BilardoBase — Privacy policy

This English text is a translation provided for convenience. In case of any conflict, the Turkish version prevails.

This privacy policy and information notice applies to the BilardoBase desktop software, the BilardoBase waiter mobile app and the related cloud service (together, the “Service”). It has been prepared under the information obligation in Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”). This notice is also shown to you when you install the software and create an account.

1. Data controller and roles

Service provider: RumiSoft — mc@rumisoft.com.tr — rumisoft.com.tr

BilardoBase holds two different groups of data, and responsibility differs for each:

• Account and license data (information about the business owner and authorized persons): RumiSoft is the data controller for this data.
• Business data (customer, customer credit, staff, player and sales records the hall enters into the software): the business itself is the data controller for this data. RumiSoft is only a data processor that stores this data on the business's behalf to provide the Service; it does not use, inspect, sell or share this data for its own purposes.

2. Data we process

a) Account and license data

• Identity and contact: full name, business name, email address, phone number.
• Sign-in data: when signing in with Google, the name, email and profile ID shared by Google; when signing in with email, the email address and a securely stored (hashed) password.
• License and payment: license type, trial start/end date, server service period, billing details.
• Technical data: device and operating system information, software version, session and sync logs, error logs.
• Support correspondence: information you send us via WhatsApp or email.

b) Business data (stored on the business's behalf)

• Customer records: name, phone, notes, credit/balance and payment history.
• User and staff records: user name, role, page permissions, password/PIN (hashed), activity history.
• Tournament records: player names, match-ups, scores and statistics.
• Operational records: table sessions, order tabs, product and stock data, register transactions, expenses, partner accounts and reports.

The Service is not designed to process special categories of personal data (health, biometric data, etc.); please do not enter such data into the software.

3. Purposes and legal bases

• Creating the account, authentication, managing the license and trial period — formation and performance of a contract (KVKK Art. 5/2-c).
• Storing data in the cloud, syncing between the computer and waiters' phones, and backups — performance of a contract (Art. 5/2-c).
• Billing, accounting and legal retention obligations — legal obligation (Art. 5/2-ç).
• Service security, fixing errors, preventing misuse and technical support — legitimate interest (Art. 5/2-f).
• Protecting rights in possible disputes — establishment, exercise or protection of a right (Art. 5/2-e).

Your data is not used for advertising, profiling or marketing and is not sold to third parties.

4. How data is collected

Data is collected electronically, by automated and partly automated means, through the information you enter into the software and the waiter app, the Google sign-in service, technical logs created during sync, and your correspondence with us.

5. Transfers and international transfers

Google Firebase / Google Cloud services are used as the cloud infrastructure (authentication, database and backups). Google is a service provider processing data on RumiSoft's behalf, and its servers may be located outside Turkey. Data may therefore be transferred abroad in line with the safeguards set out in KVKK Article 9 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (such as standard contracts announced by the Personal Data Protection Board).

Otherwise, data is shared only to the extent necessary: upon request of legally authorized public authorities, under legal obligations, and with accountants / e-invoicing service providers for billing.

6. Retention and security

• When there is no internet connection, transactions are stored locally on your computer and added to the cloud when the connection returns. Local data depends on the security of the computer the software is installed on; preventing unauthorized access to your computer is your responsibility.
• Cloud data is kept in a separate area for each business that only that account can access. Communication takes place over an encrypted connection (TLS).
• A waiter's phone connects only with a single-use QR code or 8-digit code valid for 15 minutes; the business decides which actions the waiter can see.
• Account and business data are retained as long as the account is active and the server service continues.
• When the trial or the server service ends and is not renewed, cloud data is kept for a further 90 days; during this time you can request an export of your data. After 90 days, cloud data and backups are deleted or anonymized.
• Invoice and accounting records are kept for the period required by law (5–10 years under the Turkish Tax Procedure Law and Turkish Commercial Code).

7. Deleting your account and data

You can request deletion of your account and all related cloud data at any time. This option is available even if you have already uninstalled the software or the app:

• From the email address registered to your account, send an email to mc@rumisoft.com.tr with the subject “BilardoBase account deletion request”.
• Once your identity is verified, your account, business data and cloud backups are deleted within 30 days at the latest; you will be notified when this is complete.
• Invoice records we are legally required to keep are retained separately for the retention period and not used for any other purpose.
• Local data on your computer is deleted when you uninstall the software or delete the local data folder.

Deletion cannot be undone. We recommend exporting any reports you need before deletion.

8. Your rights

Under KVKK Article 11, you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request deletion or destruction within the conditions of KVKK Article 7 and notification of these actions to third parties to whom it was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation if you suffer damage due to unlawful processing.

If you are located outside Turkey, you may also have rights under the data protection law of your country. You can send all requests to mc@rumisoft.com.tr. Requests are answered free of charge within 30 days at the latest.

9. Businesses' obligations towards their own customers

A business that enters customer, staff or player information into the software is the data controller towards those people. The business is responsible for informing them as required by applicable law, obtaining their consent where necessary and responding to their requests. You can carry out deletion or correction requests from your customers yourself within the software, and ask us for technical support if needed.

10. Waiter mobile app

• Camera: used only to scan the connection QR code, when you allow it; images are not saved or sent to the server.
• Internet: used to sync order and table data; this can be Wi-Fi or mobile data.
• The app does not access location, contacts, microphone or photo gallery data.

11. Children's privacy

The Service is business software and is not intended for account creation by anyone under 18.

12. Changes

This notice may be updated when the law, the Service or the infrastructure used changes. Significant changes are announced in the software or by email. The current version is always published on this page.