Protection of personal data is an important issue for Rivabu. ("Rivabu" or "Company"). As the data controller, Rivabu acts in compliance with the principles and obligations set forth by the Personal Data Protection Law No. 6698 (“KVKK”).
This Clarification Text has been prepared to inform you, as the data controller, on how your personal data is processed through the website www.Rivabu.com (“Website” or “Site”), the Rivabu mobile application, and the “GetirAlışveriş” interface located within the Getir mobile application (collectively referred to as the “Mobile Application”).
Personal data processed by Rivabu are as follows:
Member Customer Personal Data
| Data Category | Example Data Types |
|---|---|
| Identity Information | Name, surname, date of birth, gender, ID number |
| Contact Information | Mobile phone, email address, address, postal code, landline |
| Payment Information | Tax office, invoice details, payment method, encrypted credit card details |
| Membership Information | Membership info, membership ID number, password |
| Customer Transaction Info | Purchased products, order amount and date, commercial communication permission, campaigns/contests joined, coupons used, transaction history, product reviews and questions and information shared therein, rating and evaluation data, chatbot conversations |
| Transaction Security Info | IP address, user activity logs |
| Marketing Information | Marketing messages via SMS, email, or call center (if consented), cookie records, targeting info, usage and preference evaluations |
| Visual and Audio Data | Call center voice recordings, photos shared in product reviews |
| Location | Automatically obtained via browser settings or manually provided location data |
| Legal Transaction Information | Service start and end times, type of service, approved membership agreement, other legal documents enabling service use |
| Request and Complaint Info | Complaints and/or requests submitted via Site, Mobile App, social media, or call center, and related records |
We process your personal data based on the legal grounds listed in Article 5 of KVKK. The table below details the purposes and legal reasons for processing by Rivabu:
[Table matches Turkish original — summarizing:]
Purposes include: complying with legal obligations, verifying membership info, receiving/managing orders, managing delivery and payment processes, customer support, detecting fraud or legal violations, product/service improvement, marketing communications (with consent), etc.
Legal Grounds include:
Explicit legal requirements (KVKK Art. 5/2-a)
Contract necessity (KVKK Art. 5/2-c)
Legal obligations (KVKK Art. 5/2-ç)
Protection of legal rights (KVKK Art. 5/2-e)
Legitimate interests (KVKK Art. 5/2-f)
Explicit consent (KVKK Art. 5/1)
Notably, payment information is temporarily stored for 15 minutes for a seamless shopping experience, in compliance with PCI DSS standards and without access by Rivabu or third parties.
Rivabu obtains personal data via electronic channels such as the Website, Mobile Application, call center, and email — fully or partially automated. In some cases, data may be collected physically in a non-automated way but as part of a data recording system (e.g., documents sent via post).
Rivabu shares personal data only for the purposes specified in this Clarification Text and in compliance with Articles 8 and 9 of KVKK.
Recipient Groups and Purposes:
Authorized persons, institutions, and organizations: For legal compliance and obligations (e.g., regulatory disclosures).
Sellers and logistics companies: For order fulfillment and delivery.
Service providers and business partners: For audits, reporting, improving services, and better customer experience.
Suppliers, business partners, authorized payment institutions: For payment processing, order notifications, and support infrastructure (e.g., email systems).
International Data Transfers:
If data is transferred abroad (e.g., to cloud service providers or foreign sellers), this is done in compliance with Article 9 of KVKK and relevant regulations, using standard contracts with adequate safeguards.
According to Article 11 of KVKK, you have the right to:
Learn whether your personal data is processed,
Request information if processed,
Learn the purpose of processing and whether used accordingly,
Know third parties to whom data is transferred in or outside Turkey,
Request correction of incomplete or incorrect data,
Request deletion/destruction of data per Article 7 of KVKK,
Request notification of corrected or deleted data to third parties,
Object to negative outcomes from automated processing,
Request compensation for damages due to unlawful data processing.
You can exercise your rights through your account on the “My Account” section of the Website or Mobile App or by the following methods:
You may also apply using the methods stated in the "Communiqué on the Procedures and Principles of Application to the Data Controller."
Rivabu uses cookies on www.Rivabu.com. Details on the types, purposes, and durations of cookies can be found in the Cookie Policy. Please review the Cookie Policy for more information.
Rivabu may change this Clarification Text at any time. Such changes will become effective upon publication of the updated version. You will be notified appropriately of any updates.
Last Updated: December 2025
