1. Identity of the Data Controller
Data controller: ŞİRVAN SOFRASI LOKANTASI VE OTELCİLİK SANAYİ TİCARET LİMİTED ŞİRKETİ
Restaurant address: Küçük Ayasofya, Küçük Ayasofya Cd. No:71, Fatih, İstanbul, Türkiye
General contact: sirvansofrasi@gmail.com
The company's official service address and formal data protection application channel remain subject to verification.
2. Categories of Personal Data
The following information is collected through the reservation system.
The contact form also contains full name, email address, phone number, subject and message fields. Personal data entered into these fields may also be processed.
- Full name.
- Telephone number.
- Email address.
- Reservation date.
- Reservation time.
- Number of guests.
- Optional special requests and notes.
3. Methods of Collection
Reservation information is collected electronically through the reservation form using automated methods.
Technical access records and data associated with active Google services may also be generated during website visits.
The website does not collect personal data through a contact form because no such form is provided.
Information entered into the contact form is also submitted electronically by the individual. The form's storage, email delivery and other processing flows must be verified.
4. Purposes of Processing
Reservation information is processed to receive, assess and manage reservations and communicate with guests about their reservations.
Technical access records will be assessed in connection with website operations and security.
The specific processing purposes associated with active Google Analytics and Google Ads features will be established after configuration review.
Information submitted through the contact form is used to review questions and feedback and respond to the enquiry.
5. Legal Grounds
For reservation processing that is genuinely necessary for entering into or performing a contract, Article 5(2)(c) of Turkish Personal Data Protection Law No. 6698 is being assessed as the applicable legal ground.
The specific grounds for technical and security processing will be determined following completion of the processing inventory.
Whether consent is required for analytics and advertising processing will be assessed based on the actual technologies and processing activities.
Providing privacy information and obtaining consent are separate obligations.
The applicable legal ground under Article 5 must be explicitly determined for each contact-form data category and enquiry type once the actual process has been reviewed.
6. Transfers of Personal Data
The website uses Vercel, Google Analytics and Google Ads. Reservation data is stored in a database associated with Vercel Postgres / Neon infrastructure.
The exact personal data received by each provider, their roles and the purposes of any transfers have not yet been verified.
Any international transfers and the applicable mechanisms under Article 9 of Law No. 6698 will be determined separately.
7. Data Retention
The business has declared a one-year retention period for reservation data.
The start of this period, applicable statutory obligations and the actual deletion or anonymisation procedures remain subject to verification.
Retention periods for other categories will be established through the processing inventory.
8. Rights of Data Subjects
You have the following rights under Article 11 of Turkish Personal Data Protection Law No. 6698.
- Learn whether your personal data is processed.
- Request information if your data has been processed.
- Learn the purposes of processing and whether data is used accordingly.
- Know the third parties to whom your data is transferred, domestically or internationally.
- Request correction of incomplete or inaccurate data.
- Request deletion or destruction where the legal conditions are met.
- Request notification of corrections or deletion to relevant third parties.
- Object to adverse results arising exclusively from automated analysis.
- Claim compensation for damages caused by unlawful processing.
9. Application Procedure
Requests under Law No. 6698 may be submitted through the methods prescribed by the Regulation on the Procedures and Principles of Application to the Data Controller.
The official address for written applications is currently being verified.
General contact: sirvansofrasi@gmail.com. This address has not yet been verified as the formal channel for statutory data protection requests.
Requests are handled as soon as possible and within thirty days at the latest, in accordance with applicable law.