GroundBox — GDPR Privacy Notice & Data Protection Policy (KMZ-1, KMZ-24)
Version: gdpr-v1 (Legal review completed and approved — 10 November 2026; pilot signup consent version venue-pilot-signup-v1)
Last Updated: 3 November 2026
Implementation Note: This unified GDPR Privacy Notice covers all personal data processing across GroundBox (
https://groundbox.app), including Guest Check-in & Live Queue, Venue Pilot Applications, and Venue Owner / Staff & Spotify Integration, in compliance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) as well as Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Data Controller & Contact Information
For platform authentication, device verification, security rate-limiting, and software infrastructure operations, the Data Controller is:
- Controller: Workouse Yazılım Ltd. Şti. (Turkish tax ID / VKN:
8141022044), operator of GroundBox - Company Website:
https://workouse.com - Privacy Contact:
privacy@workouse.com/kvkk@workouse.com - Service Website:
https://groundbox.app
(Note: Individual hospitality venues using GroundBox are independently responsible for in-venue cash/POS voucher sales, local receipt issuance, and on-premise queue moderation decisions.)
2. Categories of Personal Data, Purposes, and GDPR Legal Bases
GroundBox follows strict data minimization and privacy by design:
| Data Subject Category | Personal Data Processed | Purpose of Processing | GDPR Legal Basis (Art. 6) |
|---|---|---|---|
| 1. Venue Guests | Identity & Verification: Mobile phone number (+90), stored exclusively as a keyed lookup digest (HMAC-SHA256) and authenticated ciphertext (AES-256-GCM) — never stored in plaintext; 6-digit SMS OTP challenge metadata; optional display nickname (defaults to Guest #<random>).Device & Security Metadata: 30-day signed HttpOnly verification cookie; truncated IP subnet (/24 IPv4 or /48 IPv6) and keyed rate-limit hashes; Cloudflare Turnstile bot-verification token.Location Proximity Check: Ephemeral browser GPS check verifying the guest is within $\le 100\text{ metres}$ of the venue at check-in and once every hour while checked in (raw GPS coordinates are never stored in the database). Service & Ledger Activity: Redeemed 5-character venue voucher codes, song requests/boosts, and temporary night moderation status ( banned_until). |
- Verify guest identity via SMS OTP and remember verified devices for 30 days without repeated SMS - Confirm physical presence at the venue during active check-in sessions - Manage the live song queue, venue-scoped credits, and refunds ( Skip & Refund)- Prevent SMS pumping, bot abuse, and voucher brute-forcing |
- Art. 6(1)(b) (Contract / Service Delivery): Phone verification, venue-scoped credit accounting, and song queue management - Art. 6(1)(f) (Legitimate Interests): Fraud prevention, SMS/voucher rate-limiting, Turnstile verification, and abuse moderation - Art. 6(1)(a) (Explicit Consent): Hourly browser location proximity verification while checked in (withdrawable at any time by checking out) |
2. Venue Pilot Applicants (venue-pilot-signup-v1) |
Application & Contact Data: Venue name, contact person’s full name, city, mobile phone number (AES-256-GCM encrypted at rest), preferred language (tr/en), Turnstile verification, and consent version/timestamp. |
- Evaluate pilot venue applications - Contact the venue representative for onboarding and setup |
- Art. 6(1)(b) (Pre-contractual Steps): Evaluating and responding to a venue’s request to join the pilot - Art. 6(1)(a) (Consent): Explicit consent recorded with version and timestamp at submission |
3. Venue Owners & Staff (owner, bartender) |
Account & Role Data: Full/display name, mobile phone number (AES-256-GCM encrypted at rest), staff role (owner, bartender), optional venue tax ID (VKN/TCKN), venue address and coordinates.Operational & Integration Data: Shift logs, voucher issuance/void records, queue moderation actions ( audit_log), and venue-connected Spotify OAuth 2.0 PKCE refresh token (AES-256-GCM encrypted at rest). |
- Authenticate staff and enforce role-based access (owner vs. bartender)- Sync the venue’s live queue with its connected Spotify account - Maintain an immutable audit trail for shift and voucher accountability |
- Art. 6(1)(b) (Contract): Performing the B2B SaaS agreement with the venue - Art. 6(1)(c) & 6(1)(f) (Legal Obligation & Legitimate Interests): Financial/voucher auditability and prevention of staff self-redemption or skimming |
3. Technical & Cryptographic Safeguards (Privacy by Design)
- Application-Layer Encryption at Rest: Phone numbers and Spotify OAuth refresh tokens are encrypted before database storage using AES-256-GCM with unique per-record authenticated context (
guest:<id>:phone,staff:<id>:phone,venue_signup:<id>:phone,venue:<id>:spotify) and versioned keys supporting rotation. Equality lookups use a separate secret pepper with HMAC-SHA256. - Zero Raw Location History: Browser geolocation coordinates are evaluated in memory solely to confirm that the guest is within 100 metres of the venue’s coordinates. Raw guest latitude/longitude pairs are discarded immediately after verification and are never written to D1 or logs.
- Zero Marketing SMS: Phone numbers are used strictly for one-time verification codes (OTP) or requested pilot onboarding contact—never for promotional messages, third-party advertising, or profiling.
- Strictly Necessary Cookies Only: GroundBox uses only first-party, signed,
HttpOnly,SameSite=Lax,Securesession cookies (a 30-day verified-guest cookie, an active check-in cookie, and a staff session cookie). No third-party advertising or cross-site tracking cookies are used.
4. Recipients, Sub-Processors & International Data Transfers
GroundBox does not sell or rent personal data. Data is shared only with essential infrastructure sub-processors under Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs) where applicable under GDPR Chapter V:
| Sub-Processor | Role & Scope | Data Shared | Safeguards |
|---|---|---|---|
| Cloudflare, Inc. | Edge compute (Workers), encrypted database (D1), live queue state (Durable Objects), bot protection (Turnstile), transactional email (Email Sending) | Encrypted database records, request headers/IP for bot & rate-limit protection, PII-minimized pilot signup notification emails | Application-layer AES-256-GCM encryption for PII; EU/Global DPA & SCCs |
| Twilio Inc. | Transactional SMS OTP delivery | Recipient mobile phone number (+90...) and 6-digit verification code during OTP send |
HTTPS TLS in transit; 5-minute OTP validity; Twilio DPA & Binding Corporate Rules / SCCs |
| Spotify AB | Venue playback queue synchronization (POST /v1/me/player/queue) |
Venue owner’s OAuth token and track URIs only (no guest phone numbers or identities are ever sent to Spotify) | OAuth 2.0 with PKCE; encrypted refresh token at rest |
| Functional Software, Inc. (Sentry) | Operational error tracking and alerting | Sanitized application error traces (phone numbers, OTP codes, and credentials are scrubbed before transmission) | PII scrubbing at source; DPA & SCCs |
5. Data Retention & Erasure Schedule (KMZ-24)
| Data Category | Retention Period | Disposal / Anonymization Action |
|---|---|---|
| SMS OTP Challenges & Rate-Limit Windows | 30 days | Automatically purged via scheduled Worker Cron Trigger (DELETE). |
| Turnstile Token Claims & Signup Attempt Buckets | 15 minutes – 30 days | Automatically purged via scheduled Worker Cron Trigger. |
| Remembered Guest Device Cookie | 30 days | Expires automatically in the guest’s browser (or immediately upon revocation). |
| Active Check-in & Hourly Proximity State | Duration of visit (1-hour TTL per check, revoked immediately on checkout or QR rotation) | Raw GPS is never stored; check-in metadata is cleaned up after 30 days. |
Encrypted Guest Phone (guests.phone_encrypted) |
1 year from last venue activity, or immediately upon an erasure request | phone_encrypted is overwritten (erased) and phone_hash is rotated/anonymized while preserving non-identifiable ledger totals. |
Venue Pilot Applications (venue_signups) |
Up to 1 year from submission (or until onboarded/erased) | Encrypted phone ciphertext is erased upon request or expiry. |
Credit Ledger (credit_ledger) & Audit Log (audit_log) |
5 – 10 years (statutory commercial & tax retention) | Retained in append-only form with guest phone PII severed/anonymized. |
6. Your Rights Under the GDPR (Articles 15–22)
Subject to applicable law, you have the right to:
- Access (Art. 15) & Portability (Art. 20): Request a copy of the personal data we hold about you in a structured, machine-readable format.
- Rectification (Art. 16): Update or correct inaccurate information (such as your display nickname or contact details).
- Erasure / “Right to be Forgotten” (Art. 17): Request immediate deletion of your encrypted phone number and unlink your identity from historical song requests and credit ledger entries.
- Restriction (Art. 18) & Objection (Art. 21): Object to processing based on legitimate interests or request restricted processing.
- Withdraw Consent (Art. 7(3)): Withdraw location verification consent at any time simply by tapping “Check out” (
Çıkış yap) on the venue page or revoking browser location permissions. - Supervisory Authority Complaint (Art. 77): Lodge a complaint with your local EU Data Protection Authority or the Turkish Personal Data Protection Authority (KVKK Kurumu).
To exercise any of these rights, contact privacy@workouse.com or use the in-app data export and deletion controls on /en/privacy (or inside the venue check-in privacy dialog). We respond to all verified requests within 30 days.