Privacy Policy

Last updated: January 29, 2026

1. Introduction

Welcome to Miterra Coffee. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our mobile application and services. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the application.

2. Data Controller

Miterra Coffee ("Company", "we", "us", or "our") is the data controller responsible for your personal information.

Contact Information:

• Address: Uludağ University, Görükle, Street No:1, 16000 Bursa, Turkey
• Email: privacy@miterracoffee.com

3. Information We Collect

We collect the following types of personal information through our mobile application:

Data Category	Data Types
Identity Information	First name, last name
Contact Information	Phone number, email address
Transaction Information	Purchase history, coffee points, free coffee rewards, campaign participation
Technical Information	Device ID, session information, login dates
Marketing Preferences	Notification preferences, push notification token

4. How We Use Your Information

We use your personal information for the following purposes:

4.1 Service Provision

• Creating and managing your account
• Operating our loyalty program (earning and redeeming points)
• Authenticating your identity and securing your account
• Processing QR code transactions
• Providing customer support

4.2 Communications

• Sending campaign and promotional notifications (with your consent)
• Announcing service updates
• Responding to customer inquiries

4.3 Improvement and Analytics

• Improving service quality
• Enhancing user experience
• Conducting statistical analysis
• Preventing fraud and ensuring security

5. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Contract performance: To provide our loyalty program services
• Consent: For marketing communications and promotional notifications
• Legitimate interests: To ensure service security and prevent fraud
• Legal obligations: To comply with applicable laws and regulations

6. Information Sharing and Disclosure

We may share your personal information with the following parties:

Recipient	Purpose
Google Firebase (USA)	Authentication, data storage, push notifications
Legal Authorities	Compliance with legal obligations

7. How We Collect Information

We collect your personal information through the following methods:

• During registration and use of the mobile application
• Through OTP codes sent via SMS
• During QR code scanning operations
• Through push notification preferences

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this privacy policy and to comply with legal obligations:

• Active accounts: While your account remains active
• Inactive accounts: 3 years from the last transaction
• Financial records: As required by law (10 years)
• Account deletion request: Deleted within 30 days of the request

9. Your Privacy Rights

You have the following rights regarding your personal information:

1. The right to know whether your personal data is being processed
2. The right to request information about the processing if it has taken place
3. The right to know the purpose of processing and whether data is used accordingly
4. The right to know the third parties to whom data is transferred
5. The right to request correction of incomplete or inaccurate data
6. The right to request deletion or destruction of data under certain conditions
7. The right to request notification of corrections, deletions, or destructions to third parties
8. The right to object to automated decision-making
9. The right to claim compensation for damages resulting from unlawful processing

10. How to Exercise Your Rights

To exercise any of the above rights, you may:

Your request should include:

• Your full name and signature (for written requests)
• Your ID number or passport number
• Your contact address or email address
• Details of your request

We will respond to your request within 30 days, free of charge. However, if the process requires additional costs, we may charge a fee as determined by the relevant data protection authority.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure authentication mechanisms
• Regular security assessments
• Access controls and monitoring

12. Children's Privacy

Our services are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately.

13. Third-Party Services

Our application may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this privacy policy from time to time. Significant changes will be notified through in-app notifications. The "Last updated" date at the top of this policy indicates when it was last revised.

15. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at: