Privacy and cookies

KVKK privacy notice

Data controller

Under Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is ÖZ DAMAR YAPI SANAYİ VE TİCARET LTD. ŞTİ..

Address: Ahmet Yesevi Mahallesi, Ergin Sokak No:107 D:1, 16140 Nilüfer/Bursa
Email: info@loabursa.com
Website: https://loabursa.com

Personal data processed

Depending on the nature of our services, the following personal data may be processed:

• Identity and contact: when you call us or write on WhatsApp, your name, phone number and message content;
• Reservation and transaction: reservation date, time, party size, requests and related communication records;
• Website: technical records kept by the hosting infrastructure during a site visit, such as IP address, browser information and access time. There is no form on the site; the site does not ask you for personal data;
• Physical premises security: security camera footage;
• Guest Wi-Fi: connection, device, IP/MAC address and time records;
• Loyalty system: once activated, contact, preference, visit/transaction and points records.

We kindly ask that you do not send us special categories of personal data.

Purposes of processing personal data

Personal data is processed for the purposes of ensuring the safety of the business and visitors, taking and managing reservations, providing and securing the guest Wi-Fi service, operating and securing the website, responding to requests, improving service quality, fulfilling legal obligations and, where necessary, establishing, exercising or protecting a right.

Once the loyalty system is activated, data required for personalised benefits, points and campaign processes may be processed. Further information is provided at the enrolment stage for this process; explicit consent is obtained where required.

Collection methods and legal grounds

Data is obtained, automatically or partly automatically, through the website's hosting infrastructure, security cameras, guest Wi-Fi infrastructure, phone calls, WhatsApp messages, reservation communication and loyalty system channels.

Processing activities rely on the legal grounds set out in Article 5 of the KVKK: being necessary for the establishment or performance of a contract, fulfilling the data controller's legal obligation, the establishment, exercise or protection of a right, and legitimate interest provided it does not harm fundamental rights. Explicit consent is obtained for marketing or other processing that legislation requires explicit consent for.

Transfer of personal data

Personal data may be transferred, only for the stated purposes and to the extent necessary, to hosting/IT service providers, technical service providers, telecommunication and messaging service providers, guest Wi-Fi infrastructure providers, loyalty system service providers and legally authorised public institutions.

Because of the use of Cloudflare (the site's hosting and content delivery infrastructure) and services such as Meta/WhatsApp that have infrastructure abroad, limited technical or communication data may be transferred abroad. Such a transfer is carried out within the framework of the KVKK's provisions on transfers abroad and applicable adequate safeguards or explicit consent mechanisms.

Camera, guest Wi-Fi and reservation processes

Security cameras: footage may be recorded inside and around the business for the safety of persons and property, the detection of incidents and the protection of legal rights. Recordings are accessible only to authorised persons.

Guest Wi-Fi: connection and traffic records may be processed to provide the service, ensure network security and fulfil legal obligations.

Phone/WhatsApp reservations: name, phone, message and reservation details are processed to create, confirm and finalise the relevant request. Use of WhatsApp is additionally subject to Meta's own privacy terms.

Retention periods and data security

Personal data is retained only for as long as required by the purpose of processing and legal obligations. Camera footage is kept for a proportionate and limited period for security purposes; Wi-Fi records for the period required by applicable legislation; reservation and communication records for the period needed to finalise the request and applicable statute-of-limitations periods.

When the purpose of processing or legal ground ceases to exist, data is deleted, destroyed or anonymised in accordance with legislation. Appropriate technical and administrative measures are applied against unauthorised access, loss and unlawful processing.

Data subject rights and requests

Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether it is used accordingly, to know the third parties to whom it is transferred, to request correction of incomplete or inaccurate data, to request its deletion/destruction where the conditions are met and that these actions be notified to the parties to whom it was transferred, to object to a result arising from automated analysis alone to your detriment, and to claim compensation for damage arising from unlawful processing.

You may submit your request, together with information sufficient to verify your identity, to info@loabursa.com or to the postal address above. Requests are finalised as soon as possible depending on their nature, and within 30 days at the latest.