Privacy Policy
By1Market is a platform for ordering from restaurants and markets at METU Northern Cyprus Campus and around Kalkanlı, with delivery by couriers. This policy applies to the By1Market customer app, the By1Market Partner app, the partner web panel and by1market.com.
In short: we process only the data needed to provide the service. We show no ads, we do not sell your data and we use no advertising or marketing trackers.
1. Data controller
[to be added]
[to be added]
Email: gizlilik@by1market.com
2. Data we process
| Data | When | Why |
|---|---|---|
| Email address | When you sign in | To create your account and send your sign-in code |
| Full name, phone number | When you complete your profile | So the business preparing your order and the courier delivering it can reach you |
| Student status | Automatically, if your email ends with @metu.edu.tr | Student offers |
| Delivery address (zone, delivery point, address note) | When you add an address | To deliver to the right place |
| Order details (items, options, notes, amount, payment method, coupon, status history) | When you order | To fulfil the order, resolve issues and meet record-keeping obligations |
| Reviews (rating and comment) | When you leave a review | To show business ratings |
| Favourites | When you add a favourite | For your convenience |
| Courier location (couriers only) | While on shift and an order is on the way | So the customer can track the order live |
| Technical logs (IP address, timestamps, error logs) | While you use the service | Security, abuse prevention and fixing errors |
Payment happens on delivery; we do not process or store card details. The customer app does not collect your phone's location.
3. Legal bases
- Performance of a contract: account, address, order and delivery data.
- Legitimate interests: security logs, preventing fraud and abuse, improving the service.
- Legal obligation: keeping accounting and tax records.
- Consent: if we ever send marketing messages, only with your consent, which you can withdraw at any time.
4. Who sees your data
- The business you order from: your name, phone number, delivery point, address note and order contents.
- The courier delivering your order: your name, phone number, delivery point, address note and the amount to collect.
- Our service providers: they process data only on our behalf and on our instructions.
| Provider | Service | Location |
|---|---|---|
| Contabo GmbH | Server hosting (database, sign-in and files on a server we operate) | France (EU) |
| Amazon Web Services (SES) | Sign-in code emails | Germany (Frankfurt) |
| Cloudflare | Website, domain, attack protection, encrypted backups | European Union and global network |
| Expo (650 Industries) | App updates and notifications | United States |
| Sentry | Error reports (personal data masked) | Germany (Frankfurt) |
| Apple, Google | App stores and notification services | Global |
Unless required by law, we do not share your data with anyone else, and we never sell it.
5. International transfers
Your data is stored on servers in the European Union (France). Transfers to providers outside the EU take place only with appropriate safeguards such as the European Commission's standard contractual clauses.
6. Retention
- Account data: until you delete your account.
- Courier location: deleted as soon as the delivery is completed or the order is closed.
- Your name and phone number on an order: deleted 30 days after the order is closed.
- Address and order notes on orders: deleted after 12 months.
- Order records: for the statutory retention period; if you delete your account, your personal details are removed from them.
- Technical logs: up to 30 days.
- Encrypted backups: 30 days.
7. Security
All connections are encrypted with TLS. Phone numbers are additionally encrypted in the database, and backups are encrypted with a key that is not kept on the server and stored with a separate provider. Administrator accounts require two-step verification. Each user can access only their own data, and businesses and couriers only their own orders; this rule is enforced in the database itself. Your session is kept in your phone's secure storage. We use no passwords: you sign in with a one-time code sent to your email.
8. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to object to processing.
- You can correct your profile in the app.
- You can delete your account in the app: see how.
- For other requests, email gizlilik@by1market.com; we reply within 30 days.
If you are not satisfied with our answer, you can complain to the data protection authority where you live.
9. Children
By1Market is not intended for people under 18, and we do not knowingly collect their data.
10. Changes
If we change this policy we update the effective date and announce significant changes in the app.