Privacy Notice under the Turkish Personal Data Protection Law

Last updated: 27 October 2026. This is a translation; in case of any discrepancy, the Turkish version prevails.

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to business representatives who use the Menü Uyum service and to visitors who view menus.

1. Data controller

Menümde
Istanbul
E-mail: iletisim@menumde.com

2. Personal data processed

Account holders: name, e-mail address, an irreversible hash of the password (the password itself is not stored), sign-up and terms-acceptance dates.
Business information: business name, address, telephone and the full name of the representative who gave the declaration of accuracy.
Security of operations: session cookie, IP address and server logs. See the Cookie Policy for details of the cookies used.
Menu visitors: no account is created and no name or contact details are requested to view a menu. The allergen preferences a visitor selects are kept only on their own device (in the browser's storage) and are not sent to our servers. If the restaurant has enabled "Call waiter" and the visitor uses it, the message goes directly from the visitor's own WhatsApp account to the restaurant's number; neither the message nor the visitor's phone number reaches us — it is between the restaurant and the visitor.
In-app waiter calls and table ordering: table number, ordered items, an optional kitchen note, times and a random device code; IP address briefly to prevent abuse. Waiter calls are kept for 30 days and orders for 90 days. If the visitor allows "order ready" notifications, the push address and keys created by their browser are stored for 12 hours; the notification is delivered encrypted through the browser's push service (e.g. Google, Apple, Mozilla).
Contact form: the name, e-mail address, subject and message you write, the interface language and your IP address (to prevent abuse).

3. Purposes and legal grounds

Opening the account, providing the service and tracking the subscription — establishment and performance of a contract (KVKK Art. 5(2)(c)).
Allowing the business to present its menu information to customers and recording its declaration — compliance with a legal obligation (Art. 5(2)(ç)) and legitimate interest (Art. 5(2)(f)).
Information security, prevention of misuse and backups — legitimate interest (Art. 5(2)(f)).
Answering messages sent through the contact form — legitimate interest (Art. 5(2)(f)); for an existing customer, also performance of the contract (Art. 5(2)(c)).

4. Transfers

Personal data is stored on the servers of the hosting provider where the service runs, and is shared with competent public authorities where required by law. Other than that, it is not sold to third parties or transferred for marketing purposes.

When a barcode lookup is made in the panel, the barcode number is sent by your browser directly to the Open Food Facts service (France). Panel libraries (QR codes, drag-and-drop) and menu typefaces are served from our own servers.

5. Retention period

Account data is kept until the account is deleted and thereafter for the statutory retention periods. Backups are kept for at most 30 days. Contact form messages are deleted after 365 days. Declarations given when importing photos from another menu (account, email, wording, source link, date and IP address) are kept without deletion as evidence in case of dispute.

6. Your rights

Under Article 11 of the KVKK you have the right to learn whether your data is processed, to request information, to request correction or deletion, to know the parties to whom it has been transferred, to object, and to claim compensation for damages. You can send your requests to iletisim@menumde.com; requests are concluded within 30 days at the latest.