KVKK

KVKK Privacy Notice

Last updated: 20 October 2026

Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, we inform you about the processing of your personal data.

1. Data controller and data processor

1.1 Data for which we are the data controller

For businesses with an account on the Platform, panel users and visitors to our website, the data controller is MenuRobo.

Email: [email protected]
Phone: +90 224 483 6 436
Address: Üçevler, İzmir Yolu Cd NO: 241 Westpoint

1.2 Data for which we are the data processor

For the data of guests and customers (QR menu orders, reservations, cake orders, on-account records) and staff of restaurants, cafés, hotels and pastry shops, the data controller is the relevant business; MenuRobo processes this data on behalf of and on the instructions of the business as a data processor. This relationship is governed by the Data Processing Agreement concluded with the business. Businesses can show their own privacy notices to their guests and customers using the option on the Platform.

2. Personal data processed

Identity: full name, company name, username.
Contact: email address, phone number, business address.
Customer transaction: selected plan and add-on modules, plan dates, extra branch requests, bank transfer payment records, support requests; the business's menu, table/room, branch, staff and order data.
Transaction security: password stored encrypted, two-factor authentication data, staff PIN codes (non-reversible hash), the business's own email (SMTP) account details; IP address, browser information, login/logout and failed attempt records, panel action logs, IP addresses blocked due to attack attempts.
Legal transaction and consent records: dates of acceptance of the terms of use, privacy notice, Data Processing Agreement, explicit consent and commercial communication consent.
Marketing: your communication preference, only if you consented to commercial communications.
Website visitors: name, email, phone, subject and message entered in the contact form; page visited, date-time, IP address, browser, operating system, device type, language and referring site; your cookie preference.
Guest data (on behalf of the business): order contents, table/room number, payment method and amount, customer name in takeaway orders, order note, IP address and browser information during ordering, waiter calls and reviews, table QR session data and device recognition code (cookie), questions asked to the menu assistant, review ratings.
Reservation data (on behalf of the business): full name, phone, email, reservation date and time, party size, note, preferred language, IP address and browser information, verification, approval, rejection, cancellation and arrived/no-show records and the time of privacy notice acknowledgement.
On-account customer data (on behalf of the business): full name, phone and note if any, amounts charged and collections.
Cake order data (on behalf of the pastry shop): full name, phone, email, (for home delivery) address and directions, selected product, inscription and design preferences, delivery date, (if added) image, order note, time of KVKK acknowledgement and explicit consent, WhatsApp notification preference, name of the staff member who took the order, non-reversible hash of the IP address. Allergy/sensitivity information entered by the customer is health data; it is processed only with the customer's explicit consent and for preparing the cake. Also processed: delivery photo and delivery problem notes, response to a delay notice, cancellation request and reason, order change log, uncollected order record, deposit refund outcome, storage consent and withdrawal time, survey answers, complaint records and (if enabled by the pastry shop) email verification time. Address, email, notes, allergy information, complaint descriptions and uploaded images are stored encrypted with AES-256; on printed slips and lists the customer's name is masked. Payment for cake orders is not taken through the Platform.
Staff data (on behalf of the business): name of the waiter, cashier, chef, courier, goods receiving staff and food engineer, (if WhatsApp notification is on) the waiter's phone, PIN code (non-reversible hash), log of actions and performance reports; if enabled by the pastry shop, the courier's live location only during delivery; training and health certificates within the scope of food safety (health data, only for food hygiene obligations).
Location data (on behalf of the business, only if location check is on): your device's location at the time of ordering if you allow it; used only for an instant check of distance to the business and not stored.

3. Purposes of processing

Creating the membership account, authentication and account management,
Providing QR menu, ordering, waiter, kitchen, cashier, on-account and hotel room service; closing bills, preparing receipts and Z reports,
Receiving online reservation requests, verifying them by email, forwarding them to the business and notifying the result,
Receiving cake orders, forwarding them to the pastry shop, production and delivery; notifying order status to the customer by email or WhatsApp; taking allergy information into account in preparation; notifying a new delivery time in case of delay and obtaining approval; remembering details for future orders if the customer allows; forwarding cancellation requests to the pastry shop; keeping food safety (HACCP) records and handling complaints,
Preventing fake orders and reservations (table QR verification, per-phone and per-IP limits, location check, waiter approval for new devices, email verification code at pastry shops, review limit),
Providing staff performance and cashier reports to the business,
Selling plans and add-on modules, conducting payment processes,
Conducting information security processes, preventing attacks, unauthorised access and abuse,
Keeping access logs and providing information to competent authorities as required by law,
Keeping website visit statistics, responding to contact and support requests, improving service quality,
Sending campaign and news announcements if you consent.

4. Collection method and legal bases

Your personal data is collected electronically, by automated or partly automated means, via the website, registration and contact forms, management panel, staff screens, QR menu, reservation and cake order forms, email verification links and codes, cookies and (if you allow) your device's location service, and processed based on the following legal grounds of the KVKK:

Being directly related to the establishment or performance of a contract (Art. 5/2-c),
Fulfilment of a legal obligation of the data controller (Art. 5/2-ç) — Law No. 5651, tax and commercial legislation, food legislation,
Establishment, exercise or protection of a right (Art. 5/2-e),
Legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f) — system security and prevention of abuse,
Your explicit consent (Art. 5/1 and Art. 6) — commercial communications, measurement with Google Analytics, allergy information at pastry shops and storing details for future orders.

5. Recipients and purposes of transfer

Suppliers: hosting, domain/DNS, content delivery and security (Cloudflare), email delivery, SMS and WhatsApp notification service providers — to provide the service. Questions typed to the menu and site assistant are not sent to any external AI service; only the product name and description are sent to the AI image service.
The relevant business and its staff: order, reservation and cake order details to the business where the request was made and the staff it authorises.
The business's email provider: emails to the business's guests and customers are sent via the business's own SMTP account.
Analytics provider: website usage data to Google LLC only if you allowed performance cookies.
Banks: to receive plan payments by bank transfer.
Authorised public institutions: to fulfil legal obligations.

Some service providers may have servers abroad; these transfers are carried out in accordance with Article 9 of the KVKK. For details, see the Explicit Consent Text.

6. Retention period

Your personal data is kept for as long as required by the purpose of processing and the periods set out in legislation: login, security and panel action logs 2 years; menu view statistics and waiter calls 13 months; website visit statistics 1 year. In QR menu and hotel orders, the IP address, browser information, order note and the customer name in takeaway orders, and the name, phone, email and note in reservations are deleted within the period set in the business's plan (30, 90 or 180 days; default 90 days). On-account customer details are deleted if there is no activity for the period in the plan (1–3 years; default 3 years) after the balance is closed. Images uploaded with cake orders are deleted within the period chosen by the pastry shop (7–90 days; default 30 days) after the order is closed; the customer's name, phone, email, address, notes and allergy information are anonymised — without storage consent, within the period in the plan after the order is completed (48 hours, 7 days or 30 days; default 7 days); with consent, if no new order is placed within the period in the plan after the last order (1–3 years; default 3 years); for an order subject to an open complaint this is postponed until the complaint is closed. When an account is closed, the account and business data are permanently deleted after 30 days; for accounts whose plan has expired and that are unused, 30 days after the warning sent on day 60. Plan payment records are kept for 10 years under tax and commercial legislation (KVKK Art. 5/2-ç) and anonymised at the end of the period. A record of deletions containing no personal data and the commercial communication consent record are kept for 3 years. Deleted data may remain in backups for at most 7 days. Blocked IP addresses are released after 1 hour and device blocks after 24 hours; unverified reservation requests expire after 24 hours; location data is never stored. Expired data is automatically deleted, destroyed or anonymised.

7. Your rights under Article 11 of the KVKK

To learn whether your personal data is processed,
To request information if it has been processed,
To learn the purpose of processing and whether it is used accordingly,
To know the third parties to whom it is transferred in Türkiye or abroad,
To request correction if it is incomplete or inaccurate,
To request deletion or destruction under the conditions in Article 7 of the KVKK,
To request that correction, deletion and destruction be notified to third parties to whom the data was transferred,
To object to a result against you arising exclusively from analysis by automated systems,
To claim compensation if you suffer damage due to unlawful processing.

8. How to apply

You may submit your requests in writing to the address above together with information identifying you, or send them from your email address registered in our system to [email protected]. Your application will be concluded free of charge within 30 days at the latest; if the action requires an additional cost, the tariff of the Personal Data Protection Board may apply. For requests concerning data processed on behalf of a business, please contact that business first.

For more details, see the Privacy Policy.