PURPOSE AND SCOPE

This Personal Data Protection and Processing Privacy Notice ("Privacy Notice") has been prepared regarding personal data processed within the scope of mobile applications, web applications, management panels, API services, QR menu systems, reservation systems, order management systems, augmented reality features and other digital services provided by RESTODAN.

This Privacy Notice covers end users, restaurant partners, restaurant representatives and employees, courier partners, integrators, suppliers, visitors and other data subjects using the Platform.

The purpose of this text is to provide transparent information regarding the purposes for which personal data is processed, the legal bases relied upon, to whom it may be transferred, how long it may be retained and the rights of data subjects.

This text is not an explicit consent form. Separate explicit consent and permission preferences may be obtained for processing activities requiring explicit consent.

DATA CONTROLLER

Your personal data is processed by RESTODAN in its capacity as data controller.

Information regarding the data controller is as follows:

• Title: RESTODAN
• Address:
  Akarca Mh.
  Mustafa Kemal Blv. No: 158A
  48300 - Fethiye / MUĞLA / Türkiye
• Email: kvkk@restodan.com
• Website: restodan.com

Where necessary for users within the European Union or European Economic Area, information regarding a GDPR representative or data protection contact person may be announced separately.

DEFINITIONS

The terms used in this Privacy Notice have the following meanings:

• Personal data: Any information relating to an identified or identifiable natural person.
• Data subject: The natural person whose personal data is processed.
• Data controller: The person or organization that determines the purposes and means of processing personal data.
• Data processor: The person or organization that processes personal data in accordance with the instructions of the data controller.
• Platform: The mobile application, website, management panel, API services and all related digital services provided by RESTODAN.
• End user: A person who views restaurants, places orders, makes reservations or uses consumer services through the Platform.
• Restaurant partner: A business offering its establishment, products or services on the Platform.
• Courier partner: A natural or legal person independently providing delivery services.
• Integrator: An independent service provider authorized by RESTODAN to provide sales, setup, training and support services.
• Profile: A user view that may be defined under the same user account and may have different permissions, interfaces, transaction areas or purposes of use. A user may have one or more end-user, restaurant owner, restaurant staff, courier or integrator profiles under the same account.

CATEGORIES OF PERSONAL DATA PROCESSED

RESTODAN may process the following categories of personal data within the scope of use of the Platform and provision of services:

• Identity information: First name, last name, business representative information and, where necessary, identity verification information.
• Contact information: Telephone number, email address, address information.
• Account information: Username, password information, account preferences, profile information, role and authorization information, business relationships and authorization records.
• Transaction security information: IP address, device information, session records, access logs, transaction times.
• Order and reservation information: Order contents, restaurant information, delivery address, reservation time, table information, order status.
• Location information: Address, approximate location or GPS coordinates obtained with the user's explicit permission or manual input.
• Financial and commercial information: Subscription information, billing information, entitlement information, service fee records.
• Professional and operational information: Courier vehicle information, integrator service records, restaurant staff roles, support requests.
• Communication and support records: Requests, complaints, messaging, calls or support records.
• Rating and review information: Ratings, comments, feedback and satisfaction records.
• Visual and media content: Photos, logos, product images or similar media content uploaded by the user or restaurant.

RESTODAN does not process all data categories for every user. The data processed may vary depending on the user's role, features used and type of transaction performed on the Platform.

PURPOSES OF PROCESSING PERSONAL DATA

Your personal data may be processed for the following purposes:

• Creating and managing user accounts,
• Providing Platform services,
• Conducting restaurant, courier, integrator and other partnership processes,
• Managing business ownership and business authorization processes,
• Creating and managing user roles such as staff, managers, service staff and kitchen staff,
• Establishing business-staff relationships through QR codes or similar secure authorization methods,
• Defining, modifying and revoking access permissions,
• Fulfilling transaction security and record-keeping obligations,
• Fulfilling legal obligations.

LEGAL BASES FOR PROCESSING PERSONAL DATA

Personal data may be processed on the following legal bases under Personal Data Protection Law No. 6698 and, to the extent applicable, the GDPR:

• Processing being necessary for the establishment or performance of a contract
• Compliance with the data controller's legal obligations
• Processing being necessary for the establishment, exercise or protection of a right
• Legitimate interests, provided that the fundamental rights and freedoms of the data subject are not harmed
• Processing being expressly provided for by law
• Explicit consent of the data subject where explicit consent is required

Data necessary for providing the service, such as telephone number, email, delivery address, order information, reservation information, account security records and billing information, is generally processed not on the basis of explicit consent, but on the legal bases of establishment or performance of a contract, legal obligation, establishment of a right or legitimate interest.

Separate explicit consent or permission preferences may be obtained for activities such as marketing communications, optional location use, certain types of cookies, optional profile creation or publication of public comments/photos.

DATA PROCESSING BY USER TYPE

Users may have a single primary user account on RESTODAN. End-user, restaurant owner, restaurant staff, courier, integrator or other profiles that may be offered in the future may be defined under the same user account. The categories of data processed may vary according to the profiles and permissions held by the user.

For end users, the following data may be processed:

• Account information
• Contact information
• Order and reservation information
• Delivery addresses
• Location information
• Comments and reviews
• Support records

For restaurant partners, the following data may be processed:

• Business information
• Authorized person information
• Tax and billing information
• Subscription records
• Operational and order records
• Performance and support records

For courier partners, the following data may be processed:

• Identity and contact information
• Vehicle information
• Delivery records
• Location information
• Performance records
• Support records

For integrators, the following data may be processed:

• Identity and contact information
• Service records
• Performance evaluations
• Entitlement records
• Training and certification records

TRANSFER OF PERSONAL DATA

RESTODAN may transfer personal data only within the scope necessary for providing services, fulfilling legal obligations and legitimate operational needs.

Personal data may be transferred to the following recipient groups:

• Relevant restaurants
• Relevant couriers
• Relevant integrators
• Payment, accounting or billing service providers
• Cloud infrastructure providers
• Technical service providers
• Legally authorized public institutions and organizations
• Courts and enforcement authorities

Transferred data is limited to data necessary for the provision of the service.

RESTODAN does not sell, rent or transfer personal data to unrelated third parties for commercial purposes.

DATA SHARING FOR DELIVERY AND OPERATIONAL PURPOSES

Certain data may be shared with relevant restaurants and persons or organizations carrying out delivery in order to perform order and delivery services.

Data that may be shared within this scope may include:

• First and last name
• Delivery address
• Delivery notes
• Telephone number
• Order information
• Location information

Such sharing is carried out solely for preparing and delivering the order and communicating with the customer.

RESTODAN endeavors to technically limit data access between restaurants and independent couriers and aims to display only necessary information.

INTERNATIONAL DATA TRANSFERS

Certain technical services, cloud infrastructures, communication services, map services, email services or security services used by RESTODAN may operate through servers located abroad.

Therefore, personal data may be transferred abroad or processed in systems located abroad to the extent permitted by applicable legislation.

When transferring data abroad, RESTODAN endeavors to take the technical and administrative measures required under applicable legislation.

Where explicit consent is required for international data transfers, separate permission or explicit consent may be obtained.

For European Union users, where appropriate, European Commission adequacy decisions, standard contractual clauses or equivalent protection mechanisms may be used.

RETENTION PERIODS AND DATA MINIMIZATION

RESTODAN aims to retain personal data only for as long as necessary for the purpose of processing.

Retention periods are determined by taking the following criteria into account:

• Statutory retention obligations
• Tax and financial obligations
• Dispute resolution processes
• Service security requirements
• Legitimate interest assessments

For example, order records, accounting records, billing records and certain transaction records may be retained for years as required by applicable legislation.

Data whose retention period has expired or whose processing purpose no longer exists is deleted, destroyed or anonymized in accordance with applicable legislation.

In accordance with the principle of data minimization, RESTODAN aims to process only necessary data.

SECURITY OF PERSONAL DATA

RESTODAN endeavors to take reasonable technical and administrative measures to prevent unlawful processing, access, disclosure, alteration or loss of personal data.

The following measures may be applied within this scope:

• Data transmission security through SSL/TLS
• Authorization and access control systems
• Password hashing and security mechanisms
• Logging and transaction records
• Backup and disaster recovery processes
• Security updates and system monitoring
• Staff authorization and confidentiality obligations

Taking into account that no electronic system can provide absolute security, RESTODAN aims to implement measures reasonably necessary to protect personal data.

RIGHTS OF THE DATA SUBJECT

Data subjects have certain rights regarding their personal data under applicable legislation.

Under KVKK, data subjects have the following rights:

• To learn whether personal data is being processed
• If processed, to request information regarding such processing
• To learn the purpose of processing and whether the data is used in accordance with that purpose
• To know the third parties to whom data is transferred domestically or abroad
• To request correction of incomplete or inaccurate data
• To request deletion or destruction where statutory conditions are met
• To request notification of correction or deletion operations to third parties to whom the data has been transferred
• To object to outcomes resulting from automated systems
• To claim compensation if damage arises due to unlawful processing

Where the GDPR applies, data subjects may additionally have rights such as data portability, restriction of processing, objection to processing activities and withdrawal of explicit consent.

APPLICATIONS AND EXERCISE OF RIGHTS

Data subjects may submit requests concerning their personal data to RESTODAN in accordance with applicable legislation.

Applications may be made through the following channels:

• Email: kvkk@restodan.com
• Application form through the website
• Written application methods
• Other methods accepted under applicable legislation

RESTODAN endeavors to evaluate applications within the periods prescribed by applicable legislation.

Additional information or documents may be requested where identity verification is required.

COOKIES AND SIMILAR TECHNOLOGIES

The Platform may use cookies or similar technologies to improve the user experience, manage sessions, provide security and enable technical functions.

Technologies used may include:

• Strictly necessary session cookies
• Security cookies
• Preference and settings cookies
• Performance and analytics technologies
• Mobile application identifiers
• Local storage technologies

Where required, separate permission may be obtained for cookies or similar technologies requiring explicit consent.

Detailed information regarding cookies may be provided in the separately published Cookie Policy.

UPDATES TO THE PRIVACY NOTICE

RESTODAN reserves the right to update this Privacy Notice in line with changes in applicable legislation, changes in the scope of services, technical developments or operational needs.

The updated text enters into force on the date it is published on the Platform.

Material changes may also be separately communicated to users through appropriate communication channels.

EFFECTIVE DATE

This Personal Data Protection and Processing Privacy Notice enters into force on the date it is published on the Platform.

Use of the Platform does not mean that this Privacy Notice has been read by the user; however, RESTODAN aims to ensure that data subjects can easily access this text.

Separate explicit consent and permission preferences may be obtained for processing activities requiring explicit consent.