Clarification Text Regarding The Protection, Processing and Privacy Of Personal Data

1. Data Controller

KASRAT TURİZM OTELCİLİK GIDA SANAYİ ANONİM ŞİRKETİ (“Company” or “Gusina”), acting as the data controller within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK”), exercises utmost care in the lawful processing and protection of personal data, particularly of customers, visitors and individuals who communicate with the Company. This text has been prepared in accordance with Article 10 of the KVKK in order to inform data subjects.

2. Definition and Processing of Personal Data

Within the scope of KVKK, personal data refers to any information relating to an identified or identifiable natural person. The processing of personal data includes all kinds of operations performed on such data, such as obtaining, recording, storing, preserving, modifying, disclosing, transferring, classifying or preventing its use. All personal data processing activities carried out by our Company are conducted in compliance with the law and principles of good faith, for specific, explicit and legitimate purposes, and in a manner that is relevant, limited and proportionate to the purposes for which they are processed.

3. Personal Data Processed

Personal data that may be processed by our Company includes, but is not limited to, identification and contact information such as name and surname, e-mail address, phone number, message content provided by you, technical data related to website usage (such as IP address, device and browser information), as well as camera recordings obtained for ensuring security within our restaurant premises. Such data may be collected through automated or non-automated methods, in electronic or physical environments.

4. Purposes of Processing Personal Data

Your personal data is processed for the purposes of carrying out the services provided by our Company, establishing communication with you, evaluating requests and complaints, ensuring customer satisfaction, improving service quality, maintaining operational security and fulfilling the legal obligations of the Company.

5. Legal Grounds for Processing Personal Data

Your personal data is processed based on the legal grounds specified in Article 5 of the KVKK, including: your explicit consent, the necessity of processing for the establishment or performance of a contract, fulfillment of the Company’s legal obligations, and the legitimate interests of the data controller.

6. Transfer of Personal Data

Our Company may transfer your personal data, limited to the purposes stated above and by taking necessary security measures, to technical infrastructure providers, IT service providers and legally authorized public institutions and organizations. Except for these cases, your personal data will not be shared with third parties without your explicit consent.

7. Camera Surveillance Activities

Within the restaurant premises operated by our Company, camera surveillance activities are carried out for the purpose of ensuring physical security. Camera recordings are used solely for security purposes, stored for a limited period in compliance with applicable legislation and then deleted or anonymized. Such surveillance activities are conducted in a limited and proportionate manner so as not to infringe upon fundamental rights and freedoms.

8. Retention and Security of Personal Data

Your personal data is stored for the duration required by applicable legislation or for the period necessary for the purposes for which it is processed. Upon the expiration of such periods or the elimination of the purpose of processing, personal data is deleted, destroyed or anonymized in accordance with Article 7 of the KVKK. Our Company takes necessary technical and administrative measures to ensure the security of personal data and to prevent unlawful processing and access.

9. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, data subjects have the right to: learn whether their personal data is processed, request information if their personal data has been processed, learn the purpose of processing and whether it is used in accordance with its purpose, know the third parties to whom personal data is transferred domestically or abroad, request correction of incomplete or inaccurate data, request deletion or destruction of personal data, request notification of such actions to third parties, object to automated decision-making, and request compensation for damages in case of unlawful processing.

10. Application and Contact

Data subjects may submit their requests regarding the above-mentioned rights to our Company in writing or through electronic means. Applications will be concluded as soon as possible and within thirty (30) days at the latest, in accordance with Article 13 of the KVKK.

11. Effectiveness and Updates

This Clarification Text has been prepared in accordance with the applicable legislation and may be updated when deemed necessary. The updated version shall become effective as of the date it is published on the Company’s website.