This text is a draft under legal review. Last updated: 9 November 2026
Privacy Policy
Last updated: 9 November 2026
This policy explains how your personal data is processed when you use the Gurme Cep mobile app (the "App"). It is intended to serve as the information notice required by the Personal Data Protection Law No. 89/2007 of the TRNC.
1. Data controller
- Company: Gurme Cep
- Email: destek@gurmecep.com
2. What the service is
Gurme Cep is an ordering platform that connects you with restaurants in Northern Cyprus. The restaurant prepares and delivers your order itself. There is no in-app payment: you pay the restaurant on delivery, in cash or by card. The platform does not collect money from you.
3. Data we collect and why
| Data | Purpose |
|---|---|
| Phone number (verified by SMS) | Sign-in, account security, confirming orders are genuine, letting the restaurant call you about delivery |
| Name | Saying who the order is for, personalising your account |
| Delivery addresses (map location, building, floor, apartment, directions) | Checking whether your address is in a delivery area and delivering the order |
| Order history (items, amounts, statuses, times) | Processing the order, showing your history, commission calculation between the restaurant and the platform, accounting records |
| Reviews and ratings | Informing other users about restaurants |
| Delivery confirmation ("received / not received") | Handling complaints and disputes |
| Favourites | Showing your favourite restaurants |
| Push notification token | Sending order status notifications; only if you opted in, sending offer and campaign notifications |
| Marketing notification preference (on/off and when consent was given) | Sending campaign notifications only to people who opted in, and being able to show when consent was given |
| Invite code and invite relationship (who invited whom, whether the reward was granted) | Running the refer-a-friend programme and preventing abuse |
| Loyalty card status (number of delivered orders from a restaurant) | Calculated from your order history to show and apply your reward |
| Language preference (Turkish / English) | Showing the App in your language |
| Location | Only when you allow it: showing nearby restaurants and marking an address. You can use the App without it by marking the address by hand. |
| Technical error data (Sentry) | Finding and fixing App errors. Not enabled yet; once enabled, only technical data is collected, personal data is filtered out and the user is represented only by a random ID. |
What we do not do: we show no ads, we do not track you for advertising, and we do not sell your data. We send no marketing emails. Offer and campaign notifications are off by default; they are sent only if you turn them on in the app's notification settings, and you can turn them off at any time. This choice does not affect order status notifications. The person who invited you, or whom you invited, sees none of your order details beyond whether a reward was granted.
4. Legal bases
We process your data on these bases:
- Performance of a contract: taking your order, passing it to the restaurant, delivery.
- Legitimate interest: preventing fraud and abuse, fixing errors, security.
- Legal obligation: financial and commercial record-keeping.
- Consent: device permissions such as location and notifications, and campaign notifications, work only with your approval. You can withdraw device permissions in your device settings and campaign notification consent in the app's notification settings at any time.
5. Who we share data with
- The restaurant you order from: your name, phone number, delivery address and order contents are shared only for delivery. A restaurant sees only its own orders. Restaurants may not use this data for marketing and must not keep it after delivery.
- Infrastructure and hosting providers (processors):
- Supabase — database and authentication. Server region: an EU region is planned.
- Vercel — hosting of the restaurant and admin web panels.
- Apple and Google notification services and the Expo push service — delivering notifications to your device.
- SMS provider — sending the verification code.
- Sentry — error tracking; only once enabled.
- Authorities: courts and public authorities where the law requires it.
We do not sell or rent your data to anyone else.
6. International transfers
Our providers may be located outside the TRNC (for example in EU countries or the USA), so your data may be transferred abroad. Transfers rely on contracts with the providers and appropriate safeguards.
7. Retention and deletion
- Account deletion: you can delete your account at any time in the App: Account → Delete account. You cannot delete the account while an order is in progress; delete it once the order is finished.
- After deletion your account and profile are removed. Past orders are kept, for accounting and commission records, with personal information removed: name, phone and order note are deleted, the address is anonymised and the location is rounded to about 1 km. Your name is removed from your reviews.
- Notification queue records are deleted after 30 days.
- Retention period for financial records:. Other retention periods:.
8. Your rights
Under Law No. 89/2007 you have the following rights:
- To learn whether your data is processed and request information,
- To have incomplete or wrong data corrected,
- To have your data deleted or destroyed (you can also do this in the App),
- To object to processing,
- To learn which third parties received your data,
- To claim compensation if you suffer damage.
How to apply: write to destek@gurmecep.com. We may ask you to confirm the phone number on your account to verify your identity. We will answer within. You may also complain to the competent authority.
9. EU / GDPR users
If you are an EU citizen or live in the EU and your data is processed within the scope of the General Data Protection Regulation (GDPR), you can also contact destek@gurmecep.com to exercise your GDPR rights (access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority).
10. Children
Gurme Cep is not intended for people under 18 to open accounts. If we find an account of a person under 18, we delete the account and its data.
11. Security
In general we use: encrypted communication, access rules so each user can reach only their own data, calculations and authorisation done on the server, limited access to the admin panel, and regular security reviews. No system is risk-free; if a data breach occurs we will inform you and the competent authority as the law requires.
12. Changes
We may update this policy. We will announce important changes in the App. The current text is always at gurmecep.com/gizlilik.