Privacy Policy

Oquto is the data controller of your personal data with respect to our website, our quotation and contact forms, customer accounts, and billing and support processes. Our contact details are set out below:

With respect to the data of guests who use the digital menus published by businesses through the Platform, the relevant business acts as the data controller and the Company acts as the data processor. Details on this matter are explained under the heading “Data of Digital Menu Guests”.

The personal data we process varies according to the nature of your relationship with us:

• Website visitors: technical records automatically generated by the server, such as IP address, browser type and version, operating system, pages visited, and date and time of access.
• Persons who complete our quotation and contact forms: first name, last name, business name, business type, telephone number, email address, city, business address, number of tables or rooms, package preference and message content.
• Customer businesses and their authorized representatives: identity and contact details of the authorized person, trade name, tax office and tax identification number, billing address, subscription and payment records, Management Panel username and encrypted password, panel activity logs and support requests.
• Persons who contact us by email, telephone, WhatsApp or social media: contact details and the content of correspondence and conversations.

We do not request special categories of personal data (such as health, religion, ethnic origin or biometric data). We kindly ask that you do not enter such information in the free-text fields of our forms.

• To evaluate your requests for quotations, demos and sample kits, to prepare quotations tailored to you and to deliver the sample kit to your address;
• To conclude and perform the subscription agreement, set up the Platform, manage accounts and provide the services;
• To carry out billing, collection and accounting operations;
• To respond to support requests, provide user training and send service-related notifications;
• To ensure the security of the website and the Platform, prevent misuse and unauthorized access, and detect and resolve errors;
• To measure service quality and improve our services;
• To fulfil retention, notification and disclosure obligations arising from legislation and to respond to requests from competent authorities;
• To establish, exercise and protect our rights in legal disputes;
• Only if you have given your consent, to send commercial electronic messages regarding campaigns, new features and events.

We process your personal data on the basis of the following legal grounds set out in Article 5 of the KVKK: processing is directly related to the conclusion or performance of a contract; processing is necessary for compliance with our legal obligations; processing is necessary for the establishment, exercise or protection of a right; processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms; and processing is expressly provided for by law. The sending of commercial electronic messages is based solely on your explicit consent and on the approval obtained pursuant to Law No. 6563 on the Regulation of Electronic Commerce.

Where the GDPR applies, the corresponding legal bases are the performance of a contract or the taking of steps at your request prior to entering into a contract (Article 6(1)(b)), legal obligation (Article 6(1)(c)), legitimate interest (Article 6(1)(f)) and consent (Article 6(1)(a)).

Our website does not use analytics, marketing or third-party advertising cookies intended to track visitor behaviour, create profiles or display advertisements. No information intended to identify you is stored in your browser’s local storage.

The hosting and security infrastructure of the website may use only strictly necessary technical cookies for purposes such as delivering pages securely and without interruption and blocking malicious traffic. As these cookies are essential for the provision of the service, they are not subject to consent. You may delete or block cookies through your browser settings; however, in that case some functions of the site may not work as expected.

Should a decision be made in the future to use cookies for analytics or marketing purposes, such cookies will be activated only after your explicit consent has been obtained, and this Policy will be updated accordingly.

• Web fonts: The fonts on our pages are served directly from our own servers; no personal data is transferred to a third-party font service for this purpose.
• Map: The “Open in map” link on our contact page opens Google Maps in a new tab only if you click it; no data is transferred to this service unless you click the link.
• Social media: The links to our X, Instagram and Facebook accounts serve solely for redirection purposes; our pages do not contain any tracking plug-ins belonging to these platforms.

The Company is not responsible for the content or privacy practices of linked third-party websites. We recommend that you review the respective privacy policies before visiting such sites.

Guests access the digital menu without downloading any application or creating an account, by scanning the QR code or holding their phone near the NFC tag located on the tables, in the rooms or on the sun loungers of businesses. During such use, the table, room or sun lounger number, the content of orders and requests (calling a waiter, requesting the bill, etc.), language preference and technical information relating to the device and browser may be processed.

These data are processed on behalf of, and in accordance with the instructions of, the business that publishes the menu. The business is the data controller with respect to these data and is responsible for informing its guests. The Company, in its capacity as data processor, processes these data solely for the purpose of providing the service, within the framework of the agreement concluded with the business, and does not use them for any other purpose. Guests should submit their requests regarding these data directly to the relevant business; any requests received by the Company are forwarded to the relevant business without delay.

We never sell or rent your personal data under any circumstances. Your data may be shared, only to the extent required by the purposes set out above and subject to confidentiality obligations, with the following categories of recipients:

• Suppliers from whom we obtain hosting, cloud infrastructure, email and software services;
• Courier and logistics companies for the shipment of sample kits and hardware;
• Payment institutions and banks;
• Persons and organizations from whom we obtain financial advisory, audit and legal consultancy services;
• Providers of POS, billing and hotel management (PMS) systems with which an integration is established at the request of the customer business;
• Public institutions and organizations and judicial authorities that are legally authorized.

The servers of some of our infrastructure providers may be located outside Türkiye. In such cases, your personal data are transferred in accordance with Article 9 of the KVKK, provided that one of the appropriate safeguards is in place, such as the existence of an adequacy decision regarding the country of transfer or the execution of the standard contract published by the Personal Data Protection Board. Standard contracts are notified to the Board within five business days of their execution. For transfers from the European Economic Area, the safeguards set out in Chapter V of the GDPR apply.

We take administrative and technical measures to ensure an appropriate level of security in order to prevent the unlawful processing of and access to your personal data and to ensure the safekeeping of your data. These measures include the following:

• Encryption of website and Platform traffic with TLS and irreversible storage of passwords;
• Role-based authorization and access restriction in accordance with the “need-to-know” principle;
• Maintenance and regular review of access and activity logs;
• Regular backups, security updates and vulnerability checks;
• Input validation on forms and rate limiting against automated misuse;
• Execution of confidentiality agreements with employees and suppliers, and informing staff on data protection.

If, despite all measures, the processed personal data are obtained by others through unlawful means, this will be notified to the Personal Data Protection Board and to the affected data subjects as soon as possible and in any event within 72 hours, pursuant to Article 12 of the KVKK.

We retain your personal data for the period necessary for the purpose for which they are processed and for the maximum periods prescribed by the relevant legislation. Quotation and contact requests that do not result in a contract are retained for two years from the date of last contact, and contract and invoice records are retained for ten years from the termination of the contract. Data whose retention period has expired are erased, destroyed or anonymized. Detailed retention periods are set out in the KVKK Privacy Notice.

Pursuant to Article 11 of the KVKK, you have the right to learn whether your personal data are processed, to request information if they have been processed, to request their rectification or erasure, to object to processing and to claim compensation for any damage you have suffered. The methods of application are explained in the KVKK Privacy Notice.

Where the GDPR applies, you additionally have the right to data portability, to request restriction of processing, to withdraw your consent at any time for processing based on consent, and to lodge a complaint with the data protection supervisory authority in your country. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

You may stop receiving commercial electronic messages at any time, free of charge, by using the opt-out link in the messages or by writing to ⁦destek@oquto.com⁩.

Our website and Platform management services are intended for businesses and are not directed at persons under the age of 18. We do not knowingly collect personal data of persons under the age of 18. If we become aware that such data have been submitted to us, the data concerned will be erased immediately.

This Policy may be updated in line with changes in legislation or in our services. The current version is always published on this page, and the “Last updated” date at the top of the page is amended. Material changes are additionally notified to our registered customers by email.

For any questions or requests regarding this Policy or the processing of your personal data, you may contact us through the following channels: