KVKK Disclosure Statement

1. Data controller

ReserOne is the reservation and operations software brand of NFK Bilişim ve Danışmanlık Hizmetleri Ltd. Şti. For personal-data processing activities carried out through reserone.com, the data controller is NFK Bilişim ve Danışmanlık Hizmetleri Ltd. Şti.

Address: Fatih Sultan Mehmet Mahallesi, Balkan Caddesi No:62/A, Ümraniye / İstanbul, Türkiye

Contact: info@reserone.com · +90 850 309 75 34

2. Scope

This statement covers personal-data processing that takes place when you visit the corporate/product website at reserone.com or use its contact and demo request forms.

Personal-data processing in the restaurant operations panel and guest reservation interface is subject to separate notices and contractual arrangements specific to the relevant service and customer relationship.

3. Personal data processed

Depending on how you use the website and contact us, the following limited categories of personal data may be processed:

• Identity data: first and last name
• Contact data: email address and phone number
• Request and customer-transaction data: business name, city, business type, number of branches, subject and the free-text message you provide
• Transaction-security and technical records: IP address, access/submission time, requested page or the page from which a form was submitted, server response and browser/user-agent information
• Source information: where analytics preference is enabled, referring page, first landing page and any UTM campaign parameters
• Preference data: your cookie/analytics choice and the time at which that choice was made
• Analytics data: only where you have explicitly consented to analytics and the applicable cross-border transfer requirements are satisfied, usage statistics such as page views, sessions and conversions together with online identifiers

4. Purposes and legal bases

Data you submit through contact and demo forms is processed to receive and assess your request, contact you, provide product or demo information, conduct quotation and pre-contract discussions, protect form security and prevent abuse.

Depending on the nature of the request, this processing relies on the legal bases in Article 5/2 of the KVKK, including processing directly related to the establishment or performance of a contract, establishment/exercise/protection of a right, fulfilment of the data controller’s legal obligations and the legitimate interests of the data controller provided your fundamental rights and freedoms are not harmed.

The checkbox below the form is not a declaration of explicit consent; it is only a record that you have read and been informed by this disclosure statement.

Non-essential analytics technologies such as Google Analytics 4 are activated only after you separately give explicit consent through the cookie preferences interface and the cross-border transfer requirements under Article 9 of the KVKK are satisfied.

Form data is not used for advertising, behavioural profiling or unsolicited commercial electronic messages unrelated to your request. If such marketing communication is introduced, the required separate permission process will be followed.

5. Method of collection

Technical records are collected automatically through server and security systems when you access the site. Form data is collected electronically when you complete and submit a contact or demo request form.

Analytics usage data is collected automatically through cookies or similar technologies only when your analytics preference is enabled and the relevant transfer conditions are satisfied.

6. Transfers of personal data

Your personal data may be transferred, on a purpose-limited and proportionate basis, to authorised Company employees handling your request, public authorities and judicial bodies authorised by law, legal or financial advisers where necessary, and information-technology service providers.

Website hosting and corporate email infrastructure are provided through Natro services. The contractual provider of hosting and email services offered under the Natro brand is Çizgi Telekomünikasyon A.Ş. The website hosting infrastructure is provided from a data centre in İstanbul.

Contact and demo form contents are not stored in a separate customer database on the website; they are delivered to the corporate mailbox at info@reserone.com. Limited technical records required for form security and rate limiting may be retained separately.

If analytics services are activated, measurement data may be processed abroad. Regular cross-border transfers are carried out only where a valid transfer mechanism under Article 9 of the KVKK, such as an adequacy decision or an appropriate safeguard, is in place.

Personal data is not sold or rented to third parties for advertising purposes.

7. Retention periods

Technical server and security logs are retained for no longer than 6 months unless a security incident, legal claim or statutory obligation requires a longer period.

Contact, information and demo requests that do not develop into a commercial relationship are retained for no longer than 2 years from the date of the last communication.

Information that becomes part of a quotation, contract, invoice, support or commercial relationship is retained for the periods required under applicable legislation and the Company’s legal retention obligations.

When the retention period expires or the reasons for processing cease to exist, personal data is erased, destroyed or anonymised.

8. Data security

Appropriate technical and organisational measures are applied to prevent unlawful processing or access and to ensure that personal data is stored securely.

The website is served over HTTPS; forms use server-side validation, length and format controls, abuse prevention and rate limiting. SMTP credentials are kept outside the public web root and source-code repository.

The contact and demo forms do not request special categories of personal data. Please do not enter health data, identity documents, passwords, bank/card information or other sensitive or unnecessary information into free-text fields.

9. Rights of the data subject

Under Article 11 of the KVKK, you may ask whether your personal data is processed and request information, learn the purposes of processing and third parties to whom data is transferred, request correction of incomplete or inaccurate data, request erasure or destruction where the statutory conditions are met, object to an adverse result produced exclusively by automated analysis and claim compensation where you suffer damage due to unlawful processing.

10. How to apply

You may submit KVKK requests, together with information sufficient to verify your identity and request, by signed written application to NFK Bilişim ve Danışmanlık Hizmetleri Ltd. Şti., Fatih Sultan Mehmet Mahallesi, Balkan Caddesi No:62/A, Ümraniye / İstanbul, Türkiye.

You may also apply to info@reserone.com using an email address that you have previously notified to us and that is registered in our systems. Other methods permitted by law, including registered electronic mail (KEP), secure electronic signature or mobile signature, may also be used where applicable.

Applications are concluded as soon as possible and within 30 days at the latest depending on the nature of the request. Where an additional cost is required, the fee set by the Personal Data Protection Board may be charged.

11. Updates

This statement is updated when the website’s personal-data processing activities or applicable legislation change. The current version is published on reserone.com together with its last-updated date.