PDPL Privacy Notice

Personal data received within Pidem Restaurant İşletmeleri Gıda Turizm İnşaat Ticaret ve Sanayi A.Ş. (hereinafter referred to as "Pidem") are under the protection of Pidem. Within the scope of the Personal Data Protection Law (hereinafter referred to as "PDPL"), necessary technical and administrative measures are taken to protect your personal data securely and to process them in accordance with the law.

This Privacy Notice applies to all users who use the "..." website (hereinafter referred to as the "website") and members who subscribe to the website (hereinafter referred to as the "customer") and any personal data provided to Pidem for any reason.

Personal data means information that identifies and/or makes your identity identifiable. Processing of personal data means "all kinds of operations performed on personal data, including obtaining, recording, storing, modifying, sharing with third parties and transferring personal data abroad by automatic or non-automatic means provided that it is a part of any data recording system".

Data Controller

Your name, surname, Turkish ID number, date of birth, telephone, e-mail, address, interests, social media information and likes related to your personal data that you have approved to be shared by you through social media channels in case you connect with your social media accounts, your website browsing movements, your location information, your voice recording if you reach the call center, your special quality personal data if you transmit, shall be stored, processed and transferred domestically and abroad by Pidem in its capacity as "data controller".

Pidem attaches special attention to the protection and security of personal data and takes the necessary technical and administrative measures to ensure that all kinds of personal data of all real persons related to it within the scope of PDPL shall be processed and stored in accordance with the law.

Any personal data obtained / to be obtained by Pidem or shared / to be shared by you shall be processed only within the scope described below and in the ways stipulated in the PDPL. By reviewing this Privacy Notice, you can obtain information about the personal data collected by Pidem in its capacity as data controller or transferred to Pidem, the purposes of processing, the persons to whom it may be transferred, the method and legal reason for collection, and your rights regarding such personal data.

Collection, Processing and Transfer of Personal Data

Personal data may be collected verbally, in writing or electronically by Pidem directly from the information transmitted by you verbally or in writing, information transmitted via the website, social media accounts, digital marketing channels, telephone, e-mail, etc., information received from agencies, our branches and franchise branches, official institutions and organizations, through applications and software and camera recordings used within the scope of company activities and from business partners from whom support services are received, contracts, applications, forms, offers, cookies used in website visits, in accordance with the legislation.

Your personal data may be recorded, preserved, stored, maintained, modified, shared with other persons / group companies / service providers deemed appropriate by Pidem in accordance with the legal or actual requirements of the service provided by Pidem, and may be processed by Pidem in accordance with the legislation.

Pidem may transfer the personal data and special categories of data obtained by Pidem to all kinds of institutions, Pidem shareholders / employees, domestic or foreign real or legal persons with whom Pidem directly or indirectly cooperates; banks for collection purposes and / or institutions authorized by collection to all companies in cooperation; to all kinds of companies from which it receives consultancy in agreement; to official institutions and organizations and other relevant third parties.

It should be noted that in accordance with the legislation, it is possible to process your personal data without explicit consent in the following cases

• Explicitly stipulated in the law.
• Mandatory for the protection of the life or physical integrity of the person or another person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid.
• Conduct and supervision of business activities.
• Sending electronic messages for commercial or contract performance purposes.
• Processing of personal data belonging to the parties to the contract is necessary, provided that it is directly related to the conclusion or performance of a contract or the promotion, sale and after-sales support services of products and services are carried out.
• Receiving and evaluating suggestions for the functioning and improvement of business processes, conducting and developing communication activities, monitoring requests and complaints, measuring and evaluating the quality of telephone calls made through the call center.
• Conducting company/product/service loyalty processes, data analysis, research and use within advertising services.
• Execution of customer relationship management processes and activities for customer satisfaction including social media channels.
• Conducting marketing processes of products and services including promotions, advertisements, campaigns, promotions, announcements; conducting surveys, analysis, targeting, segmentation studies.
• Mandatory for the data controller to fulfill its legal obligation.
• Being made public by the data subject himself/herself.
• Mandatory data processing for the establishment, exercise or protection of a right.
• Mandatory data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
• Keeping log records created in electronic environment for transaction security purposes, carrying out information security processes, informing authorized persons, institutions and organizations, carrying out storage and archive activities.
• Carrying out activities in accordance with the legislation and ensuring compliance with Pidem's policies and procedures.

Purposes of Processing Personal Data

Your personal data shall be processed in order to ensure that the services can be performed in the best way possible regarding the products, services or commercial activities offered by Pidem.

Using the website in case all kinds of general or special categories of personal data are transmitted by Pidem, becoming a member of the website, benefiting from the services, purchasing the services and performing payment/accounting transactions for the collection of the price; conducting information and communication activities with you and conducting analysis studies in order to anticipate the possible demands of customers; visiting the website; keeping log records in electronic environment for transaction security purposes in accordance with the legislation; ensuring and managing participation in Pidem loyalty programs; ensuring information and data security, ensuring the continuity of information systems; conducting necessary studies for the improvement of products and services, reporting, analysis, internal control, audit, examination, investigation studies; conducting archive and storage processes; control / development / prevention of illegal use of the website or technical systems; If approval is given, in order to improve the quality of the services and products offered by our company and to ensure customer satisfaction, being informed about campaigns and opportunities or providing prices, marketing, promotions, campaigns, other opportunities, offers and information regarding the service; for the purpose of managing all kinds of transactions to be carried out from the website and without limitation, in accordance with the PDPL, "It is necessary to process personal data belonging to the parties of the contract, provided that it is directly related to the establishment or performance of a contract" Pidem processes your personal data based on the above-mentioned legal grounds and stores them until notified by you or until the legal period and grounds expire.

Your personal data may be processed in physical and electronic archives within Pidem and service providers, limited to the purposes of compliance with the provisions of the legislation and Pidem, Pidem's partners and all group companies to which Pidem is affiliated and Pidem policies and procedures; may be transferred abroad; may be kept by taking all measures in accordance with the legislation

Principles Regarding the Storage Periods of Personal Data

Personal data shall be stored by Pidem for the periods stipulated in the relevant legislation in line with its legal obligations. Pidem may process and store your personal data for the period of time required to be processed in accordance with its practices and commercial practices in connection with its activities.

Your Rights Regarding the Personal Data Protection

Pidem takes reasonable technical and administrative measures to process personal data in accordance with the law, to store them in secure environments, to prevent unauthorized access risks and any other unlawful access, to prevent data loss for any reason, to prevent deliberate damage and deletion of data, to the extent technological possibilities and implementation costs allow.

Pursuant to Article 11 of the PDPL, we inform you that you have the following rights by applying to Pidem;

• Learn whether your personal data is being processed,
• Request information if processed,
• Learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom it is transferred domestically or abroad,
• Request correction of personal data in case of incomplete or incorrect processing,
• Request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the PDPL,
• Request notification of the actions taken pursuant to your above-mentioned rights to correction, deletion and destruction to third parties to whom personal data have been transferred,
• Object to the occurrence of a result against you by analyzing your processed personal data exclusively with automated systems,
• In case you suffer damage due to the processing of personal data in violation of the legislation, request the compensation of your damage

How to Exercise Your Rights Arising from the Legislation Regarding Your Personal Data

You can send your request to exercise your rights mentioned above by filling out the "Application Form" on the ... website in the following ways;

• by mail to your address with a petition bearing your wet signature,
• Through a notary public,
• to kep address with secure electronic or mobile signature,

Otherwise, the applications shall not be registered.

Applications shall be finalized as soon as possible and within 30 days at most.

In the event that your application is rejected, the answer given is insufficient or the application is not responded to in due time; You can complain to the Personal Data Protection Board within 30 days from the date you learn our answer to your application and within 60 days from the date of application. However, if the requested transaction requires an additional cost, we shall charge the fee in the tariff determined by the Personal Data Protection Board within the scope of Article 13 of the PDPL