This text has been prepared by AŞ HAN YEMEK GIDA VE TURİZM SANAYİ TİCARET ANONİM ŞİRKETİ (“Company”) in order to fulfill its obligation to inform pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“PDPL”), regarding the processing of your personal data within the scope of the services provided to you. Our Company takes the necessary technical and administrative measures to ensure the secure storage and lawful processing of personal data in accordance with the Law and relevant legislation.
1-Personal Data Processed, Purpose of Processing, and Legal Basis : Your personal data is processed by our Company through fully or partially automated means, or through non-automated means provided that they form part of a data recording system, from physical and/or electronic media; our company’s departments and offices, group companies, social media platforms, applications and software, registration forms, WhatsApp and similar communication channels, email, website, mobile applications, text messages, call centers, telephone, mail, courier services, in-person delivery of contracts, application forms, and similar means are used to collect personal data verbally, in writing, or electronically, and are processed in accordance with the legislation on the protection of personal data for the following purposes and legal grounds. Our company can process your personal data in a lawful manner, in accordance with the general principles set forth in Article 4 of the Law, and in a way that is specific, clear, and legitimate, as well as limited and proportionate to the purposes for which it is processed.
Your personal data is processed by our company for the following purposes: conducting business operations in compliance with legislation and company procedures; managing customer relationship processes; implementing human resources policies; managing information security processes; handling finance and accounting matters; managing the sale of goods and services and post-sale support processes; logistics operations; managing customer relationship management and customer satisfaction processes; conducting advertising, campaign, and promotional activities; managing contract processes; developing products and services offered by our company and our group companies in line with user preferences and needs and providing personalized recommendations; ensuring the secure conduct of our company’s and our group companies’ operational activities; protecting the legal and commercial security of natural and legal persons with whom we have business relationships; managing communication processes; ensuring physical premises security; conducting customer satisfaction and complaint management activities; carrying out initiatives to protect corporate reputation; planning organizational and event processes; and fulfilling obligations arising from legislation.
Your personal data can be processed according to the Article 5 of the PDPL in some circumstances:
Where expressly provided for by law,
It is necessary to protect the life or physical integrity of the individual—who is unable to express consent due to actual impossibility or whose consent is not legally valid—or of another person,
Where it is necessary to fulfill a legal obligation,
Where the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of the contract,
Where data processing is necessary for the establishment, exercise, or protection of a right,
Where the data has been made public by the data subject,
It may be processed because it is necessary for the legitimate interests of the data controller, provided that it does not infringe upon the fundamental rights and freedoms of the data subject.
Our company collects and processes your personal data classified as “sensitive” under Article 6 of the Personal Data Protection Law, including health information, religious information, data related to criminal convictions and security measures, as well as visual and audio recordings.
Data regarding a person’s race, ethnic origin, political views, philosophical beliefs, religion, denomination, or other beliefs; attire; membership in associations, foundations, or unions; health; sexual life; criminal convictions and security measures; as well as biometric and genetic data, are considered special category personal data. The processing of special category personal data is prohibited. However, your special category personal data may be processed in the following cases:
The data subject’s explicit consent has been obtained,
It is expressly provided for by law,
It is necessary to protect the life or physical integrity of the data subject or another person, where the data subject is unable to express consent due to actual impossibility or where their consent is not legally valid,
It relates to personal data that the data subject has made public and is consistent with the data subject’s intent to make it public,
It is necessary for the establishment, exercise, or protection of a right,
It is necessary for persons subject to a duty of confidentiality or by authorized institutions and organizations for the protection of public health, the provision of preventive medicine, medical diagnosis, treatment, and care services, as well as the planning, management, and financing of health services,
It is necessary for the fulfillment of legal obligations in the areas of employment, occupational health and safety, social security, social services, and social assistance.
2-Purpose of Transferring Personal Data and Recipient Groups : Your personal data is processed in accordance with the purposes and legal grounds set forth in this Clarification Text, under the Law and other applicable legislation, to ensure that operations are conducted in compliance with the law and company procedures; to manage customer relationship processes; to implement human resources policies; to manage information security processes; to conduct financial and accounting operations; to carry out sales and post-sales support processes for goods and services, to carry out logistics activities, to carry out customer relationship management and customer satisfaction processes, to carry out advertising, campaign, and promotional processes, to carry out contractual processes, and to develop the products and services offered by our Company and our group companies in line with user preferences and needs and to provide personalized recommendations, to ensure the secure conduct of the operational activities of our Company and our group companies; to protect the legal and commercial interests of natural and legal persons with whom we have business relationships; to manage communication processes; to ensure the security of physical premises; to carry out customer satisfaction and complaint management activities; to implement measures aimed at safeguarding our corporate reputation; planning organizational and event processes, and fulfilling obligations arising from legislation, personal data may be transferred to our group companies, business partners, suppliers, shareholders, legally authorized public institutions, and private individuals, in accordance with the personal data processing conditions and purposes specified in Article 8 of the Personal Data Protection Law and listed above.
Our company may also process the collected personal data abroad and transfer it outside the country. In such cases, the Company may transfer data abroad based on a decision of adequacy regarding the country to which the transfer is made, sectors within that country, or international organizations, provided that one of the data processing conditions listed in Articles 5 and 6 of the Personal Data Protection Law and specified above is met. In the absence of an adequacy decision, however, an international transfer may be carried out provided that one of the data processing conditions is met and the data subject has the ability to exercise their rights and access effective remedies in the country to which the transfer is made, subject to the provision of any of the safeguards listed below:
The existence of binding corporate rules containing provisions on the protection of personal data and approved by the Personal Data Protection Board,
The existence of a standard contractual clause,
The existence of a written commitment containing provisions that ensure adequate protection, and authorization for the transfer by the Personal Data Protection Board.
If none of the safeguards listed above can be provided, cross-border transfers may be made on an ad hoc basis in certain exceptional circumstances. These exceptional transfer cases can be summarized as follows:
The data subject’s explicit consent to the transfer,
The transfer is necessary for the performance of a contract between the data subject and the Company or for the implementation of pre-contractual measures,
The transfer is necessary for the conclusion or performance of a contract to be entered into between the Company and another natural or legal person for the benefit of the data subject,
The transfer is necessary for an overriding public interest,
Where the transfer of personal data is necessary for the establishment, exercise, or protection of a right;
Where the transfer of personal data is necessary to protect the life or physical integrity of a person who, due to actual impossibility, is unable to express consent, or whose consent is not legally valid, or of another person;
The transfer of personal data from a registry open to the public or to persons with a legitimate interest, provided that the conditions required by applicable legislation for accessing the registry are met and the person with a legitimate interest requests such access. Subject to the provisions of international treaties, in cases where the interests of Türkiye or the relevant data subject would be seriously harmed, our company may transfer personal data abroad only with the permission of the Personal Data Protection Board, after obtaining the opinion of the relevant public institution or organization.
Our company transfers the data subject’s personal data to our group companies, business partners, suppliers, and shareholders located abroad, as well as to legally authorized public institutions and private individuals, in order to fulfill the data processing purposes listed above.
3-Method of Collecting Personal Data : Your personal data is collected by our Company, within the scope of the purposes and legal framework specified above, through physical and/or electronic means—whether fully or partially automated, or through non-automated means provided they form part of a data recording system—from: Our Company’s departments and offices, group companies, social media platforms, applications and software, registration forms, WhatsApp and similar communication channels, email, websites, mobile applications, text messages, call centers, telephone, mail, courier services, in-person delivery of contracts, application forms, and similar means—whether verbally, in writing, or electronically.
4-Your Rights Under the PDPL : Pursuant to Article 11 of the Law, you can exercise these rights by contacting our Company using the methods listed in the “Contact” section of this Clarification Text:
Find out whether your personal data has been processed,
Request information regarding such processing if it is processed,
Find out the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
To know the third parties to whom your personal data has been transferred, whether within or outside the country,
To request the correction of your personal data if it has been processed incompletely or incorrectly,
To request the erasure or destruction of your personal data within the framework of the conditions set forth in Article 7 of the Law,
To request that the third parties to whom your personal data has been transferred be notified of any actions taken in accordance with your rights to rectification, erasure, and destruction as outlined above,
To object to a decision made solely through the automated processing of your personal data that adversely affects you,
To request compensation for any damages you may have suffered as a result of the unlawful processing of your personal data,
5-Contact : In accordance with the Personal Data Protection Law, you may submit your request to exercise the rights listed above in writing or through other methods specified by the Personal Data Protection Board, by calling 0212 580 69 32, by emailing [email protected], or by submitting a written request to our company located at Maslak Mahallesi AOS 55. Sokak 42 Maslak Sitesi No:2/84 34398 Sarıyer/İstanbul.
6-Changes to the Clarification Text : This Clarification Text shall be effective as of the date of its publication. Our company may make changes to this Clarification Text at any time, if necessary. Any changes made shall take effect immediately upon the publication of the Clarification Text on our website.
