Privacy Notice

Draft — legal review required. This text is a template and must be reviewed by a lawyer before publication.

This Privacy Notice explains how we handle personal data collected through the YumiPokeGo corporate franchise website (the “Site”), including when you browse the Site or submit a contact or franchise application form. It is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), which governs our processing activities. A Turkish version is also available; if there is any inconsistency, the Turkish version prevails.

Who We Are

The data controller responsible for your personal data is YumiPokeGo A.Ş. (the “Company”, “we”, “us”), the owner and operator of the YumiPokeGo brand.

• Legal name: YumiPokeGo A.Ş.
• Registered address: 1137. Sokak, 35930 Çeşme, İzmir, Türkiye
• E-mail: contact@yumipokego.com.tr
• Phone: +90 232 722 48 47

What Data We Collect

Depending on how you interact with the Site, we may process:

• Identity data: first and last name.
• Contact data: e-mail address, phone number, city and country of residence.
• Franchise application data: your intended investment budget, preferred location or territory, relevant experience in food service, retail or business management, current occupation, and anything else you choose to include in the form.
• Technical and security data: IP address, browser and device information, date and time of form submissions, and security logs.
• Cookie and analytics data: your cookie preferences and, only if you consent, information about how you use the Site (pages visited, time on page, referring source). See our Cookie Policy for details.

We do not ask for sensitive data such as health information, religious beliefs or ethnic origin. Please do not include this kind of information in your application.

Why We Use Your Data

We use your personal data to:

• receive and evaluate your franchise application and run the initial screening process;
• contact you about your application or enquiry and answer your questions;
• conduct pre-contract discussions and negotiations;
• keep the Site secure and prevent spam or misuse;
• analyse Site usage and improve our content, if you consent;
• send you news about franchise opportunities and announcements by e-mail or SMS, if you consent;
• comply with legal obligations and respond to requests from competent authorities.

Under Turkish Law No. 6563 on the Regulation of Electronic Commerce, marketing messages are only sent with your prior consent, which is recorded in Türkiye’s Message Management System (İYS). You can withdraw consent at any time using the unsubscribe link in any message or via İYS.

Our Legal Grounds

We rely on the following legal grounds under Article 5 of the KVKK:

• Contract (Art. 5(2)(c)): processing is necessary to take steps towards entering into a franchise agreement with you.
• Legal obligation (Art. 5(2)(ç)): processing is necessary to comply with our legal obligations.
• Legitimate interests (Art. 5(2)(f)): processing is necessary for our legitimate interests, such as managing applications, communicating with you and securing the Site, provided your fundamental rights and freedoms are not harmed.
• Explicit consent (Art. 5(1)): for analytics cookies, marketing messages and, where required, international transfers.

Who We Share Data With

We share personal data only as needed for the purposes above, with:

• website hosting providers;
• form and e-mail service providers;
• analytics providers (only if you consent);
• our legal and financial advisers;
• public authorities, where required by law.

A list of our service providers: Netlify, Inc. (hosting and form processing) and Google LLC (Google Analytics 4 — only if you consent to analytics cookies).

International transfers. Some of our hosting, form and analytics providers may store or process data on servers outside Türkiye. Where this happens, transfers are made in line with Article 9 of the KVKK — to countries benefiting from an adequacy decision, under appropriate safeguards such as the standard contractual clauses published by the Personal Data Protection Authority, or, for occasional transfers where no such safeguard is available, on the basis of your explicit consent.

How We Collect Data

We collect personal data electronically, by fully or partly automated means, through the franchise application and contact forms on the Site, through e-mails and phone calls you initiate, and through cookies and similar technologies.

How Long We Keep Data

We keep personal data only for as long as necessary for the purposes described above, or as required by law. After that, it is deleted, destroyed or anonymised.

• Unsuccessful or inactive franchise applications: 2 years from the application date
• Contact form submissions: 1 year after the request is resolved
• Security logs: 2 years
• Analytics data: 14 months
• Marketing consent records: 3 years after consent is withdrawn

Your Rights

Under Article 11 of the KVKK, you have the right to:

• find out whether we process your personal data and, if so, request information about it;
• learn the purpose of processing and whether it is used accordingly;
• know the third parties, in Türkiye or abroad, to whom your data is transferred;
• ask us to correct incomplete or inaccurate data;
• ask us to delete or destroy your data under the conditions set out in Article 7 of the KVKK;
• ask us to notify third parties of any correction, deletion or destruction;
• object to an outcome against you that results solely from automated analysis;
• claim compensation if you suffer damage due to unlawful processing.

How to Exercise Your Rights

In line with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can submit a request:

• in writing, with a wet signature, delivered in person or via a notary to 1137. Sokak, 35930 Çeşme, İzmir, Türkiye;
• by e-mail to contact@yumipokego.com.tr, sent from the e-mail address you previously provided to us and that is registered in our systems.

Your request should include your full name, signature (for written requests), Turkish ID number (or, for non-Turkish citizens, nationality and passport or ID number), postal address, e-mail address and phone number if available, and a description of your request. We will respond free of charge as soon as possible and within 30 days at the latest. If responding involves additional cost, a fee may be charged in line with the tariff set by the Personal Data Protection Board.

Data Controllers’ Registry (VERBİS)

Whether the Company must register with the Data Controllers’ Registry (VERBİS) is assessed against the thresholds set by the Personal Data Protection Board; registration details will be published here if the obligation arises.

Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in the law or in how we process data. The current version is always published on this page.