In short
- The data your restaurant enters into Qungry (orders, guests, staff, menu) belongs to you. Your restaurant is the data controller for this data; we only process it on your behalf and on your instructions. This relationship is set out in the Data Processing Agreement.
- This policy describes the data Qungry processes on its own behalf: people who visit our website, request a demo, our customers' authorised contacts and users, support requests and billing details.
- In the courier app, location is shared with the restaurant only while the courier is carrying an order, and only the latest location is kept. Details are in the Courier app and location data section.
- We do not sell your data or use it for advertising.
1. Data controller
Ae Telecom, Mecidiyeköy No:00153, 34381 Istanbul, Türkiye.
For privacy questions and to exercise your rights: moc.yrgnuq@ofni
EU representative (GDPR Art. 27): [EU REPRESENTATIVE] · UK representative (UK GDPR Art. 27): [UK REPRESENTATIVE]
2. What data we process, why and on what legal basis
| Whose data / when | Data | Purpose | Legal basis |
|---|---|---|---|
| Demo request form | Full name, business name, email, phone, country, city, number of branches, your message | To assess your request, get back to you and open a trial account | Steps prior to a contract (Art. 6(1)(b)) |
| Contact and support requests (form, email, support system, WhatsApp) | Name, email, phone, message content, any attachments | To answer your questions, provide support and fix errors | Performance of a contract (for customers), legitimate interest (for other requests) |
| Customer account (business) | Business name, address and phone; the authorised contact's name, email and phone; country, currency, language | To open and manage the account, provide the Service and send important notices | Performance of a contract (Art. 6(1)(b)) |
| Subscription and billing | Billing name and address, tax number, selected plan, payment history, card brand and last 4 digits (we never hold the full card number) | To take payments, invoice and keep accounting records | Performance of a contract; legal obligation (Art. 6(1)(c)) |
| Panel and app users (restaurant staff) | Name, email, role and permissions, sign-in records, registered device details, device token for notifications | Secure sign-in, authorisation, preventing misuse, sending notifications | Performance of a contract; legitimate interest (security) |
| Technical logs | IP address, browser and device information, error logs, request times | Security of the Service, detecting and fixing errors | Legitimate interest (Art. 6(1)(f)) |
| Newsletter and marketing emails | Email address | Product news and promotions | Consent (Art. 6(1)(a)); legitimate interest for similar services to existing customers. You can unsubscribe at any time with the link in every email. |
Where we rely on legitimate interest as the legal basis, we assess that our interest is balanced so as not to override your rights. You can ask for information about this assessment.
Our service is aimed at restaurants; we do not knowingly collect data from children under 16.
Courier app and location data
The data controller for location data in the courier app is the restaurant the courier works for. Qungry processes this data on the restaurant's behalf under the Data Processing Agreement. The restaurant determines the legal basis and is responsible for informing its couriers.
- When it is shared: While a shift is open and the courier is carrying an undelivered order. Outside a shift, or when the courier has no order, location is not shared with the restaurant.
- How it works: The courier is informed in the app before starting a shift and grants location permission on the phone. During the shift, location services stay on and are visible in the notification area; location is sent only while carrying an order. Sharing continues while the app is in the background or the screen is locked; it stops if the app is closed.
- What data: Latitude, longitude, location accuracy and time. Location is updated about every 20 seconds.
- Purpose: To see where orders are and to manage deliveries. Qungry does not use this data for its own purposes, advertising or profiling.
- Who sees it: Restaurant staff with access to the courier tracking screen for the relevant branch. Map images are loaded from a map provider; this provider does not receive the courier's identity, it sees the IP address of the person opening the screen and the map area being viewed (Sub-processors).
- Retention: Only the latest location is kept, and the previous one is deleted with each update. When the last order is delivered or the shift ends, the latest location is deleted too. Past routes and the location at delivery are not stored. Copies in backups are deleted within the normal backup cycle.
- Records other than location: Shift start and end times, delivered orders and collected payments are kept as the restaurant's business records.
3. Who we share data with
We share your data only as far as needed to provide the Service, with service providers bound by contract: servers and hosting, email delivery, payment infrastructure (PayTR), support system, error tracking, mobile notifications and optional AI-assisted invoice reading. The current list and countries are on the Sub-processors page.
Otherwise, we share data only with competent authorities where required by law, with our legal advisers to protect our rights, or with our successor in a merger or transfer of the company (with the same level of protection).
4. International transfers
Your data is stored on servers in France; backups are kept in the Netherlands. Our company is established in Türkiye, and some of our service providers are outside the European Economic Area and the United Kingdom (e.g. the USA). For these transfers to countries without an adequacy decision, appropriate safeguards are used, such as the European Commission's Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum (IDTA / UK Addendum). You can request a copy of the safeguards.
5. Retention periods
- Demo and contact requests: 24 months from the last correspondence if you do not become our customer.
- Customer account: For the term of the subscription and 90 days after it ends (for reactivation and export); then deleted.
- Invoices and payment records: For the period required by tax and accounting law (10 years, as our company is established in Türkiye).
- Support records: 24 months from when the request is closed.
- Technical and error logs: Up to 90 days.
- Courier location: Only the latest location, until the last order is delivered or the shift ends (see Courier app and location data).
- Backups: Deleted data is removed from backups within the normal backup cycle, at the latest after 30 days.
- Marketing emails: Until you withdraw your consent.
6. Your rights
Under the EU General Data Protection Regulation (GDPR) and the UK GDPR you have the right to:
- access your data and get a copy,
- ask for incorrect or incomplete data to be corrected,
- ask for your data to be erased,
- ask for processing to be restricted,
- object to processing based on legitimate interest, and always object to direct marketing,
- receive the data you provided in a structured, machine-readable format (data portability),
- withdraw your consent at any time where processing is based on consent.
You can send your requests to moc.yrgnuq@ofni or through the Data Deletion Request page. Once we have verified your identity, we reply within one month at the latest.
If you are a restaurant's guest: The restaurant is the data controller for your order and contact details it keeps in Qungry; please send your request directly to the restaurant. We forward requests we receive to the restaurant concerned and assist them.
If you are a restaurant's courier or staff member: The restaurant is the data controller for your staff records and courier location data it keeps in Qungry; please send your request directly to the restaurant. We forward requests we receive to the restaurant concerned and assist them.
Right to complain: you can contact the data protection authority of the country in the European Union or the European Economic Area where you live or work, and in the United Kingdom the Information Commissioner's Office (ico.org.uk). If you contact us first, we will try to resolve the issue together.
7. Security
We protect data with these measures: encryption on all connections (HTTPS/TLS), encrypted storage of sensitive information such as API keys and payment details, a separate database for each restaurant's data, role and permission-based access, never storing card details on our servers, regular backups and monitoring of access logs. If a data breach occurs, where the law requires we notify the competent authority within 72 hours and the people affected without undue delay.
8. Cookies
The cookies we use and how you can manage your preferences are explained in the Cookie Policy.
9. Changes
We update this policy when needed. The current version is published on this page with the date of the last update. We notify our customers of important changes separately by email or in the panel.