Privacy Policy
Last updated:
This policy explains how Hade ("Hade", "we") processes the personal data collected through the hadecyprus.com website and its waitlist and contact forms. Hade is in its pre-launch phase; when the mobile app launches, this policy will be extended and the new version announced on this page.
Personal data is processed under the Turkish Republic of Northern Cyprus Personal Data Protection Law No. 89/2007. Visitors resident in the European Union are additionally granted the rights set out in the General Data Protection Regulation (GDPR).
1.Data controller
The data controller is Hade (TRNC). The company name and registered address will be added here once incorporation is complete. For any privacy question or request: merhaba@hadecyprus.com.
2.Data we collect
We collect only what you type into the forms and the minimum technical data needed to keep the forms secure.
| Source | Data | Required? |
|---|---|---|
| Waitlist form | Full name, phone number, city, role (rider / driver / both), language preference | Yes |
| Waitlist form | Email address, university, ideas and suggestions text | No (optional) |
| Contact form | Full name, subject, message; email and/or phone (at least one) | Yes |
| Automatic | Consent timestamp and the policy version you accepted | Yes |
| Automatic | Salted and hashed IP address — the raw IP is never stored | Yes |
| Automatic | Browser information (user agent) | Yes |
| Automatic | Traffic source: UTM parameters (utm_source, utm_medium, utm_campaign, utm_content), referring page, landing path | If present |
| Cookies | Your cookie choice; Meta Pixel cookies if you consented | See Cookie Policy |
We do not collect payment details, identity documents or location data. Driver verification (ID, licence, registration) will start with the mobile app and be covered by a separate policy.
3.Purposes and legal basis
| Purpose | Data used | Basis |
|---|---|---|
| Keeping the waitlist and notifying you at launch (SMS, WhatsApp, email) | Name, phone, email, role, language | Explicit consent (form checkbox) |
| Planning which city launches first and in what order | City, university, role (aggregate statistics) | Legitimate interest |
| Answering your questions | Contact form data | Legitimate interest / fulfilling your request |
| Preventing abuse and bots, rate limiting | Hashed IP, browser information, Turnstile verification | Legitimate interest (security) |
| Understanding which channel you came from (e.g. the Instagram bio link) | UTM parameters, referring page | Legitimate interest |
| Measuring our Instagram ads | Meta Pixel cookies | Only your consent to marketing cookies |
We do not use your data for any other purpose and we do not profile you or make automated decisions.
5.International transfers
The providers above host data outside the TRNC, mainly in the European Union and partly in the United States. Transfers rely on the providers' standard data processing agreements and the EU Commission's standard contractual clauses.
6.Retention periods
| Data | Period |
|---|---|
| Waitlist record | At most 12 months after launch; earlier on request |
| Contact messages | 24 months after reply |
| Rate-limit counters (hashed IP) | 24 hours |
| Email delivery log | 12 months |
| Cookie choice | 12 months (in your browser) |
| Meta Pixel cookies | 90 days (Meta's policy) |
Expired data is deleted or anonymised so it can no longer be linked to a person.
7.Your rights
Under Law No. 89/2007 you have the right to:
- Learn whether your data is processed and request information about it
- Learn the purpose of processing and whether it is used accordingly
- Request correction of incomplete or inaccurate data
- Request deletion or destruction of your data
- Object to processing and withdraw your consent at any time
If you are resident in the European Union, the GDPR additionally grants you the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, and complaint to the supervisory authority of your country.
Send your request to merhaba@hadecyprus.com stating the phone number or email you registered with. After verifying your identity we reply within 30 days at the latest. To stop launch messages, use the link in the message or simply reply "stop".
8.Security
- All connections are encrypted (TLS); the site is served over HTTPS only.
- Only the server talks to the database; no secret key is ever sent to the browser.
- Admin access requires email, password and mandatory two-factor authentication (TOTP); every action is written to an audit log.
- IP addresses are stored only in hashed form; raw IPs are not recorded.
- We collect the minimum data necessary (data minimisation).
9.Age limit
Hade is intended for people aged 18 and over. By joining the waitlist you confirm you are at least 18; if we identify data belonging to a person under 18 we delete it.
11.Changes
When we update this policy we publish the new version on this page and update the date. The version you accepted on the waitlist form is stored with your record; material changes affecting your rights are also announced through your registered contact details.