Draft — to be reviewed by a lawyer.
This is an informational English translation of the Turkish notice; if the two differ, the
Turkish version prevails. Fields in square brackets ([…])
will be completed once company details are finalised.
Personal data protection
Demo Request Form Privacy Notice
Last updated: 25 September 2026 (draft)
This notice has been prepared under Article 10 of Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to explain how we process the personal data you share through the demo request form on mihmanai.com.
This notice only covers the demo request form on the website. Data processing while the Mihman product runs in restaurants will be governed separately under the pilot agreement.
1. Data controller
[Company name] (“Mihman”)
Address: [Full address]
MERSIS no.: [MERSIS number]
Email: iletisim@mihmanai.com
2. What personal data do we process?
- Identity: full name.
- Contact: phone number, email address.
- Professional details: business name, city, number of branches, approximate number of tables, your role in the business.
- Information you add: anything you write in the “Note” field. Please don’t include personal data about your guests or staff there.
- Marketing: whether you agreed to receive announcement emails, and when.
- Source information: which link brought you to the site (UTM parameters: source, medium, campaign), the referring page and the first page you visited.
- Transaction security: the IP address, browser information and submission time recorded by our hosting provider when the form is sent.
Our site does not use cookies. Your browser’s session storage (sessionStorage) is used to keep the source information until the form is submitted; it is deleted from your browser when you close the tab. The cookieless analytics tool we use for visit statistics is configured not to store personal data.
3. Why do we process it, and on what legal basis?
| Purpose | Legal basis (KVKK Art. 5) |
|---|---|
| Reviewing your demo request, scheduling the demo and contacting you | Directly related to the formation of a contract (Art. 5/2-c) |
| Measuring, in aggregate, which promotional channels attract interest | Legitimate interest (Art. 5/2-f) |
| Protecting the form against abuse and spam, and ensuring information security | Legitimate interest (Art. 5/2-f) |
| If you opted in, emailing you announcements about Mihman | Explicit consent (Art. 5/1) and consent to commercial electronic messages under Law No. 6563 |
| Requests from authorised bodies and legal obligations | Expressly provided for by law and compliance with a legal obligation (Art. 5/2-a, ç) |
4. How do we collect it?
Your personal data is collected electronically when you fill in the demo request form on our website, and partly by automated means (source information, IP address).
5. Who do we share it with?
- Hosting and form service: our website and demo request form are hosted on the infrastructure of Netlify, Inc. (USA). Your form data is therefore stored on servers abroad. This transfer is carried out under Article 9 of KVKK with [appropriate safeguards / standard contract].
- Email service: [email service provider], to reply to you and (if you opted in) send announcements.
- Request log: to keep track of demo requests, your form data is stored in a Google Sheets spreadsheet of Google LLC (USA), accessible only to our authorised team. This transfer is also carried out under Article 9 of KVKK with [appropriate safeguards / standard contract].
- WhatsApp (optional): if you message us via the WhatsApp link on the site, the conversation takes place on WhatsApp (Meta) infrastructure and your phone number and message content are processed under that service’s terms. Using this channel is optional; you can also reach us by email.
- Authorised public bodies: only where there is a legal obligation, and only as far as necessary.
We don’t sell your personal data or share it with third parties for advertising.
Note for counsel: the mechanism under KVKK Art. 9 (as amended in 2024) relied on for the transfer abroad (standard contract and notification to the Board, etc.) must be confirmed. If the data should stay in Türkiye, the form service can be moved to a provider based in Türkiye.
6. How long do we keep it?
- Demo request details: if you don’t move on to a pilot setup after the demo, kept for at most 12 months from the request date, then deleted or anonymised.
- If you move on to a pilot setup: for the duration of the contractual relationship and the statutory limitation periods after it ends.
- Consent to commercial messages: until you withdraw it. Consent and opt-out records are kept for 3 years after the consent ceases to be valid, as required by the relevant legislation.
- Transaction security records: limited to the hosting provider’s retention periods.
7. Your rights
Under Article 11 of KVKK, you have the right to contact us to:
- learn whether your personal data is processed,
- request information about it if it has been processed,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom it has been transferred,
- request correction if it is incomplete or inaccurate,
- request its deletion or destruction under the conditions in Article 7 of KVKK,
- request that third parties to whom it was transferred be notified of corrections, deletion or destruction,
- object to a result against you arising exclusively from automated analysis,
- claim compensation if you suffer damage due to unlawful processing.
You can withdraw consent to announcement emails at any time using the “unsubscribe” link in any email or by writing to us.
8. How can you contact us?
You can send your requests, in line with the Communiqué on the Procedures and Principles of Applications to the Data Controller, by email to iletisim@mihmanai.com or in writing to [full address]. Your request will be concluded free of charge within 30 days at the latest.