Privacy Policy

The data controller responsible for processing personal data under applicable data protection legislation is:

Company Name: Invitation Seyahat Acentesi ve Ticaret Limited Şirketi
Website: foodshoppass.com
E-mail: support@foodshoppass.com
Address: Selimpaşa Merkez Mah. 3261 Sok. No:2/3, Silivri, İstanbul, Türkiye

FoodShopPass operates a digital platform offering food, shopping, lifestyle, travel-related offers and digital Passes.

Depending on how you use the Platform, we may process the following categories of personal data.

2.1. Account and Identity Information

This may include:

• Full name

• E-mail address

• Telephone number

• Account information

• Country of residence or nationality, where provided

• Login and authentication information

We collect this information when you create or use an account or interact with our services.

2.2. Purchase and Transaction Information

When you purchase a Pass through the Platform, we may process:

• Pass purchased

• Order number

• Purchase date and time

• Transaction amount

• Currency

• Payment status

• Refund or cancellation information

• Invoice and billing information

• Transaction reference information

This information may be required to process and manage your purchase.

2.3. Payment Information

Payments for purchases made through the Platform are processed through iyzico, our third-party payment service provider.

FoodShopPass does not store complete payment card information, including full card numbers or CVV/security codes.

Payment card information required to complete a transaction is processed by iyzico in accordance with its own privacy policy, security standards and applicable laws.

FoodShopPass may receive limited transaction-related information from iyzico, such as:

• payment status;

• transaction/reference number;

• transaction amount;

• currency;

• payment date;

• refund status; and

• other information necessary to manage the transaction.

When you purchase or use an F&S Pass, we may process information relating to:

• Pass ID;

• Pass status;

• purchase date;

• activation date and time;

• first successful QR validation;

• QR validation records;

• participating merchant where the Pass was validated;

• Pass usage records;

• cancellation records;

• expiry date and status.

These records are used to operate the Pass system, determine activation and validity, prevent unauthorized use, process refunds and cancellations, provide customer support and resolve disputes.

The first successful QR validation or equivalent validation may be recorded as the activation of the Pass.

When you contact FoodShopPass, we may process:

• E-mail correspondence;

• Customer support requests;

• Refund requests;

• Complaints;

• Questions;

• Feedback;

• Other communications relating to your use of the Platform.

We may retain relevant communications where necessary to provide customer support, resolve disputes, protect our legal rights or comply with legal obligations.

If you submit a review, rating, comment, photograph or other content to the Platform, we may process the information contained in that submission.

You are responsible for ensuring that content you submit does not unlawfully disclose another person's personal data or violate applicable laws or third-party rights.

When you access or use the Platform, we may automatically collect certain technical information, including:

• IP address;

• Device type;

• Browser type;

• Operating system;

• Language settings;

• Approximate location information, where enabled and legally permitted;

• Date and time of access;

• Pages and features accessed;

• Platform interaction information;

• Technical and security logs; and

• Cookie and similar technology information.

The information collected may vary depending on your device, browser, settings and use of the Platform.

We may process personal data for the following purposes:

Platform Operation

• Operating and maintaining the Platform;

• Creating and managing User accounts;

• Providing digital Passes;

• Activating and validating Passes;

• Processing QR code validations;

• Providing access to Partner benefits.

Purchases and Transactions

• Processing purchases;

• Confirming payments;

• Managing orders;

• Issuing invoices;

• Processing refunds and cancellations;

• Maintaining transaction records.

Pass Management

• Recording Pass activation;

• Determining Pass validity;

• Recording Pass usage;

• Managing Pass expiry;

• Preventing unauthorized Pass use.

Security and Fraud Prevention

• Detecting fraudulent activity;

• Preventing unauthorized access;

• Preventing misuse of Passes and QR codes;

• Protecting Users, Partners and the Platform.

Customer Support

• Responding to inquiries;

• Processing complaints;

• Handling refund requests;

• Resolving technical problems;

• Resolving disputes.

Platform Improvement

• Understanding how Users interact with the Platform;

• Improving Platform functionality;

• Monitoring technical performance;

• Developing new features and services.

Legal and Regulatory Compliance

• Complying with applicable laws;

• Responding to lawful requests from competent authorities;

• Maintaining legally required records;

• Establishing, exercising or defending legal claims.

Communications

Where legally permitted, we may send service-related communications concerning:

• Purchases;

• Payments;

• Pass activation;

• Pass expiry;

• Refunds;

• Account security;

• Important changes to the Platform.

Marketing communications will only be sent where the applicable legal requirements are satisfied.

Depending on the processing activity and applicable law, we may process personal data based on:

• Performance or preparation of a contract;

• Compliance with legal obligations;

• Establishment, exercise or protection of legal rights;

• Legitimate interests, where permitted by applicable law;

• Consent, where legally required;

• Fraud prevention and security purposes; and

• Other lawful grounds provided under applicable legislation.

Under the KVKK, applicable processing conditions may include those set out in Article 5 and, where applicable, Article 6 of Law No. 6698.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We may share personal data where necessary and legally permitted with the following categories of recipients.

Payment Service Provider

iyzico may process payment information and transaction information necessary to process payments, verify transactions and process refunds.

Technology and Infrastructure Providers

We may use third-party providers for:

• Hosting;

• Cloud infrastructure;

• Database services;

• Authentication;

• Security;

• Analytics;

• E-mail and communications;

• Customer support; and

• Other technical services.

Participating Partners

Where necessary to provide or validate a Pass benefit, certain information may be shared with the relevant participating Partner.

For example, a Partner may receive information necessary to confirm that a User has a valid Pass.

We aim to limit information shared with Partners to information reasonably necessary for the relevant service or transaction.

Public Authorities

We may disclose personal data where required or permitted by law to:

• Courts;

• Law enforcement authorities;

• Tax authorities;

• Regulatory authorities; and

• Other competent public authorities.

Professional Advisors

Where necessary, information may be shared with professional advisors such as lawyers, accountants, auditors or other professional service providers, subject to applicable legal and confidentiality requirements.

We do not sell personal data to third parties.

Some of our service providers, including technology, hosting, analytics or payment-related providers, may process personal data outside Türkiye.

Where personal data is transferred internationally, we take the safeguards required by applicable data protection legislation.

Depending on the applicable legal requirements, these safeguards may include:

• Appropriate contractual safeguards;

• Standard contractual clauses or equivalent mechanisms;

• Adequacy decisions where applicable; and

• Other legally recognized transfer mechanisms.

We use cookies and similar technologies to operate, secure and improve the Platform.

These technologies may be used for:

• Essential Platform functionality;

• Authentication;

• Security;

• User preferences;

• Analytics;

• Performance measurement; and

• Marketing, where legally permitted.

For more information, please review our Cookie Policy.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required or permitted by applicable law.

Retention periods may depend on:

• The purpose for which the data was collected;

• The duration of the User relationship;

• Legal obligations;

• Tax and accounting requirements;

• Dispute resolution;

• Fraud prevention;

• Security requirements; and

• The exercise or protection of legal rights.

Purchase, payment, invoice and transaction records may be retained for periods required by applicable tax, accounting and commercial legislation.

Pass activation, QR validation and usage records may be retained for an appropriate period to establish transaction history, prevent fraud, resolve disputes and protect the rights of FoodShopPass, Users and Partners.

When personal data is no longer required, it will be deleted, anonymized or otherwise processed in accordance with applicable law.

We use reasonable technical and organizational measures designed to protect personal data against:

• Unauthorized access;

• Unauthorized disclosure;

• Loss;

• Misuse;

• Alteration;

• Destruction; and

• Other unlawful processing.

Security measures may include access controls, authentication, encryption where appropriate, monitoring, logging and other technical safeguards.

However, no internet-based service or electronic storage system can be guaranteed to be completely secure.

Depending on applicable law, you may have the right to:

• Learn whether your personal data is being processed;

• Request information about the processing;

• Access your personal data;

• Request correction of inaccurate or incomplete data;

• Request deletion or destruction where legally applicable;

• Request restriction of processing where applicable;

• Object to certain processing activities;

• Withdraw consent where processing is based on consent;

• Request data portability where applicable; and

• Exercise other rights provided under applicable law.

Under the KVKK, data subjects may exercise their rights in accordance with Article 11 of Law No. 6698.

Requests may be submitted to:

support@foodshoppass.com

We may request information necessary to verify your identity before processing certain requests.

We will respond to valid requests within the periods required by applicable law.

Where legally permitted and where the required consent or other lawful basis exists, FoodShopPass may send promotional communications concerning:

• FoodShopPass;

• F&S Pass;

• Partner offers;

• New services; and

• Related products or experiences.

You may unsubscribe from marketing communications at any time using the unsubscribe mechanism provided in the relevant communication or by contacting us.

Opting out of marketing communications does not prevent us from sending essential service communications relating to:

• Purchases;

• Payments;

• Pass activation;

• Pass expiry;

• Refunds;

• Account security; or

• Important contractual or service-related matters.

The Platform is primarily intended for adults.

We do not knowingly collect personal data from children in circumstances where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to us without appropriate legal authorization, please contact:

support@foodshoppass.com

We will take appropriate steps in accordance with applicable law.

The Platform may contain links to websites, applications or services operated by third parties.

These third-party services may have their own privacy policies and data processing practices.

FoodShopPass is not responsible for the privacy practices of independent third-party services.

We recommend reviewing the relevant privacy policy before providing personal data to a third-party service.

FoodShopPass works with independent Partners that may provide products, services, discounts or other benefits.

Where a Partner receives personal data for the purpose of providing or validating a service, the Partner may process that information in accordance with its own legal obligations.

FoodShopPass shares information with Partners only where reasonably necessary for the relevant service, transaction, security or legal purpose.

Depending on the particular processing activity, FoodShopPass and third-party service providers may act as data controllers, data processors or other legally recognized roles under applicable data protection legislation.

Where we engage service providers to process personal data on our behalf, we take reasonable steps to ensure that such providers process personal data only for authorized purposes and in accordance with applicable legal requirements.

We may update this Privacy Policy from time to time to reflect:

• Changes in applicable law;

• Changes to our services;

• Changes in technology;

• Changes in our data processing practices; or

• Security and operational requirements.

The updated version will be published on the Platform with a revised “Last Updated” date.

Where required by applicable law, we will provide additional notice or obtain the necessary consent for material changes.