This information notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data and to the provisions of the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. Our purpose is to tell you clearly for what purposes and on what legal grounds we process your personal data.
Identity of the Data Controller
Pursuant to Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller is the business whose identity and contact details are set out below.
- Trade name: KMU Mehmet Usta Restoran
- Address: Taşpazar Mahallesi Mahallesi, Aksaray, 68100 Aksaray, Türkiye
- Telephone: +90 382 502 50 00
- E-mail: kardeslermehmetusta@gmail.com
- Website: kmumehmetusta.com
Personal Data We Process
Depending on the nature of our relationship with you, the following categories of data may be processed:
- Identity data: first name, surname.
- Contact data: telephone number, e-mail address.
- Reservation data: the date and time of the reservation, the number of guests, table or area preference, special-occasion information and any notes you send us.
- Request and complaint data: the content of messages you send through the contact form, by e-mail, by telephone or via social media.
- Transaction security data: IP address, browser and device information, on-site navigation records, cookie records.
- Visual and audio data: security camera recordings on the premises; and, where you have given explicit consent, photographs and videos used for promotional purposes.
- Marketing data: where you have given explicit consent, your preferences for the e-mail newsletter and campaign communications.
Information that may constitute health data — a dietary restriction, an allergy or similar — is processed only if you choose to share it of your own accord, solely so that your order can be prepared safely, and we do not retain that information once service is complete.
Purposes of Processing
- receiving, confirming and managing reservation requests,
- providing our restaurant services and carrying out service processes,
- responding to and resolving your requests, suggestions and complaints,
- measuring guest satisfaction and improving service quality,
- ensuring the safety of the business and of our guests,
- keeping invoicing and accounting records,
- fulfilling our legal obligations and providing information to official authorities,
- where you have given explicit consent, sending promotional, campaign and newsletter communications,
- operating, securing and improving our website.
Legal Grounds for Processing
Your personal data is processed on the following legal grounds, set out in Article 5 of the KVKK:
- Art. 5(2)(c) — Conclusion or performance of a contract: necessary in order to receive your reservation request and to provide the service.
- Art. 5(2)(ç) — Legal obligation: our record-keeping and retention obligations arising from tax, commercial and food legislation.
- Art. 5(2)(e) — Establishment and protection of a right: so that the data may be used as evidence in the event of a dispute.
- Art. 5(2)(f) — Legitimate interest: the security of the business, the measurement of service quality and the security of the site.
- Art. 5(1) — Explicit consent: marketing communications, non-essential cookies and the use of images for promotional purposes.
Method of Collection
Your personal data is collected by wholly or partly automated means through the reservation and contact forms on our website, telephone calls, e-mail, WhatsApp, our social media accounts, the security camera system on the premises and cookies.
Transfer of Personal Data
Subject to compliance with the conditions laid down in Articles 8 and 9 of the KVKK, your personal data may be transferred to the following groups of recipients:
- our accounting and financial advisory service providers,
- our IT infrastructure, hosting and e-mail service providers,
- the software providers used in our reservation and communication processes,
- our legal advisers and independent audit firms,
- where requested, competent public institutions and judicial authorities.
Because of the measurement and advertising tools used on our website, some of your data may be transferred to servers located abroad: Google LLC (Google Analytics, Google Ads — United States), Yandex LLC (Yandex Metrica — Russian Federation). Such a transfer takes place only if you consent to the relevant cookie category (analytics and/or marketing), on the basis of your explicit consent and within the conditions of Article 9 of the KVKK.
Retention Periods
- Reservation records: 2 years from the provision of the service.
- Invoice and accounting records: 5 years under the Tax Procedure Law, and 10 years for documents falling within the scope of the Turkish Commercial Code.
- Contact form and correspondence records: 2 years from the conclusion of the request.
- Security camera recordings: a maximum of 30 days; where an incident is identified, until the dispute is concluded.
- Cookie records: for the periods stated in our Cookie Policy.
- Marketing permissions: until you withdraw your permission.
Personal data whose retention period has expired is deleted, destroyed or anonymised as part of our periodic destruction processes, in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
Your Rights as a Data Subject
Under Article 11 of the KVKK you have the following rights:
- to learn whether your personal data is being processed,
- to request information if it has been processed,
- to learn the purpose of processing and whether the data is used in accordance with that purpose,
- to know the third parties, in Türkiye or abroad, to whom the data has been transferred,
- to request the correction of data processed incompletely or inaccurately,
- to request its erasure or destruction where the conditions are met,
- to request that correction, erasure and destruction operations be notified to the third parties to whom the data has been transferred,
- to object to an adverse outcome arising from analysis carried out by automated systems,
- to claim compensation if you suffer loss as a result of unlawful processing.
How to Apply
To exercise your rights you may apply in writing, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, or through registered electronic mail, a secure electronic signature, a mobile signature, or the e-mail address you have previously notified to us and which is registered in our system. Your application will be concluded free of charge as soon as possible and in any event within thirty days of reaching us. Where the process entails an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.
- Address for written applications: Taşpazar Mahallesi Mahallesi, Aksaray, 68100 Aksaray, Türkiye
- E-mail: kardeslermehmetusta@gmail.com
If your application is rejected, if you find the response inadequate, or if no response is given within the prescribed period, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of your application.
Updates
This information notice may be revised in line with legislative changes and updates to our business processes. The current text is always published on this page.
The Turkish version of this text is authoritative; in the event of any discrepancy, the Turkish text prevails.