KVKK Disclosure Notice

This disclosure notice has been prepared by DIÇA Kahve (Sakarya, Bahçe Sk. No: 3 D:21, 17200 Biga / Çanakkale, e-mail: merhaba@dicakahve.com), acting as the data controller, pursuant to Law No. 6698 on the Protection of Personal Data (“KVKK”). This notice covers the dica website, the DIÇA mobile application, and the loyalty (stamp) programme at our shop.

The following categories of data are processed:

• Identity information: first name, last name, username.
• Contact information: e-mail address.
• Customer transaction information: stamp-earning and reward-redemption activity, card fill status, your feedback.
• Transaction security information: application session records, device push-notification token, IP address, and access logs.

No personal data is collected from users who merely visit our website; membership is created only through the mobile application.

• Creating and managing your membership account,
• Operating the loyalty programme: recording stamps, calculating and granting reward entitlements,
• Sending campaign and event notifications if you request them,
• Responding to your questions, suggestions, and complaints,
• Ensuring service security and preventing misuse,
• Fulfilling our legal obligations.

Your personal data is processed on the legal grounds of the establishment and performance of the membership agreement under Article 5/2-c of the KVKK, the fulfilment of our legal obligations under Article 5/2-ç of the KVKK, and our legitimate interests (service security, prevention of misuse) under Article 5/2-f of the KVKK. Campaign and event notifications rely solely on your explicit consent; you may withdraw this consent at any time through the application settings.

Your data is shared with the server provider from which we obtain hosting services within Turkey. To send push notifications, your device’s notification token is transmitted to our notification infrastructure provider (Expo Push Service). Data may be transferred to authorised public institutions and organisations where legally required. Beyond this, your data is not sold to third parties and is not shared for marketing purposes.

Your account data is retained for the duration of your membership. When you delete your account, your personal data is deleted or anonymised within 30 days; retention obligations arising from legislation (e.g., commercial records) are reserved. Access logs are kept for a maximum of 2 years.

Pursuant to Article 11 of the KVKK, you have the right to:

• learn whether your personal data is being processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether it is used in accordance with that purpose,
• request correction if it has been processed incompletely or incorrectly,
• request its erasure or destruction within the conditions set out in Article 7 of the KVKK,
• object to a result that arises to your detriment through the analysis of the data exclusively by automated systems,
• request compensation for damages you incur due to unlawful processing.

You may submit your requests, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, by e-mail to merhaba@dicakahve.com or in writing to Sakarya, Bahçe Sk. No: 3 D:21, 17200 Biga / Çanakkale. Your applications will be concluded free of charge within 30 days at the latest.