KVKK and privacy
This page explains which personal data Şef Restaurant Kusadasi processes through its booking and contact forms, why, for how long, and your rights under Turkish data protection law (KVKK). Questions: [email protected].
Draft — awaiting approval by legal counsel. This notice has been prepared on the basis of the data that the website actually collects today. Items shown in square brackets will be replaced automatically with the actual details once they have been filled in via the admin panel (Content → Legal texts → Company details). Last updated: 26.09.2026.
1. Data controller
Şef Restaurant Kuşadası is an affiliate of İstanbul Balıkçısı Gıda Tur. Tic. Ltd. Şti.. Within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data are processed by İstanbul Balıkçısı Gıda Tur. Tic. Ltd. Şti., in its capacity as data controller, in the manner described in this notice.
- Address: Türkmen Mah., Atatürk Blv. No:186, 09400 Kuşadası/Aydın
- E-mail: [email protected] · Telephone: +90 256 618 25 54
- Tax office / tax number: [VERGİ DAİRESİ] / [ŞİRKET VERGİ NO]
- MERSİS (Central Registry System) number: [MERSİS NO] · KEP (registered electronic mail) address: [KEP ADRESİ]
- VERBİS (Data Controllers' Registry Information System): [VERBİS KAYIT BİLGİSİ — kayıt yükümlülüğü yoksa bu satır silinir]
2. Who is covered by this notice?
Everyone who visits the sefrestaurantkusadasi.com website; makes a reservation or sends a question or a special event request via the forms on the website; or contacts us via WhatsApp, telephone or e-mail initiated from the website.
3. What personal data do we process?
| Data category | Data | Source |
|---|---|---|
| Identity | Full name | Reservation, contact and event forms |
| Contact | Telephone number, e-mail address | The same forms |
| Customer transaction | Reservation date, time and number of guests; reservation type (standard / special occasion), the special occasion (birthday, anniversary, honeymoon, marriage proposal or another occasion you describe briefly) and additional requests (e.g. cake, flowers, decorations, photography); anything you write in the notes field; reservation code; sending status of the confirmation and reminder e-mails; any cancellation or change request you submit via the "View my reservation" page; in the contact and event forms, your message and the event date, number of guests and type of event | Forms and your personal reservation page (/r/…) |
| Legal transaction and consent | The date and time at which you submitted the reservation form (acknowledging that you have read the privacy notice); the date and time at which you ticked the consent box on the contact and event forms; your cookie preference | Forms, cookie banner |
| Transaction security | IP address (used momentarily and not written to the database; it appears only in the reservation notification e-mail sent to the restaurant); temporary rate-limit counters kept using an irreversible hash of the IP address; log of failed reservation attempts (time, reason for the error, and the name, telephone number and date/time entered in the form; no IP address or browser information); standard access logs of the hosting server | Website and server, automatically |
| Marketing and measurement | Cookie identifiers; pages visited; events such as clicks on "Call", "WhatsApp" and "Directions" and completed reservations | Only if you click "Accept" in the cookie banner (Cookie policy) |
No online payments are taken; no card or payment details are processed on the website. We do not ask for special categories of personal data (e.g. health information). If you yourself enter an allergy or a health condition in the notes field, this information is used solely to prepare your meal safely and is deleted together with the reservation record. [Legal review: whether separate explicit consent must be obtained for this under Article 6 of the KVKK.]
4. How do we collect your data?
Your data are collected electronically, partly by automated means (forms, server, cookies), through the forms you fill in on the website, your use of your personal reservation page and the choice you make in the cookie banner. Reservation details that you provide via WhatsApp or by telephone may be entered into the reservation system by our team.
5. For what purposes and on what legal basis do we process your data?
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Taking and confirming your reservation (confirmation e-mail), sending a reminder e-mail before your reservation, preparing your table and your special occasion arrangements, and contacting you via WhatsApp or by telephone should anything change | Establishment and performance of the contract (Art. 5(2)(c)) |
| Handling your cancellation or change request | Performance of the contract (Art. 5(2)(c)) |
| Answering your question or special event request and preparing a quotation | Establishment of the contract (Art. 5(2)(c)) and legitimate interest (Art. 5(2)(f)) |
| Protecting the website and the reservation system against misuse (rate limiting, spam and bot protection); being able to get back to the guest after a failed reservation attempt | Legitimate interest (Art. 5(2)(f)) |
| Responding to requests from authorised public institutions and organisations and fulfilling obligations arising from legislation | Legal obligation (Art. 5(2)(ç)) |
| Establishing, exercising and protecting rights in the event of a dispute | Art. 5(2)(e) |
| Visitor statistics and advertising measurement | Explicit consent (Art. 5(1)) — "Accept" in the cookie banner; may be withdrawn at any time |
Your reservation is confirmed automatically by the system if there is availability at the time you have selected; if not, another time is suggested or you are placed on the waiting list. To object to the outcome of this automated assessment, you need only call us; our team will review your request separately.
6. To whom do we transfer your data?
| Recipient | Purpose | Location |
|---|---|---|
| [BARINDIRMA FİRMASI, SUNUCU ÜLKESİ] | Hosting of the website and the database | Country in which the server is located |
| [E-POSTA HİZMET SAĞLAYICISI] | Sending confirmation and reminder e-mails and notification e-mails to the restaurant | [In Türkiye / outside Türkiye] |
| [SMS HİZMET SAĞLAYICISI — kullanılmıyorsa "kullanılmıyor"] | SMS notifications (only if this feature is enabled) | [In Türkiye / outside Türkiye] |
| Cloudflare, Inc. | If the website is served via Cloudflare: security and speed (IP address and technical request data); if bot protection (Turnstile) is enabled on the forms: bot verification | Outside Türkiye |
| Google LLC | The map on the website (Google Maps — your IP address is transmitted to Google when the map appears on screen); YouTube, if you play a YouTube video in an announcement; Google Analytics 4 and Google Ads, if you have given explicit consent | Outside Türkiye |
| Meta Platforms | Meta Pixel (Instagram / Facebook advertising measurement), if you have given explicit consent; WhatsApp, if you start a WhatsApp conversation yourself | Outside Türkiye |
| Authorised public institutions and organisations | Upon a lawful request | In Türkiye |
The WhatsApp buttons on the website only open WhatsApp with a pre-filled message; no data are transmitted to WhatsApp unless you send the message. Transfers abroad are carried out in accordance with Article 9 of the KVKK: for analytics and advertising services, we rely on your explicit consent; for infrastructure services, [Legal review: standard contract and notification to the Personal Data Protection Board, or other appropriate safeguards].
7. How long do we retain your data?
| Data | Retention period | Upon expiry |
|---|---|---|
| Reservation records and the team notes relating to that reservation | 2 years from the reservation date | Name, telephone number, e-mail address, notes and requests are deleted; the record is anonymised (only statistical data such as the date and number of guests remain); team notes are deleted |
| Contact and event messages | 1 year | Deleted |
| Log of failed reservation attempts | 30 days | Deleted |
| Rate-limit counters (IP hash) | Up to 24 hours | Deleted |
| Admin panel activity log (who changed which record) | 2 years | Deleted |
| Backups | Taken weekly and kept for a maximum of 8 weeks | The oldest backup is deleted automatically |
| Server access logs | Kept by [BARINDIRMA FİRMASI, SUNUCU ÜLKESİ] for the period laid down in the relevant legislation (Law No. 5651) | Deleted by the hosting provider |
| Cookies | The periods stated in the Cookie policy | Deleted from your browser |
Deletion and anonymisation are carried out automatically every night. If there is an ongoing legal dispute or an official request, the relevant record may be retained until the proceedings have been concluded.
8. Your rights (KVKK Art. 11)
- To learn whether your personal data are processed;
- to request information about the processing if your data have been processed;
- to learn the purpose of the processing and whether your data are used in accordance with that purpose;
- to know the third parties to whom your data have been transferred within Türkiye or abroad;
- to request rectification if your data have been processed incompletely or inaccurately;
- to request the erasure or destruction of your data within the framework of the conditions set out in Article 7 of the KVKK;
- to request that the rectification, erasure and destruction operations be notified to the third parties to whom your data have been transferred;
- to object to the occurrence of an outcome to your detriment as a result of the analysis of your data exclusively by automated systems;
- to claim compensation for the damage if you suffer damage as a result of unlawful processing.
9. How can you submit an application?
You may submit your application, together with information verifying your identity (full name; Turkish national identity number or, if you are a foreign national, your nationality and passport number; address; contact details; your request), by one of the following means:
- By a petition bearing your wet-ink signature: İstanbul Balıkçısı Gıda Tur. Tic. Ltd. Şti., Türkmen Mah., Atatürk Blv. No:186, 09400 Kuşadası/Aydın
- By registered electronic mail (KEP): [KEP ADRESİ]
- With a secure electronic signature or mobile signature, or from the e-mail address that you have previously notified to us and that is registered in our system: [email protected]
Your application will be concluded free of charge within 30 days at the latest; if the process entails an additional cost, the fee schedule determined by the Personal Data Protection Board may be applied. If your application is rejected, if you find the response insufficient, or if no response is given in due time, you may lodge a complaint with the Board within 30 days of the date on which you learn of the response and, in any event, within 60 days of the date of your application.
10. Changes
This notice is updated whenever changes occur on the website or in our data processing activities; the current version is always available on this page. Last updated: 26.09.2026. Details on cookies: Cookie policy.