Privacy Notice
Last updated: 4 November 2026
This is a translation for convenience; if the two versions differ, the Turkish version prevails.
As HYPE Restoran İşletmesi Mimari Tasarım LTD. ŞTİ. ("Charm Bistro" or "the Company"), acting as "Data Controller" under the Turkish Personal Data Protection Law No. 6698 ("PDPL", in Turkish "KVKK"), we take care to keep your personal data secure and to process it lawfully.
This notice explains, in connection with your visits to our website (www.charmbistro.com), your reservations, your messages to us and your visits to our venue, for what purposes your personal data is processed, to whom it may be transferred, how it is collected, on which legal grounds, and what your rights under the PDPL are.
Our website has no membership, online ordering, payment or forms, and it uses no advertising, analytics or tracking cookies (details in our Cookie Policy).
1. Personal data processed, purposes and legal grounds
Your personal data is processed on the legal grounds set out in Articles 5 and 6 of the PDPL, for the following purposes:
| Data category | Data processed | Purposes | Legal ground |
|---|---|---|---|
| Identity | First name, surname | Making and confirming your reservation | Directly related to the conclusion or performance of a contract (Art. 5/2-c) |
| Contact | Phone number, e-mail address, Instagram/WhatsApp username | Confirming your reservation and informing you of changes, answering your requests and questions | Directly related to the conclusion or performance of a contract (Art. 5/2-c); legitimate interest of the data controller (Art. 5/2-f) |
| Customer transaction | Reservation date, time, party size, seating preference, message contents, requests and complaints | Managing reservations and hosting guests, following up requests and complaints | Directly related to the conclusion or performance of a contract (Art. 5/2-c); legitimate interest of the data controller (Art. 5/2-f) |
| Health (special category) | Only the allergy or dietary information you choose to share | Serving you safely | Your explicit consent (Art. 6/3) |
| Transaction security | IP address, date and time of access, pages visited, browser information (technical logs of our hosting provider) | Keeping the website secure and available, preventing unauthorised access and attacks | Legitimate interest of the data controller (Art. 5/2-f) |
| Physical security | Security camera footage inside the venue and at the entrance | Ensuring the safety of the venue, guests and staff | Legitimate interest of the data controller (Art. 5/2-f) |
Important notes:
- We use health information such as allergies only if you share it and only to serve you safely; we do not keep it after your visit.
- The Google Maps window on our website does not load until you press "Show map". When you follow the Google Maps, WhatsApp or Instagram links, that service's own privacy policy applies. See our Cookie Policy for details.
2. How your personal data is collected
Your personal data is collected electronically: directly from you through phone calls, WhatsApp, Instagram and e-mail messages; automatically by our hosting provider for the website's technical logs; and through the security cameras at our venue.
3. To whom and for what purposes personal data may be transferred
Your personal data is never sold or shared for advertising. In line with Articles 8 and 9 of the PDPL and with the necessary administrative and technical measures, it may only be transferred to:
- Service providers: Cloudflare, Inc., which hosts our website (technical logs), Meta Platforms, which provides the channels you contact us through (WhatsApp, Instagram), and our e-mail provider, limited to providing the service. These providers' servers may be located abroad; transfers abroad are made in accordance with Article 9 of the PDPL.
- Authorised public authorities: public institutions and judicial authorities authorised by law, to fulfil our legal obligations or within judicial and administrative investigations, upon request and as far as the law allows.
4. Retention, erasure, destruction or anonymisation
- Reservation details are kept for at most 30 days after the reservation date.
- Website technical logs are kept for the short period set by our hosting provider.
- Security camera footage is kept for 30 days and is then overwritten.
When the reasons for processing no longer exist and the statutory retention periods (for example under the Tax Procedure Law and the Turkish Commercial Code) have expired, your personal data is erased, destroyed or anonymised by the Company, on its own initiative or at your request.
5. Your rights under the PDPL (Article 11)
As a data subject, you may apply to the Company to:
- find out whether your personal data is processed,
- request information about the processing,
- find out the purpose of the processing and whether the data is used accordingly,
- know the third parties in Türkiye or abroad to whom the data is transferred,
- request correction if the data is incomplete or incorrect,
- request erasure or destruction under the conditions of Article 7 of the PDPL,
- request that third parties to whom the data was transferred be notified of such correction, erasure or destruction,
- object to a result against you that arises solely from automated analysis of your data,
- claim compensation for damage caused by unlawful processing.
6. Data controller and how to apply
You can send your requests, together with information that verifies your identity, in line with the Communiqué on the Procedures and Principles of Applications to the Data Controller: in writing to the address below, with a secure electronic or mobile signature, or by e-mail to the address below from an e-mail address you have previously given us.
- Data controller: HYPE Restoran İşletmesi Mimari Tasarım LTD. ŞTİ.
- MERSIS no: 0465126874000001 · Tax office / no: Kavaklıdere, 465 126 87 40
- Address: Arjantin Cd. No: 6/A, Gaziosmanpaşa, 06700 Çankaya / Ankara, Türkiye
- E-mail: charmbistro@hotmail.com
Requests are answered free of charge as soon as possible, and within 30 (thirty) days at the latest, depending on the nature of the request.