Paletra Information Notice on the Processing of Personal Data (KVKK)

1. Data Controller

Luka Rolik Gıda Sanayi Ticaret Limited Şirketi (the "Company")
Address: Siteler Mah. 9 Eylül Cad. No: 11, İç Kapı No: 5, Aliağa / İzmir, Türkiye
Email: info@paletra.net

2. Categories of Personal Data Processed

Which data is processed in Paletra depends on which features you use. No data is processed for a feature you do not use.

a) Identity and account data. Your first and last name; your email address (if you signed in with email, Google or Apple); your sign-in method; the user identifier Paletra assigns to your account. If you continue as a guest, only that user identifier is created. Your date of birth, if you choose to enter it.

b) Contact data. Only the phone number you type when making a reservation; the contact details you share if you are a Paletra Guide; the contact details in the application if you apply as a restaurant. No phone number is asked for to open an account.

c) Taste and preference data. The cuisines you like; your diet; ingredients you dislike, your spice tolerance, proteins and cooking methods you like; your character-trait choices; your "Liked", "Not for me" (and the reasons you pick), "Tried" and favourite marks on dishes; the private scores you give dishes and restaurants.

d) Data that may relate to health.

• The allergies you state;
• your diet (some diets may indicate a health condition or a belief);
• if you turn on "My Paletra": your water log, the daily water, step and calorie targets you set yourself, the goal type you chose;
• the meals you mark "I ate this" and the calorie value the restaurant declared, if any;
• if you allow it, your daily step count and active energy read from Apple Health or Health Connect. These two values are only read and shown on your device; they are not sent to Paletra's servers and not stored.

Paletra does not ask for or process weight, height, heart rate, sleep, test results or medical records.

e) Location data. If you allow it, your device's location is used on your device, only while the app is open, to show nearby restaurants and distances and to confirm you are at the restaurant when you tap "I'm here". Your coordinates are not sent to Paletra's servers and not stored. What is stored is which restaurant you tapped "I'm here" at, the time, and — if a verification was made — a coarse distance band.

f) Reservation and pre-order data. Restaurant, date and time, party size, table, reservation code, guest name and phone number, your note, your special requests (baby chair, accessibility, outdoor, window, celebration); if you pre-ordered, the items and your note. No payment is taken through Paletra; no payment data is processed.

g) Community and content data. Your restaurant reviews; private notes you write to a restaurant; your presence in the live community and your poll votes; your meetups; your likes, comments, saves and follows on guides; reports you file; restaurant and menu information you add to the community; if you are a Paletra Guide, your profile, your guides and the images you upload.

h) Contribution and reward data. Your contribution history, contribution points, reward claims; your Taste Journey badges and the counts they rest on.

i) Notification and device data. If you allow notifications, your device's notification token, operating system type (Android / iOS), language setting and your notification preferences.

j) Transaction security and usage data. Records of actions in the app (for example viewing a restaurant or a dish, scanning a QR code); limit counters kept to prevent abuse; technical attestation data confirming the app is genuine. Our infrastructure provider technically sees your IP address when you connect.

k) Account deletion record. When you delete your account, only a one-way digest (SHA-256) of your user identifier and the time deletion started are kept.

3. Purposes of Processing

Your personal data is processed for the following purposes:

1. creating your account, signing you in, and the security of your account;
2. ranking dish and restaurant recommendations by your taste, your diet and the allergies you state; removing from recommendations the dishes declared to contain an allergen you stated;
3. building the Taste Map and the Taste Journey;
4. providing the "My Paletra" feature: water, meal and goal tracking;
5. showing nearby restaurants and distances; the "I'm here" feature and visit verification;
6. passing your reservation and pre-order requests to the restaurant concerned and managing them;
7. publishing reviews, comments, meetups, polls and guide content; applying the community rules and examining reports;
8. giving restaurants aggregated feedback and statistics stripped of your identity;
9. sending the notifications you allowed;
10. running the contribution-point and reward processes;
11. keeping the service secure, preventing abuse and fraud;
12. measuring and improving how the service works;
13. answering your requests and applications;
14. fulfilling legal obligations and protecting rights.

Paletra does not sell your personal data to third parties for advertising, and the app contains no third-party advertising or tracking software.

4. Method of Collection

Your data is collected, by fully or partly automatic means and in electronic form: through the information you enter in the app (sign-up, profile, preferences, feedback, reservations); through records created automatically as you use the app; if you sign in with Google or Apple, through the identity information received from those providers; and, if you allow it, from your device's location, camera, notification and health (Apple Health / Health Connect) services.

5. Legal Grounds for Processing

• Account, sign-in, profile, recommendation ranking, reservations and pre-orders, rewards — art. 5/2-c — directly related to the establishment or performance of a contract
• Security, prevention of abuse, limit counters, app attestation, account deletion record — art. 5/2-f — legitimate interest of the controller
• Usage records and measurement of the service — art. 5/2-f — legitimate interest, or art. 5/1 explicit consent
• Legal obligations, answering official requests — art. 5/2-ç — legal obligation; art. 5/2-e — establishment, exercise or protection of a right
• Allergies and other data counted as health data (water, meals, goals, steps, active energy) — art. 6 — explicit consent, or the other conditions listed in art. 6/3
• Date of birth (optional, for the zodiac feature) — art. 5/1 explicit consent or art. 5/2-c
• Public taste profile, badge display, publication of a guide's contact details — By your own choice; art. 5/1 explicit consent or art. 5/2-d made public
• Use of location on the device, "I'm here" — art. 5/1 explicit consent or art. 5/2-c
• Sending notifications — art. 5/2-c; for announcement / promotional notifications, additionally approval under Law No. 6563
• Storage of data on servers abroad — art. 9

The permissions the operating system asks for (location, camera, notifications, health) are technical permissions; they do not take the place of explicit consent within the meaning of KVKK. Where explicit consent is required it is taken separately and can be withdrawn at any time.

6. Recipients and Purposes of Transfer

• The restaurant you book or pre-order at. Your name, phone number, party size, date and time, your note and your special requests are passed to that restaurant so that your request can be met.
• The restaurant you write a private note to. The text of your note is passed to the restaurant.
• Restaurants (in general). Restaurants cannot see the private scores and likes you give per person; they see only aggregated results stripped of identity.
• Other Paletra users. Only what you choose to make public: your reviews and comments; your taste profile if you turn it on; the badges you choose to show; the visibility you choose when you tap "I'm here" (first name only or anonymous).
• Infrastructure and service providers (processors). Google LLC / Google Ireland Limited (Firebase authentication, database, file storage, server functions, notification delivery, app attestation; Sign in with Google); Apple Inc. / Apple Distribution International (Sign in with Apple, notification delivery, device attestation); the website hosting provider.
• Competent public institutions and bodies. Only where and to the extent the law requires.

7. Transfer Abroad

Paletra's database and server functions run in Google's data centres in the European Union (Germany and Belgium). Authentication, notification delivery and device attestation services are provided by Google and Apple using systems outside Türkiye as well. Your personal data is therefore transferred abroad.

8. Retention and Deletion

• Your personal data is kept for as long as the purpose of processing requires and, in any case, for as long as your account is open.
• You can delete individual records (a like, a score, a meal, a water entry, a review) inside the app. You can delete your "My Paletra" data separately, without deleting your account.
• When you delete your account inside the app, your data is deleted; past reservation, pre-order and used-reward records remain in anonymised form, with your name, user identifier, phone number and notes removed. Details: the Account Deletion page.
• So that a deletion cannot be left half done and deleted data does not come back, only the one-way digest of your user identifier and the time of deletion are kept.

9. Your Rights under Article 11 of KVKK

By applying to the data controller you have the right to:

a) learn whether your personal data is processed,
b) request information about it if it has been processed,
c) learn the purpose of processing and whether it is used in line with that purpose,
ç) know the third parties to whom it is transferred, in Türkiye or abroad,
d) request its correction if it is incomplete or wrongly processed,
e) request its deletion or destruction under the conditions in Article 7 of KVKK,
f) request that the actions taken under (d) and (e) be notified to the third parties to whom the data was transferred,
g) object to a result against you arising from the analysis of the processed data exclusively by automated systems,
ğ) claim compensation if you suffer damage because of unlawful processing.

About recommendations. The ranking of dishes in Paletra is an automatic calculation and only decides which dishes are shown to you first; it produces no legal or similarly significant effect on you.

10. How to Apply

You can send your requests about your rights, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• by email to info@paletra.net, sent from the email address registered on your Paletra account, or
• in writing to the address above.

Your application must state your first and last name, your request and contact details at which we can reach you. We may ask for additional information to verify your identity.

Your application is concluded free of charge as soon as possible according to the nature of the request, and within thirty days at the latest; if the action requires a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is refused, if you find the answer insufficient, or if no answer is given in time, you may lodge a complaint with the Personal Data Protection Board.

11. Changes

This text may be updated according to changes in our processing activities or in legislation. The current text is published in the app (Settings → KVKK Disclosure) and at https://paletra.net/kvkk; the date at the top shows the latest update.