1. Introduction

This Privacy Policy explains how Pupas Teknoloji Yatırımları Danışmanlık Anonim Şirketi ("Company"), as operator of the OpenRez platform, processes personal data in connection with the https://openrez.co domain and related websites ("Site"), including contact, demo, and similar digital channels.

We take the careful processing of your personal data seriously. This document describes what data we process, how and for how long, with whom it may be shared, and your rights.

This Privacy Policy is prepared under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK" or the "Law"), related regulations, and Personal Data Protection Board decisions. It applies together with the KVKK General Privacy Notice under Art. 10 and does not replace that notice.

Please keep your information accurate and up to date and notify us of any changes during our relationship.

2. Third-party links

The Site may contain links to third-party websites, plugins, or applications. Using those links may allow third parties to collect or share data about you. The Company does not control third-party sites and is not responsible for their privacy practices.

3. Data controller

Data controller: Pupas Teknoloji Yatırımları Danışmanlık Anonim Şirketi.

Digital contact: legal@pupas.co

Postal address: Barbaros Mah. Şebboy Sok. No:4/1 İç Kapı No:2, 34634 Ataşehir / İstanbul

Registered electronic mail (KEP): pupasteknoloji@hs06.kep.tr

Website: https://openrez.co

The Company provides reservation management, operations, and guest experience technology for hospitality businesses through the OpenRez platform.

4. Personal data categories processed

Personal data means any information relating to an identified or identifiable natural person. The Company may process data in the categories listed below:

Identity data First name, last name, and similar identity information.
Contact data Email address, phone number, and correspondence addresses.
Business / company data Organization name, role, and similar information about your business relationship.
Request and content data Messages, requests, and correspondence submitted via forms, email, or appointment channels.
Appointment data Meeting date, time, subject, and link information.
Technical and usage data IP address, browser type and version, device / OS information, timezone, page views, interaction records, security verification results, and server logs.
Consent records Explicit consent, marketing consent, cookie preferences, timestamps, source, and document version references.
Marketing and communication preferences Your preferences for commercial electronic messages and information.
Application data CV, application form, and information provided during interviews when you submit a job or internship application.

5. Special categories and automated decision-making

The Company does not generally process special categories of personal data under KVKK Art. 6 in Site processes. If such data is submitted, unnecessary data is deleted or not processed; where processing is mandatory, conditions under the Law are followed.

The Company does not make decisions based solely on automated systems that produce legal effects or similarly significant effects concerning you.

6. Failure to provide data

Where personal data is required by law or for establishing / performing a contract, failure to provide it may prevent us from fulfilling your request, running contact or appointment processes, or establishing a contract.

7. Collection methods

Your personal data may be collected through:

Direct interaction: data you provide via contact and support forms, appointment tools, email, phone, or other correspondence channels on the Site.

Automated methods: technical and usage data via cookies, server logs, and similar technologies during your interaction with the Site. See the Cookie Policy for details.

Third-party sources: open sources or legitimate business development channels, only to the extent appropriate to the purpose and legal basis.

8. Processing purposes and legal bases

Your personal data is processed only where permitted under the Law. The table below summarizes main activities:

Processing Purpose	Data Categories	Legal Basis
Site visits: operation, performance measurement, statistical analysis, service improvement, and new product / service development.	Identity (limited); contact (via forms); technical; usage; marketing and communication preferences (where applicable).	KVKK Art. 5/2 (f) legitimate interest; Art. 5/1 explicit consent where required for analytics / marketing cookies.
Receiving, recording, responding to, and tracking contact, support, and demo requests.	Identity; contact; business / company; request and message content; appointment; consent records; technical.	KVKK Art. 5/2 (c) pre-contract / performance; Art. 5/2 (f) legitimate interest; Art. 5/1 consent where cross-border transfer applies.
Customer / prospect relationship management, business development, and proposal processes.	Identity; contact; business / company; correspondence and request content; CRM records.	KVKK Art. 5/2 (c) and/or (f); contract performance where a contract is established.
Commercial electronic messages (product / service promotion, information, newsletter) — only with consent.	Identity; contact; marketing and communication preferences; consent records.	KVKK Art. 5/1 explicit consent; Law No. 6563, related regulations, and IYS obligations.
Security of the site and information systems, abuse prevention, incident detection, and technical maintenance.	Technical; usage; transaction security; identity / contact where necessary.	KVKK Art. 5/2 (f) legitimate interest; Art. 5/2 (ç) legal obligation (where applicable).
Fulfilling legal obligations, dispute resolution, establishment, exercise, or protection of rights.	Categories required by the relevant process; consent and transaction records.	KVKK Art. 5/2 (ç) legal obligation; Art. 5/2 (e) establishment / protection of rights.
Evaluation of job / internship applications (where submitted).	Identity; contact; CV and application content; interview and evaluation notes.	KVKK Art. 5/2 (c) and/or (f); Art. 5/1 consent where retained in a long-term talent pool.

9. Transfers of personal data

Your personal data may be transferred to processors (hosting, CDN, cybersecurity, email, CRM, analytics, ad measurement, appointment services, and similar), professional advisers, and public authorities where required, in compliance with the Law.

Contractual and technical safeguards are applied with processors.

10. Cross-border transfers

Your personal data may be transferred abroad under KVKK Art. 9 and related regulations via adequacy decisions, appropriate safeguards, statutory exceptions, or your explicit consent where required.

Detailed information and explicit consent for cross-border transfer in forms and appointment processes are set out in the Cross-Border Data Transfer Explicit Consent Text.

11. Retention periods

Personal data is retained for as long as the processing purpose requires and as mandated by applicable law. When retention ends or processing conditions cease, data is deleted, destroyed, or anonymized.

12. Data security

The Company implements appropriate technical and organizational measures under KVKK Art. 12 to prevent unlawful processing of or access to personal data.

13. Cookies and similar technologies

Cookies and similar technologies may be used on the Site. See the Cookie Policy for types, inventory, legal bases, and preference management.

14. Commercial electronic messages

Commercial electronic messages require consent under Law No. 6563 and IYS rules. Details are in the Commercial Electronic Message Approval Text. Withholding consent does not prevent you from submitting contact or appointment requests.

15. Definitions

Legitimate interest: the Company's interests in operating its activities — such as site security, communication management, business development, and service improvement — without harming your fundamental rights and freedoms.

Establishment or performance of a contract: processing necessary to take steps to enter into a contract or perform an existing contract.

Legal obligation: processing necessary to fulfil an obligation under applicable law.

Explicit consent: consent given on an informed basis and with free will on a specific matter (KVKK Art. 3).

16. Data subject rights

Under KVKK Art. 11 you may learn whether data is processed, request information, request correction or deletion, learn recipients, and exercise other rights listed in the Law.

You may submit requests to legal@pupas.co or via KEP. Requests are concluded within thirty days at the latest.

17. Updates

This Privacy Policy may be updated due to material changes in legislation, processing activities, or service providers. The current version is published on the Site.

18. Contact

Digital contact: legal@pupas.co

Postal address: Barbaros Mah. Şebboy Sok. No:4/1 İç Kapı No:2, 34634 Ataşehir / İstanbul

Registered electronic mail (KEP): pupasteknoloji@hs06.kep.tr