Privacy Notice · KVKK
This is an English translation for your convenience. The Turkish version is legally binding: KVKK Aydınlatma Metni, Gizlilik Politikası, Çerez Politikası.
This Privacy Notice has been prepared in accordance with Articles 3, 4, 5, 6, 7, 8, 9, 10, 11, 12 and 13 and other relevant provisions of the Turkish Personal Data Protection Law No. 6698 ("KVKK"); the amendments made by Law No. 7499; the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform; the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad; the Regulation on the Deletion, Destruction or Anonymisation of Personal Data; and the relevant decisions of the Personal Data Protection Board.
Version: 2026-11-09
1. Data controller
- Company name
- 19 MAYIS 55 GIDA RESTORAN VE KAFETERYA LİMİTED ŞİRKETİ (trading as "Küll Amazon")
- Address
- Mimar Sinan Mah. Adnan Menderes 1. Kısım Bulv. No:175/B, 55200 Atakum/Samsun, Türkiye
- Tax office / Tax no.
- Gaziler Tax Office / 0012620877
- Email (KVKK requests)
- kullrestoran55@gmail.com
- Phone (general)
- +90 546 807 58 55
In this notice, "the Restaurant", "we" or "us" refers to the data controller named above.
Data processor (technical infrastructure): ÖNALTECH acts as the data processor on behalf of the Restaurant for developing and operating the website. If the analytics and tag tools (Google Tag Manager, Google Analytics, Hotjar, Yandex Metrica) are activated on the website, they will be managed by the Restaurant's social media team on behalf of the Restaurant.
ÖNALTECH provides services on behalf of the Restaurant for the technical development, operation and maintenance of the website. Personal data is processed in this context in accordance with the Restaurant's instructions. The process of concluding a data processing agreement with service providers acting as data processors, governing obligations regarding the security of personal data, confidentiality, access rights, sub-processors and the storage and deletion of data, is under way.
2. Personal data processed, purposes, legal grounds and retention periods
| # | Data category | Which data | Purpose | Legal ground (KVKK Art. 5) | Retention period |
|---|---|---|---|---|---|
| 1 | Reservation (table and Gastro Cinema; web form or phone) | Full name, phone, (optional) email, (optional) note, number of guests, date/time or screening, booking source, reference code, time and text version of the confirmation that this notice was provided to you | Receiving, verifying, arranging, changing/cancelling the booking, checking table or screening availability, preventing double bookings, contacting you | Art. 5(2)(c): directly related to the conclusion or performance of a contract | Kept for at most 45 days from the reservation date (table time or screening date); identifying details and notes are then anonymised; records are deleted completely at the latest 60 days from the same date (see explanations below) |
| 2 | Gastro Cinema prepayment tracking | Reference code, expected and received amount, payment time, payment/cancellation/refund note, refund status | Matching the prepayment made by bank transfer/EFT to the booking, tracking payment status, refunds | Art. 5(2)(c) | Notes are deleted at the latest 45 days after the reservation date; the record including amounts is deleted completely at the latest after 60 days. The Restaurant keeps its accounting records separately in its own system; this website does not |
| 3 | Change history | Initials of the staff member making a change, time and type of the action, previous/new values of changed fields | Tracing errors and unauthorised changes | Art. 5(2)(f) | Previous/new values are cleared at the latest 45 days after the reservation date; all records are deleted together with the booking at the latest after 60 days |
| 4 | Security and abuse protection (booking form, booking lookup page, staff login, daily chat limit) | Shortened hash of the IP address created with a secret key (pepper), request counter (the IP address itself is not stored in the counter) | Limiting excessive/automated requests and abuse | Art. 5(2)(f) | Deleted when the counter period ends (15 minutes to 1 day; booking lookup counter 1 hour). The hash is nevertheless treated as pseudonymised personal data |
| 5 | Bot protection (Cloudflare Turnstile) — booking forms (table, Gastro Cinema), staff login and before the first chat message | Browser signals, IP address, device signals and technical verification data | Protecting forms and the chat against automated attacks | Art. 5(2)(f) | Limited to the period required by the service. Cloudflare is itself a data controller for the signals it processes to improve Turnstile’s bot detection (see section 4) |
| 6 | Hosting/server logs | IP address, browser and device information, request time (created technically in the Cloudflare infrastructure) | Delivering the website, its security and uninterrupted operation | Art. 5(2)(f) | Subject to Cloudflare’s technical retention periods |
| 7 | AI assistant "Küllü" (Anthropic) | Messages you type in the chat (up to the last 6 entries of the conversation), language. Phone numbers and email addresses in common formats in chat messages are automatically masked before transfer; other information such as names, addresses, ID numbers or health information is not filtered, so we kindly ask you not to enter such information in the chat. Bookings are not completed in the chat; the chat only passes the date, time and number of guests to the booking form | Answering your questions, providing information about the Restaurant’s services, directing you to the booking form | Art. 5(2)(f) (depending on the nature of the specific processing) | Not stored on our website (not written to a database or logs; kept in browser memory until the page is closed). At Anthropic: generally deleted within 30 days under the standard API retention terms. Exceptions: inputs and outputs flagged for a suspected violation of the Usage Policy may be kept for up to 2 years (safety classification scores for up to 7 years); the period also changes if a different retention has been agreed by contract or if there is a legal obligation |
| 8 | Map (only if you click "Load map") | Your IP address and browser information and the address (URL) of the page you are visiting may be sent to Google; Google may also set cookies or read existing cookies | Showing our location | Your click (active choice) | Subject to Google’s policy |
| 9 | Contact by phone | Booking details noted by staff during the call (item 1) | Phone booking | Art. 5(2)(c) | Same as item 1 |
| 10 | WhatsApp (if used) | Your phone number, message content | Notifying booking/prepayment confirmation | Art. 5(2)(c)/(f) | At most 60 days after the reservation or screening date |
| 11 | Booking lookup page (/en/reservation/check) | The reference code and phone number you enter; in the response: status, type, date/time, number of guests; for Gastro Cinema the amount, payment deadline and payment details. Name and phone number are not shown in the response | Letting guests see the status of their own booking | Art. 5(2)(c) | The code and phone number entered are only used for matching and are not stored separately; attempt counter: item 4 |
| 12 | Publication of Gastro Cinema payment details on the website (payee name, bank, IBAN; public) | Trade name of the payee (the Restaurant), bank details and the account details required for payment | Enabling the prepayment | See item 2. Payment is made to the Restaurant’s business account (payee: 19 MAYIS 55 GIDA RESTORAN VE KAFETERYA LİMİTED ŞİRKETİ) | As long as it is published on the website |
| 13 | Cookie choice record and proof of consent (only once the cookie banner is enabled; not active at present) | (a) In your browser: the categories you chose, text version, timestamp (localStorage key kull_consent). (b) On the server (Cloudflare D1): a randomly generated consent ID, time of the action, the action taken, the categories chosen, text/version information and language. No IP address and no browser identifier (User-Agent) are stored in this record | Remembering your choice and keeping minimal proof of your consent choice | Necessary preference management not requiring explicit consent; Art. 5(2)(f) | In the browser: you are asked again after 12 months; lost when browser data is deleted. On the server: 12 months. Server records can only be accessed with administrator rights |
| 14 | Usage and device data — Analytics (only with your consent) — Google Analytics 4 (via Google Tag Manager) | Online identifiers (e.g. _ga), pages visited, interaction events, approximate location, device/browser/operating system information, referring site; the IP address is technically transmitted to Google (Google’s statement that it does not log IP addresses only applies to users in the EU, Switzerland and the United Kingdom) | Measuring how the website is used, improving content and the booking flow | Art. 5(1) explicit consent | GA4 event data retention: 2 or 14 months depending on the Google Analytics account setting |
| 15 | Session recordings and heatmaps — Analytics (only with your consent) — Hotjar | Mouse movements, clicks, scrolling, on-page behaviour, device/browser information (Hotjar states that end-user IP addresses are not stored); form inputs and chat content are masked | Identifying usability problems on the website | Art. 5(1) explicit consent | Recordings and heatmaps 365 days from capture (Hotjar statement) |
| 16 | Visit statistics and session recording (Webvisor) — Analytics (only with your consent) — Yandex Metrica | Metrica identifiers (_ym_*), page views, device/browser information, IP address; recording of the visit session with Webvisor (form fields and chat are masked; under Yandex’s terms, passwords, financial information and directly identifying data are not recorded) | Website statistics and usage analysis | Art. 5(1) explicit consent | Webvisor session recordings 15 days including the current day; retention of other analytics data depends on the service and account settings |
| 17 | Marketing measurement — Marketing (only with your consent; no tool is currently active) | Advertising and conversion identifiers (e.g. _gcl_*, _fbp), site interactions | Ad measurement and remarketing | Art. 5(1) explicit consent | Stated in this notice before a tool is introduced |
Explanations of the processing activities in the table
Reservation (item 1): Your personal data relating to bookings is processed to receive, verify, arrange, change and cancel your booking request, to check table or screening availability and to prevent double bookings. The legal ground is that the processing is directly related to the conclusion or performance of a contract under Article 5(2)(c) KVKK.
Retention (items 1–3): Personal data obtained for a booking is kept for at most 45 days from the reservation date (table time or screening date) to handle possible changes, cancellations, refunds and booking-related communication. At the end of this period, identifying details and booking notes are anonymised. Records relating to the booking are deleted completely, within the framework of the defined retention and destruction policy, at the latest 60 days from the same date. Accounting and commercial documents that must be kept under tax and commercial law (Tax Procedure Law Art. 253: 5 years; Turkish Commercial Code Art. 82: 10 years) are kept separately by the Restaurant for the statutory periods; this website does not keep these documents.
Security counters (item 4): To detect excessive requests, automated access attempts and abuse on the website, IP addresses may be hashed with a secret key without being stored directly. The resulting values are used to limit repeated requests. Where these values technically allow a particular source to be distinguished, they are treated as personal data. The data is only used for security purposes and is deleted when the counter period ends.
Bot protection (item 5): Cloudflare Turnstile is used to protect the booking forms, the staff login and other transaction areas of the website against automated bot attacks and abuse. In this context, the IP address, browser and device signals and technical verification data may be processed. Processing takes place under Article 5(2)(f) KVKK, provided it is necessary and proportionate to ensure data security. The data is kept only for the period required by the service.
Küllü AI chat assistant (item 7): Messages you type to the AI-supported chat assistant Küllü may be processed to answer your questions, provide information about the Restaurant’s services and direct you to the booking system. Only the information needed to provide the service is processed. Depending on the nature of the specific processing, Article 5(2)(f) KVKK applies. Chat content is not stored permanently in our website’s own database. However, messages are transmitted to the technical infrastructure of the AI service provider used and are subject to the provider’s applicable contractual retention terms. Under the standard API retention terms, data is generally deleted within 30 days. Inputs and outputs flagged for a suspected violation of the Usage Policy may be kept for up to 2 years, safety classification scores for up to 7 years; a different contractual retention or legal obligations may also change the period. Data is stored by Anthropic in the USA; generating the answer (processing) may also take place in countries in Europe, Asia and Australia in addition to the USA. Phone numbers and email addresses in common formats in chat messages are automatically masked before transfer; other information such as names, addresses, ID numbers or health information is not filtered, so we kindly ask you not to enter such information in the chat.
Map (item 8): The location and map service on our website is activated when you choose "Load map". When the map service is loaded, your IP address, the address (URL) of the page you are visiting and some technical information about your browser may be sent to Google’s service infrastructure; Google may also set cookies or read existing cookies. This data is processed to provide the map service. Any transfers abroad that may occur in connection with this service are assessed under Article 9 KVKK.
Phone and WhatsApp (items 9–10): Booking details you give during phone calls are processed to receive and assess your request and to carry out the booking. If calls are not recorded, only the information required for the booking is recorded.
If you contact us via WhatsApp, your phone number and message content may be processed to handle bookings and prepayments. Depending on the nature of the messaging service used, data may be transferred to the relevant technology service providers. Transfers abroad are assessed under Article 9 KVKK.
Prepayment (items 2 and 12): Gastro Cinema prepayments are paid into the business bank account notified by the Restaurant. The payment reference, expected and received amount, payment time and refund information are processed to match the payment to the booking, track the payment status and carry out any necessary refunds.
Cookie choice (item 13): The cookie banner is not active at present, so these records are not created. Once it is enabled, necessary preference records are used to remember your cookie choices and apply them on later visits. These records are kept only for preference management. Analytics via Google Analytics 4 is carried out on the basis of your explicit consent. You can withdraw your explicit consent at any time in the cookie preferences. Minimal records proving the consent choice are kept for the necessary period with restricted access: for this purpose a randomly generated consent ID, time of the action, the action taken, the categories chosen, text/version information and language are stored on the server (Cloudflare D1); no IP address and no browser identifier (User-Agent) are stored. These records can only be accessed with administrator rights. Retention period: 12 months.
Google Analytics 4 and Google Tag Manager (item 14): If activated, Google Analytics 4 is used to evaluate usage statistics of our website and improve service quality. Visit and interaction data is processed only in line with your analytics choice. In that case, Google Tag Manager is used as technical infrastructure to manage the tags used on our website. Third-party tags running through this tool are assessed separately. Any transfers of personal data abroad in connection with Google services will be carried out under Article 9 KVKK.
Hotjar/Contentsquare (item 15): If activated, Hotjar/Contentsquare is used to analyse the user experience of the website and identify technical problems. Visitor interactions, mouse movements, click and scroll information and device and browser data may be processed. This takes place only if the required explicit consent has been given for the analytics category. Booking forms, payment areas and chat content are excluded from recordings or masked by appropriate technical means. According to Hotjar, recordings and heatmaps are kept for 365 days from capture; data is held in Ireland (EU) on Amazon Web Services infrastructure, some sub-processors may be located outside the EU, and end-user IP addresses are not stored.
Yandex Metrica and Webvisor (item 16): If activated, Yandex Metrica is used to evaluate the website’s visit statistics. With the Webvisor feature, technical recordings of visit sessions may be created if you consent under your analytics choice. Under the current service terms, session recordings are kept for 15 days including the current day. Retention of other analytics data depends on the service and account settings. Identifying details, passwords and payment information are excluded from session recordings. Transfers abroad will be carried out under Article 9 KVKK.
Hotjar and Yandex Metrica/Webvisor — explicit consent (items 15–16): Hotjar and Yandex Metrica/Webvisor are used to analyse the website’s usage statistics and visitor interactions. Personal data is processed by these services only if you give explicit consent for the relevant analytics cookie category. Not giving consent, or withdrawing it later, does not prevent you from using the website or the booking service.
Management of analytics/marketing tools: No analytics or marketing tool and no cookie banner is currently active on the website. If tools are activated, their accounts are managed by the Restaurant’s social media team on behalf of the Restaurant; it configures them so that no personal data is sent; this notice and the Cookie Policy are updated before any new tool is added. The data processing/usage terms of Google, Hotjar and Yandex are accepted by the Restaurant before the relevant tool is activated.
Staff data: Data relating to the Restaurant staff’s use of the system and authorised actions is outside the scope of this notice for visitors. Staff data is covered by a separate employee privacy notice and processed on the legal grounds set out in the relevant legislation.
Special categories of data: The booking note field on our website is intended for general remarks needed to handle the booking. Health information, allergy information, religion or similar special categories of personal data must not be entered in this field. The Restaurant does not request such information.
3. How personal data is collected
Your data is collected directly from you, electronically or verbally, via the booking forms on the website, the booking lookup page, phone calls or WhatsApp. The chat assistant does not take bookings; it directs you to the booking form. Security data and server logs are created automatically when you visit the website. No analytics or marketing tool and no cookie banner is currently active on the website. If the Restaurant decides to use such tools in future, they will only be activated after your explicit consent has been obtained via the cookie banner. In that case, usage and device data (items 14–17) is collected automatically through cookies and similar technologies only if you give explicit consent in the cookie banner; if you decline, these tools are not loaded. You can withdraw your consent at any time via the "Cookie preferences" link that will then appear at the bottom of the page; see the Cookie Policy for details.
4. Recipients of personal data and purposes
Within Türkiye
- ÖNALTECH — data processor; operates the website and database on behalf of the Restaurant.
- The Restaurant’s social media team — management of the analytics/tag tools (items 14–17).
- Competent public authorities — where required by law, on request.
- Restaurant staff — for booking management, with role-based access.
Abroad (KVKK Art. 9)
The servers of the following service providers may be located outside Türkiye:
| Recipient | Country | Which data, why | Basis for the transfer |
|---|---|---|---|
| Cloudflare, Inc. | Headquartered in the USA; data centres are selected automatically by region and may be outside Türkiye | Hosting, database (D1), cache (KV), security (WAF, Turnstile): items 1–6. Cloudflare is itself a data controller for the signals it processes to improve Turnstile’s bot detection | KVKK Art. 9 (general explanation below) |
| ÖNALTECH | Germany | Access during system administration and maintenance | KVKK Art. 9 and 12 (explanation below) |
| Anthropic, PBC | USA (data is stored in the USA); processing may also take place in countries in Europe, Asia and Australia | Küllü chat messages are sent to the AI model and an answer is generated | KVKK Art. 9 (explanation below) |
| Google LLC / Google Ireland Limited | USA / Ireland and other countries where Google processes data | Google Tag Manager and Google Analytics 4 (only with "Analytics" consent, item 14); map (only if you click) | KVKK Art. 9 (explanations for items 14 and 8) |
| Hotjar Ltd. / Content Square SAS group | According to Hotjar, data is stored in Ireland (EU) on Amazon Web Services infrastructure; some sub-processors may be located outside the EU | Item 15 (only with "Analytics" consent) | KVKK Art. 9 (explanation for item 15) |
| Büyük Reklam Çözümleri Limited Şirketi (party to the Yandex Metrica agreement for users in Türkiye) and the Yandex group; YANDEX LLC (only for the Yandex Tag Manager function) | Including Russia; Yandex’s privacy policy for Türkiye states that data is processed in Russia and may be transferred to other countries | Item 16 (only with "Analytics" consent) | KVKK Art. 9 (explanation for item 16) |
| Meta (WhatsApp) | Determined by the contractual and technical structure of the WhatsApp service used (explanation below) | Your phone number and the content of the confirmation message (if notifications are sent via WhatsApp) | KVKK Art. 9 (explanation below) |
General explanation of transfers abroad: Where your personal data needs to be transferred abroad, transfers are carried out under Article 9 of the Personal Data Protection Law No. 6698. For transfers to countries without an adequacy decision, procedures for the standard contracts announced by the Board are under way, and the Board will be notified once the contracts are concluded. The recipients, purposes and countries of transfer are stated in the explanations of the relevant processing activities.
Anthropic (Küllü): As part of the service provided via the AI-supported chat assistant, your chat messages may be transferred to technology service providers abroad to generate answers. The aim is to process only the data needed to provide the service. Phone numbers and email addresses in common formats in chat messages are automatically masked before transfer; other information such as names, addresses, ID numbers or health information is not filtered, so we kindly ask you not to enter such information in the chat. Transfers abroad are carried out under Article 9 KVKK; in this context, standard contract procedures are under way, and the Board will be notified once the contracts are concluded.
ÖNALTECH (access from abroad): ÖNALTECH is a service provider acting as data processor on behalf of the Restaurant for the technical operation of the website and booking infrastructure. In the course of the service, authorised personnel may access system data from abroad. Access is limited to the data required by the service. This access takes place under Article 9 KVKK; in this context, standard contract procedures are under way, and the Board will be notified once the contracts are concluded.
Meta/WhatsApp: If booking and prepayment notifications are sent via WhatsApp, your phone number and message content may be processed to carry out that communication. Data may be transferred to the relevant Meta/WhatsApp companies providing the messaging service and to any sub-service providers involved. The companies and countries of transfer depend on the contractual and technical structure of the WhatsApp service used. Transfers abroad are assessed under Article 9 KVKK.
Yandex: Under section 5.8 of the Yandex Metrica Terms of Use, visitors are informed about the "Yandex.Metrica opt-out" browser add-on (see the Cookie Policy). Yandex’s published privacy policy states that personal data may be transferred to Russia and other third countries; the countries of transfer are listed in this table.
Note: Using the services above results in personal data being sent to servers outside Türkiye; for Yandex, these countries include Russia. Analytics and marketing tools are not currently active; if they are activated in future, they are only loaded if you give explicit consent in the cookie banner; if you do not consent, no data goes abroad through these tools.
Third parties (external links, not data transfers): Menu information and prices are retrieved from the Doypos system on the server side only; no personal data of guests is sent to Doypos. Menu images and videos are served from our own server. The Instagram link is only a link; there is no Instagram embed on the website.
5. Legal grounds for collecting personal data
The legal grounds are stated in the table above for each processing activity. The checkbox in the booking form records that this Privacy Notice has been provided to you; the data required for the booking is processed without explicit consent on the ground of concluding/performing a contract. The checkbox reads: "Kişisel Verilerin Korunması Hakkında Aydınlatma Metni tarafıma sunulmuştur." (English form: "The Privacy Notice (KVKK Information Notice) has been provided to me."), together with an accessible link to the notice.
Processing in the analytics and marketing categories (items 14–17) is based on explicit consent. Explicit consent is consent relating to a specific matter, based on information and given freely. This definition is in line with Article 3(1)(a) KVKK. Giving consent is not mandatory; not giving it does not affect the use of the website or bookings. Once tools are activated, you can withdraw your consent at any time via the "Cookie preferences" link; from the moment of withdrawal your data is no longer processed for these purposes.
6. Your rights (KVKK Art. 11)
By applying to the data controller you may: learn whether your data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in line with that purpose; know the third parties in Türkiye or abroad to whom it has been transferred; request correction if it is incomplete or inaccurate; request deletion or destruction under Article 7 KVKK and request that third parties to whom it was transferred be notified; object to a result against you arising from analysis exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.
7. How to apply
You can send requests regarding your rights under Article 11 KVKK, together with information suitable for verifying your identity, to the data controller in accordance with the procedures set out in Article 13 of Law No. 6698 and the Communiqué on the Procedures and Principles for Applications to the Data Controller. You can submit your application with a wet-signed petition in person or by post to our address above; using a secure electronic signature or mobile signature; or via an email address that you have previously notified to the data controller and that is registered in the data controller’s system. Applications are concluded free of charge as soon as possible depending on the nature of the request and at the latest within 30 days. If the action involves an additional cost, the fee in the tariff set by the Board may be charged.
If you request early deletion of your booking data, please state your reference code and phone number.
8. Security
- The connection to the website is encrypted (HTTPS).
- The staff login is password-protected; passwords are stored as one-way hashes, not in plain text; session cookies are not accessible to browser scripts (HttpOnly).
- Every change made by staff is recorded with their initials; administrator and restaurant permissions are separate.
- Excessive requests are limited; booking forms and the staff login form are protected by bot protection (Cloudflare Turnstile).
- Expired data is automatically anonymised and deleted.
No internet connection or system is absolutely secure; in the event of a breach, the notification obligations under the legislation are complied with.
9. Children
Our website is not specifically designed for children. Bookings by minors that may create a prepayment, fee or other contractual payment obligation must be made by their legal representatives or with the required consent of their legal representative. If minors attend the restaurant as guests, only the personal data necessary to provide the service is processed. Children’s personal data is protected in accordance with the relevant legislation and the best interests of the child.
10. Updates
This notice is updated when necessary; the current version is published on this page. Last updated: 9 November 2026.