Fırıncızade Restaurant Personal Data Protection and Processing Policy

1. Introduction At Fırıncızade Restaurant (hereinafter referred to as "the Company"), we attach great importance to the protection of your personal data. This policy explains our Company's principles for processing personal data and the procedures for fulfilling our disclosure obligation, within the framework of the Law on the Protection of Personal Data No. 6698 ("KVKK") and related legislation.

2. Collection, Processing, and Purposes of Processing Personal Data Our Company collects personal data of its customers, employees, suppliers, and other relevant individuals in compliance with the law and good faith principles. Your personal data is processed for the purposes stated below:

• From Our Customers: Name, surname, phone number, e-mail address, address information, order history, payment information (payment method information, not the payment instrument itself).

  • Processing Purposes: Taking and delivering orders, carrying out reservation procedures, ensuring customer satisfaction, providing information about products and services, announcing campaigns and promotions, invoicing, resolving potential disputes, and fulfilling legal obligations.

• From Our Website Visitors: IP address, browsing information collected through cookies.

  • Processing Purposes: Enhancing website performance, improving user experience, and conducting analysis and statistical studies.

• From Our Employees/Job Applicants: Name, surname, contact information, educational background, work experience, reference information, health reports, criminal record.

  • Processing Purposes: Conducting employment processes, managing human resources operations, payroll, fulfilling legal obligations, and managing occupational health and safety processes.

3. Transfer of Personal Data Your personal data may be transferred to third parties for the purpose of fulfilling legal obligations, providing services, or conducting business activities, and in accordance with the conditions specified in Articles 8 and 9 of the KVKK. These transfers may occur as part of the services offered by our Company or as required by legal obligations. For example:

• To courier companies for order delivery.

• To official authorities (courts, public prosecutors' offices, etc.) for fulfilling legal obligations.

• To our financial advisors for accounting and financial affairs.

• To our database and hosting service providers.

4. Method of Personal Data Collection and Legal Basis Your personal data is collected through forms filled out on our website, e-mail, telephone, physical applications, transactions made in our restaurant (reservation, order, etc.), and other automatic or non-automatic methods.

The legal bases for processing your personal data are specified in Article 5 of the KVKK: explicit provision in the laws, necessity for the establishment or performance of a contract, fulfillment of a legal obligation, our legitimate interests provided that it does not harm the fundamental rights and freedoms of the data subject, and explicit consent.

5. Rights of the Personal Data Subject In accordance with Article 11 of the KVKK, as personal data subjects, you have the following rights:

• To learn whether personal data is being processed.

• To request information if personal data has been processed.

• To learn the purpose of the processing of personal data and whether they are used appropriately for their purpose.

• To know the third parties to whom personal data is transferred domestically or abroad.

• To request the rectification of personal data if it is incomplete or incorrectly processed.

• To request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK.

• To request that the transactions carried out in accordance with subparagraphs (d) and (e) above be notified to third parties to whom the personal data has been transferred.

• To object to the occurrence of an outcome against the person himself/herself by analyzing the processed data exclusively through automated systems.

• To demand the compensation of damages in case of suffering damage due to the unlawful processing of personal data.

You can submit your requests regarding your rights in writing to the address [Company Address] or via e-mail to [Company E-mail Address] using a secure electronic signature, mobile signature, or the e-mail address previously notified to our Company and registered in our system.

6. Retention Period of Personal Data Your personal data is retained for the period stipulated in the relevant legislation or for the period necessary for the purpose for which they are processed. In case the period expires or the processing purpose ceases to exist, the personal data is deleted, destroyed, or anonymized ex officio or upon the request of the data subject, in accordance with the KVKK and related legislation.

7. Data Security Our Company takes all necessary technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of personal data, prevent unlawful access to the data, and ensure the preservation of the data.

8. Policy Updates This policy may be updated in line with changes that may occur in legal legislation and developments in our Company's data processing processes. The current policy text will be published on our Company's website.