Introduction
DESTADE Yazılım ve Teknoloji A.Ş. ("DESTADE" or the "Company") values the privacy of all the mobile applications we develop. This Privacy Policy applies to all our mobile applications, including our enterprise applications such as DESMED, DESCAR, DESCRM and DESERP, and our publicly available applications such as Vespera Gusto and Atlas Lounge. It is important that you read this policy before using our applications. By downloading and using our applications on your device, you are deemed to have accepted the privacy practices described here. If you do not accept them, please do not use our applications.
This Privacy Policy has been prepared in full alignment with the privacy policy guidelines of the Apple App Store and the Google Play Store. In line with Apple's and Google's requirements, this document explains in plain language which data we collect, how and why we collect it, how we use it, which third parties we share it with, how long we keep it, how users can withdraw their consent and how they can request deletion of their data. We also provide our developer identity and contact details, and we state clearly that this document is a privacy policy. Our policy complies with the Law on the Protection of Personal Data No. 6698 (KVKK) in force in Türkiye and with the relevant privacy legislation in all regions where our applications are made available. We comply with all obligations required by national and international data protection laws, such as KVKK and the General Data Protection Regulation (GDPR), that apply in the jurisdictions where our applications are offered. In this context, our priority is to be transparent about our users' personal data and to protect users' rights.
Data We Collect and How We Collect It
When you use our applications, we may collect certain information from you or your device. The data we collect and the methods of collection may vary depending on the type of application (B2B or general) and its features. The types of data collected and the purposes for which they are processed are explained below:
- Account and Identity Information: We collect the basic personal information needed for access to our applications and for authentication. For example, in our enterprise applications (DESMED, DESCAR, etc.), user accounts are created by your company, and information such as your first name, last name and e-mail address is defined on your account. In our publicly available applications, you may provide information such as your first name, last name, e-mail address and, if needed, a contact number directly during registration. We use this information to create your user account, verify your identity and personalize application functions for you. In our B2B applications, this information is used solely to provide you with enterprise services and is never processed for advertising or promotional purposes. In our general applications, this information may be used both to provide the service and, if you give permission in the future, to send you campaign notifications.
- Documents for Verification: Some of our public applications, such as Vespera Gusto and Atlas Lounge, may request verification documents such as a student certificate as a condition of benefiting from certain campaigns. In this case, the application may ask you to upload a document such as a student ID or certificate as a photo or PDF. Such documents are received temporarily and solely for user verification and are not used for any purpose other than checking your eligibility for the relevant campaign. Providing such a document is entirely optional, but if the requested verification is not completed you may not be able to benefit from some campaigns. The verification documents you send us are kept safe, are not stored in our systems for long once the process is complete unless legally required, and are not shared with third parties.
- Usage Information and Analytics Data: To understand how our applications are used and to improve their performance, we may automatically collect some usage data. For example, statistical data such as actions performed in the application, frequency of use and preferred features may be collected. We may also collect technical data about your device: device type and model, operating system version, application version, device identifiers (e.g. mobile advertising ID), IP address, and your language and region settings. This data does not directly reveal your identity and is generally used to improve the application experience, resolve technical problems (e.g. crash reports) and improve our services. Analytics data may also be collected through third-party services (for example, tools such as Firebase Analytics can track user interactions anonymously or in aggregate). This data helps us understand user trends and is processed lawfully to offer our users a better experience.
- Device Permissions and Access: For some application features, we may ask for permission to access certain functions of your device. For example, if the application has a feature such as QR code reading, permission to access your device's camera is requested. Camera permission is used only for instant operations such as scanning a QR code or taking a photo within the application. Images obtained through the camera are never saved, uploaded to our servers or transmitted to third parties; the camera only runs momentarily to perform the relevant function, and image processing ends when the operation is complete. Similarly, in our general applications, if you need to upload a photo to benefit from an offer within a campaign (e.g. to show a discount coupon or a menu), these photos are also taken only for the relevant operation and are not used anywhere else without your consent. Our applications follow the principle of not collecting any unexpected or unnecessary data from your device; access is granted only for situations you would reasonably expect as part of the user experience.
Purposes of Using Data
All data collected is processed within the limits permitted by applicable law and is not used outside the purposes stated in this policy. We can summarize the purposes of processing in general terms as follows:
- Providing the Service and Functionality: The primary purpose of using personal data is to deliver the functions the relevant application promises you. For example, in enterprise applications, we use your name and surname to recognize you in the application and to associate your in-house transactions with the right person. In general applications, your identity and contact information are used to verify your account, let you log in, create a profile and present content according to your preferences. The processing of data is aimed at the smooth delivery of the functions users expect from the applications (for example, listing campaigns, making reservations, inventory management).
- Personalization and Improvement: We may use some data to enrich your application experience. For example, in general applications, your location information or the types of campaigns you have interacted with in the past (if the application has such a feature) may be used to show restaurant campaigns that may interest you. However, our applications do not currently collect precise location information; if campaigns are regional, you see them by choosing or according to the location of the relevant restaurant. By analyzing the usage data and feedback we collect, we improve application performance, develop new features and resolve potential problems. For example, frequently used features can be identified and developed, or improvements can be planned for rarely used ones.
- Communication and Support: Your e-mail address and/or phone number (if you provided them) may be used to contact you. This communication includes technical notifications about your account (e.g. password reset, security alerts), application updates or information about your use. In enterprise applications, communication for technical support and information purposes is generally coordinated with your company. In publicly available applications, support is provided directly to the user; for example, we may use your contact details to get back to you when you report a problem or to inform you about an update.
- Marketing and Campaign Communications: For our general applications, we may carry out marketing communications in line with your explicit consent or preference. For example, we may plan to send information e-mails about newly added restaurant campaigns, special offers or promotions designed for you to the e-mail address you provided in the Vespera Gusto or Atlas Lounge application. If you prefer not to receive such e-mails, you can update your message preferences during registration or at any time, or easily opt out using the unsubscribe link at the bottom of the e-mails. In enterprise (B2B) applications, no marketing or advertising messages are sent; your data is not used for such commercial purposes.
- Security and Legal Obligations: We take due care in processing data in order to protect our users' data and make our applications a safe environment. Log records and technical data may be reviewed from time to time to detect and prevent suspicious activity (e.g. unauthorized access attempts, account fraud). In addition, where we are required to comply with applicable law (for example, upon a valid request from competent authorities), we may process the relevant user data or share it with competent authorities. Apart from this, we may also use the necessary data to protect our rights or respond to legal requests in the event of a legal dispute.
Other than the purposes stated above, we will not process your personal data for a purpose different from the one for which it was first collected. When a new purpose arises or we need to use your data for an additional reason, we will inform you and, if necessary, obtain your consent. We are committed to the principles of transparency and purpose limitation in processing data; that is, we collect and use only the data needed for legitimate and disclosed purposes.
Data Sharing and Third Parties
DESTADE does not misuse or sell user data or share it with third parties without permission. We share your data with third parties only to a limited extent, within the framework set out in this policy and in the following cases:
- Service Providers (Data Processors): To operate, improve and support our applications, we work with certain third-party service providers. These service providers act as data processors on our behalf and are authorized to process your data only in line with our instructions. The main third-party services we use include:
- Firebase (Google LLC): We use Google's Firebase platform in the infrastructure of all our applications. Firebase offers many services such as authentication, cloud data storage, a real-time database, notification delivery and analytics. In this context, your user account information and in-app data may be stored on Google's secure servers. Firebase may also collect technical data such as application usage statistics and crash reports. Google protects the data it processes under Firebase in line with its own security and privacy policies. While processed through Firebase, your data is protected to international standards, and Google is not permitted to use this data for its own purposes outside our instructions.
- Algolia (Algolia Inc.): In some of our applications we use the Algolia search infrastructure to offer functions such as search and recommendations. For example, when you search for a restaurant or product, your search terms may be sent to Algolia's servers so that fast and relevant results can be returned. As little data as possible is sent during this process (usually search words and required filters), and Algolia processes this data only momentarily to provide search results. Algolia does not permanently store or analyze the search data it obtains; it uses it only temporarily for the service to work. Even so, service providers such as Algolia are also obliged to protect the privacy of data.
- Meta Platforms (Facebook SDK, etc.): Some SDKs or tools belonging to Meta may be integrated into our applications for in-app analytics and statistical advertising targeting. For example, the Facebook SDK may help collect information, anonymously, such as how many times the application has been opened and which features are used, or allow us to analyze statistical data about our application's audience through Meta's advertising platform. These integrations are kept limited in scope, and your personal data is not shared with Meta for a commercial purpose. That is, even when targeting in a possible Facebook/Instagram advertising campaign, directly identifying information such as your name or contact details is not provided to Meta by us. Meta SDKs generally provide statistics using information such as your device's advertising identifier. This information is also subject to Meta's privacy policies, and we use only anonymized or aggregated outputs.
- Apart from those listed above, similar third-party tools (e.g. error reporting, map services, payment processing) may be integrated from time to time. In every case, we take care that these service providers are reputable companies with strong privacy protections. The data shared is limited to what is necessary to provide the relevant service. For example, if we use an e-mail service provider to send an e-mail newsletter, only your e-mail address and the content of the message are shared with that service. In our contracts with all our third parties, obligations to protect the confidentiality and security of data are clearly stated. These companies cannot use your data for their own purposes and cannot act contrary to their contract with us or to legal regulations.
- Legal Requirements: Under applicable laws or at the request of official authorities, we may in certain cases have to share your personal data with third parties (for example, courts, public prosecutors or regulatory bodies). In such a case, we assess the lawfulness of the request and share data only to the extent we believe necessary. Unless required by law or a valid provision exists, your personal data is not transferred to any unofficial institution or person.
- Intra-Company Sharing: If DESTADE becomes a group structure with several affiliates or subsidiaries, your personal data may be shared with affiliates within the group (for example, if we provide the same service together). In that case, too, sharing will be limited to the purposes of this policy and subject to intra-group privacy standards. For example, if we provide a service under the DESERP application together with a business partner of DESTADE, the relevant data is shared only for the performance of that service and with confidentiality commitments.
- Business Transfers: If our company as a whole, or one of our applications, is transferred, merged or acquired by another organization, user data may also be transferred to the new parties as part of that transaction. In that case, the party receiving the data will be required to comply with the principles described in this Privacy Policy. Where possible, we will inform you before the transfer and, if legally required, obtain your consent.
In short, sharing your personal data with third parties is limited to exceptional and limited cases. Apart from services essential for our applications to work, your data is not shared for marketing purposes or in the interest of another company without your consent. We require all parties we share with to apply privacy and security measures at least as strong as ours.
Data Security
DESTADE takes industry-standard measures to ensure the security of user data. Some of the security measures we apply to protect data are:
- Encryption: Sensitive data transmitted through our applications (for example, user login details and verification documents) is encrypted, where possible, using protocols such as SSL/TLS. In addition, critical information such as passwords stored on our servers is kept using one-way encryption (hashing).
- Access Control: Access to personal data within DESTADE is limited to authorized personnel who need to know this data to do their job. Our databases and systems are protected with authentication, authorization and logging mechanisms. Our external service providers (such as Firebase) also hold globally recognized security certifications and practices.
- Monitoring and Testing: We continuously monitor our systems against misuse, unauthorized access or data leak attempts. We also carry out security tests at regular intervals (such as penetration tests and vulnerability scans) to identify and fix possible weaknesses.
- Physical Security: The servers where your data is stored are hosted in high-security data centers protected by our cloud service providers. These data centers are also protected against physical hazards (unauthorized entry, disasters, etc.).
However, please remember that no use of the internet or of a mobile application can be guaranteed to be 100% secure. Although we take the best measures we can, we cannot give an absolute guarantee against unexpected security breaches that may occur in data transmissions over the internet or in storage systems. To keep your personal data safe, you should also take measures such as using a strong password, not sharing your account details with third parties and downloading only from official application stores. If you notice anything suspicious, please contact us immediately (contact details are given at the end of this policy).
In the event of a data security breach, we will inform affected users and, where deemed necessary, the relevant official authorities within the legal time limits. You can send us all your questions and concerns about security.
Data Retention Periods
We keep your personal data only as long as necessary. This period may vary depending on the nature of the data and the purpose of processing. The retention policies we apply in general are as follows:
- User Account and Profile Data: Basic information such as your name, contact details and account ID is kept in our systems as long as your account is active. If you stop using the application or want to delete your account (see the "Deletion of Data" section below), this data is deleted or anonymized upon your request. Except for data that must be kept due to legal obligations (for example, invoice records for financial transactions), your personal data is not kept in our systems after the account is closed.
- Verification Documents: Documents received for verification purposes, such as a student certificate, are deleted as soon as reasonably possible after the relevant check is completed and the need has ended. For example, if we have verified that you are a student for a campaign and the campaign has ended, or if verification was done instantly, a copy of your document is not kept on our servers or is destroyed immediately. Only where it must be kept as evidence for misuse checks or in case of an objection may we keep the document for a limited time; even then, access to the document is strictly restricted and it is deleted when the period ends.
- Usage and Analytics Data: Since statistical data about your use of the application (such as click records and browsing information) is generally collected anonymously or in aggregate, it can be hard to set a specific retention period. We may keep such data in anonymized form indefinitely for trend analysis. However, log records that may count as personal data, such as the IP address, are deleted or anonymized after they have served their function or when the legally prescribed period ends. For example, server access logs are generally kept so that they are deleted automatically within a few months.
- Support and Communication Records: When you contact us from within the application or by e-mail/phone, we may keep records of the communication to respond to your support requests. After the issue is resolved, these records (e.g. your support request history, e-mail correspondence) may be kept for a further period for quality and training purposes, after which the parts containing personal information are masked or the record is deleted entirely.
- Data Subject to Legal Obligations: Under laws such as tax legislation, commercial law or KVKK, we may be obliged to keep certain data for certain periods. For example, commercial transactions or invoices of our users may have to be kept for 10 years. In such cases we retain the relevant data for the period required by law and destroy it securely when the period ends.
When the retention period ends, we delete, destroy or irreversibly anonymize the data using secure methods. Our data destruction policies are carried out in line with KVKK and international standards. If you have a more specific question about retention periods, you can contact us.
User Rights and Choices
At DESTADE, we are aware of the rights you have over your personal data and respect them. Under KVKK, GDPR and similar data protection laws, users have the following rights:
- Right to Information and Access: You have the right to learn which of your personal data we process and to request a copy of it. For example, you can access basic information we keep under your account from within the application; for a more comprehensive data request you can contact us.
- Right to Rectification: You have the right to request correction of personal data you believe is incomplete or incorrect. When you need to update your profile information, you can do so through the application or contact us and ask us to make the correction.
- Right to Erasure ("Right to Be Forgotten"): In certain cases you can request the deletion of your personal data. If you want to close your account in an application, you can ask for your account and all related data to be deleted by using the account deletion option within the application or by applying to us in writing. Except for data we are legally required to keep or are permitted to keep for our legitimate interest, we will delete all your personal data upon your request. Under Google Play Store policies, if we offer the ability to create an account in an application, we must give users the means to permanently delete their accounts and data; we fully comply with this obligation.
- Right to Restriction of Processing: If you object to the accuracy, the purpose of processing or the lawfulness of your data, you can ask us to restrict the processing of your data while it is being reviewed. For example, if you think your information is wrong, we can stop actively using your data until the correction is complete.
- Right to Object: You can object to certain ways in which your personal data is processed. In particular, if your data is used for direct marketing (for example, if you receive commercial e-mails from us), you can object to this use at any time and ask us to stop marketing communications. You also have the right to object, on grounds relating to your particular situation, to a processing activity based on our legitimate interest.
- Right to Data Portability: Under laws such as the GDPR, you can request that data processed by automated means and provided to us by you be transmitted to you, or to a third party you name, in a structured, machine-readable format. Although the data subject to this right in our applications is limited (for example, the information in your profile and your activity history), we provide support to the extent technically possible.
- Right to Withdraw Consent: If the processing of your personal data is based on consent (for example, permission you gave to receive campaign e-mails), you have the right to withdraw that consent at any time. Withdrawing consent does not make processing carried out on the basis of consent before the withdrawal unlawful; however, we stop the relevant processing from the time of the withdrawal request. For example, if you withdraw your marketing e-mail permission, you will no longer receive e-mails for that purpose.
When you want to exercise these rights, please contact us using our contact details below. We will conclude your request as soon as possible after verifying your identity (within 30 days at the latest under KVKK, and generally within 1 month under the GDPR). Depending on the scope of your application, we may ask you for additional information (for example, to make sure you are not requesting access to someone else's data). If we have to reject a request about your rights for legal reasons, we will explain the reason to you.
You also have the right to lodge a complaint with the Personal Data Protection Authority (KVKK) in Türkiye or, if you live in the European Union, with the data protection supervisory authority of your own country. However, we ask that you share any request and complaint with us before applying to any official authority, so that we have the chance to resolve the issue directly.
International Data Transfers
Although DESTADE mostly prefers servers located in Türkiye or within the borders of the European Union when processing your data, your personal data may be processed in international environments because of some cloud services we use. For example, because Firebase runs on Google's infrastructure, your data may be stored in Google's data centers worldwide. Third-party services such as Algolia or Meta may also use servers in different countries. In these cases, we take the necessary measures to ensure that the level of protection in the countries to which your data is transferred is equivalent to that in your own country.
The measures we apply to international data transfers may include contractual safeguards (such as Standard Contractual Clauses), privacy shields or other mechanisms approved by data protection authorities. For example, for user data coming from the European Economic Area (EEA), if the data will be transferred outside the EEA, it is protected with the standard contractual provisions required by the GDPR. For transfers of data from Türkiye abroad, Article 9 of KVKK is followed; that is, the explicit consent of the data subject is obtained, or the transfer is made to a country on the list of countries with adequate protection determined by the Board, or the data is placed under an adequate protection commitment by the receiving party.
If you have questions about the international movement of your data, you can contact us. In any case, regardless of the country in which it is processed, your data remains subject to the principles and safeguards described in this policy.
Children's Privacy
Our applications generally address a broad audience and do not target children under 13. Our enterprise applications in particular are aimed at adult employees; our applications open to the general public are designed for young adults and adults. Users under 18 should use our applications with the permission of their parents or legal guardians. If we notice that we have collected the personal data of a child under 13, we take the necessary steps to delete this data as soon as possible or, where applicable, obtain parental consent. If parents believe their child has provided us with personal information, please contact us so that we can help delete the information from our systems.
Updates and Changes
This Privacy Policy may be updated from time to time. If we make a significant change to the policy, we will inform you within the application or by other appropriate means. When the policy is updated, we will state the "last updated" date below. The renewed policy takes effect from the moment it is announced. Continuing to use our applications with the updated policy means that you accept the changes. We therefore recommend that you review the policy periodically. If you have questions about the changes, do not hesitate to contact us.
Last updated: 20 June 2025
Contact Details
DESTADE Yazılım ve Teknoloji Anonim Şirketi
Address: Hamidiye Mahallesi Anadolu Caddesi No:40/2, Kâğıthane | Istanbul | Türkiye
Tel: +90 (212) 813 03 81
Email: info@destade.com
When contacting us, please state which application your request concerns and the details of your request. Your requests will be evaluated as soon as possible and we will get back to you. We value our users' privacy rights and care about maintaining transparent communication.