1. Data Collected
• Location data (with consent)
• Device information (model, operating system, device ID, network)
• Usage data (features, error logs, statistics)
• Profile data (name, surname, e-mail, photo)
• Cookies (strictly necessary, analytics, marketing, location-based).
• Push notification tokens, notification preferences, and device identifiers (within the scope of the push notification infrastructure)
• Campaign measurement data (one-way value derived from the IP address, general technical characteristics of the device, installation identifier) – see Section 5
See Cookie Policy for details.
2. Purposes and Legal Basis
• Service provision and contract (KVKK Art. 5/2-c)
• Security, debugging, analytics (KVKK Art. 5/2-f)
• Marketing and personalization (explicit consent, KVKK Art. 5/1)
• Sending push notifications (instant notifications via the mobile application), promotional and informational communications (with explicit consent, pursuant to Article 5/1 of the Turkish Personal Data Protection Law – KVKK)
• Measuring campaign performance (legitimate interest, KVKK Art. 5/2-f; GDPR Art. 6(1)(f) for users in the EEA) – see Section 5
3. Transfers
• Technical service providers
• Law firms
• Public authorities (legal requirement)
• Push notification service providers (e.g., OneSignal or similar services)
4. Push Notifications
• Push notifications (instant notifications sent to your device via the mobile application) in our application may be delivered through OneSignal or similar third-party infrastructures.
• Within this scope, device information, notification tokens, and interaction data may be transferred to servers located abroad.
• Push notifications are sent only based on the user’s explicit consent. The user may disable notifications at any time through their device settings.
5. Campaign Measurement
In order to measure the effectiveness of our promotional activities and to understand which campaigns result in app installations, we process a limited set of measurement data when a campaign link is clicked and when the app is opened for the first time.
Data processed: When a campaign link is clicked, a one-way value is derived from your IP address using a secret key, and the raw IP address is not stored; in addition, general technical characteristics of the device (screen size, time zone, language, operating system version) are processed. When the app is opened for the first time, a randomly generated installation identifier created by the app, together with the same technical information, is processed in order to associate the campaign click with the installation. This association is carried out within a limited time window; its purpose is not to identify you personally, but to measure campaign performance.
Legal basis: This processing is carried out on the basis of our legitimate interest in measuring the effectiveness of our promotional activities and evaluating the performance of our campaigns, pursuant to Article 5(2)(f) of the Turkish Personal Data Protection Law (KVKK No. 6698) and, for users located in the European Economic Area, Article 6(1)(f) of the General Data Protection Regulation (GDPR).
Right to object: Users located in the European Economic Area have the right to object at any time, on grounds relating to their particular situation, to this processing. If you object, we will stop processing your data for campaign measurement purposes. You can submit your objection through the channels described in Section 8.
Sharing and advertising: Data processed in this context is not shared with third parties and is not used for advertising targeting or personalised advertising. Advertising identifiers (IDFA/IDFV) are not used, and no cookies are used for this measurement.
Retention: Campaign click records are deleted within 30 days at the latest. Technical device characteristics contained in installation records are removed once the record is older than 90 days; the remaining installation information (campaign name, date and installation identifier) continues to be retained for campaign analysis purposes. Aggregate statistics that do not allow individuals to be identified may be retained indefinitely.
Account deletion: If you delete your account, the link between your account and the campaign information (the campaign record and the installation identifier) is deleted.
6. Retention
• Membership data: 30 days after account deletion
• Consumer transactions: 10 years
• Campaign measurement data: see Section 5
• Cookies: depending on type, session / 6–12 months / until deleted.
See Cookie Policy for details.
7. Rights (KVKK Art. 11)
• Right to learn whether data is processed
• Right to request information
• Right to request correction, deletion, anonymization
• Right to learn recipients of transfers
• Right to object to processing
• Right to claim damages if unlawfully processed
8. Requests
You may submit your requests in writing or by e-mail to hello@lukal.app.
Requests will be finalized within 30 days free of charge (fees may apply if additional costs are incurred).