your billing details and IP address are sent for the payment. Established in Turkey.
Resend: delivering account verification, password reset, and payment confirmation email.
Hetzner: the servers running the application and the database.
Cloudflare: domain routing, traffic security, and attack protection.
WhatsApp (Meta): carrying the conversation if you choose to message us on WhatsApp. Your phone number, your WhatsApp name, and whatever you share in the conversation are processed on WhatsApp’s infrastructure.
Google: the email service that holds our support email (Google Workspace); authentication, if you choose to sign in with Google. When you search for a venue or an address, the text you type is sent to Google through our server to fetch results. The request carries the invitation’s language, the country derived from your IP address and, if you allow location access, your device’s location; your IP address is not sent to Google in this request. The map on an invitation is loaded from Google; the same map appears in the form and the preview while you build it. The browser opening the map sends Google the selected place’s Google Maps place ID, or the typed address with its district and city, along with the map language and its IP address.

Transfers abroad

Every provider above except iyzico is located outside Turkey, so delivering the service means your data is processed on their servers. Only the data the service needs is transferred, and only as far as it needs to go.

No third-party analytics company is involved in visitor counting or session recording; those records stay on the servers the application runs on.

How long we keep it

Your account and the invitations you have not published: until you ask us to delete them. We may delete inactive accounts and unpublished invitations earlier.
Published invitations and their RSVPs: for the service period and at most six months after it ends, after which they are deleted or anonymized.
Invoices and payment records: ten years, as the applicable legislation requires.
Security and error logs: twelve months at most.
Visitor measurement: per-visit records for twelve months, then only aggregate figures that cannot be traced to a person.
Session recordings: thirty days.

Your rights

Article 11 of the law gives you the right to:

Learn whether your personal data is processed, and ask for information about it if it is.
Learn the purpose of the processing, and whether the data is used accordingly.
Know the third parties the data is transferred to, in Turkey or abroad.
Have incomplete or inaccurate data corrected.
Have the data erased or destroyed once the conditions for that are met.
Have any correction, erasure, or destruction notified to the third parties the data was transferred to.
Object to a decision reached against you purely through automated analysis.
Claim compensation if unlawful processing causes you loss.

Requests and complaints

To exercise any of these rights, you can write to info@davetliler.com; if you have an account, writing from its registered address makes you easier to identify. Telling us which right you want to exercise helps us settle the request sooner.

We answer within thirty days at the latest. Where we cannot be confident who you are, we may ask for more information.

If your request is refused, if you find our answer inadequate, or if no answer reaches you in time, you can complain to the Turkish Data Protection Board within thirty days of learning our answer, and in any case within sixty days of the date of your request.