Privacy Notice

1. Who is responsible for your data

The data controller for this website is [DATA CONTROLLER LEGAL NAME], which operates the café Roots & Roasted on Sultanahmet Square, Istanbul.

Legal name

[DATA CONTROLLER LEGAL NAME]

Address

Binbirdirek Mah., At Meydanı Cd. No:10/1, 34122 Fatih/İstanbul, Türkiye

Email

[EMAIL]

Instagram

@rootsroasted (direct message)

You can use either channel for any question or request about your personal data.

2. What we collect, and why

This is a small café website. It collects personal data in three situations only, and always automatically through the website and its hosting infrastructure.

Visiting the website. The site is hosted by Vercel. Like any web server, Vercel’s infrastructure records technical details of each request in server logs: your IP address, your browser type (user agent), the page requested and the time. We use these logs only to keep the site running and secure — for example to detect abuse or fix errors. We do not use analytics tools, tracking pixels or advertising cookies, and we do not build profiles of visitors.

Leaving a review. If you submit a review on our Reviews page, we store what you type and upload:

• the name you enter (2–60 characters, exactly as you typed it);
• your star rating (1–5) and the text of your review;
• up to three photos, if you choose to add any (JPEG, PNG or WebP, up to 4 MB each);
• the language you wrote in (English or Turkish), the time of submission and the time we approved or rejected the review;
• a one-way hash of your IP address (SHA-256 with a secret key). We never store the IP address itself. The hash only lets us block a second submission from the same connection within 10 minutes and detect abuse.

We use this data to moderate the review, publish it if approved, and prevent spam. Nothing from the form is used for marketing, sold, or shared with anyone other than the service providers listed in section 6. We do not ask for your email address or phone number.

The form also contains a hidden field that only automated bots fill in. Submissions that trigger it are discarded and never stored.

Staff sign-in. Our own staff sign in to a private admin area to moderate reviews. That sign-in sets one cookie (see section 8). Ordinary visitors never receive it.

3. Legal basis

Under the KVKK we process your data on the following grounds:

• Your explicit consent (KVKK Article 5(1)) — for storing and publishing your review: your name, rating, text and photos. You give it by ticking the consent box on the form, and you can withdraw it at any time by asking us to remove the review.
• Our legitimate interest in running a secure website (KVKK Article 5(2)(f)) — for server logs, the hashed IP address and the staff sign-in cookie.
• Compliance with a legal obligation (KVKK Article 5(2)(ç)) — if a competent authority lawfully requires us to hand over data.

If you are visiting from the European Economic Area, the same processing rests on Article 6(1)(a) GDPR (consent) for reviews and photos, Article 6(1)(f) GDPR (legitimate interests) for logs, abuse prevention and the staff cookie, and Article 6(1)(c) GDPR (legal obligation) where applicable.

4. Publication of reviews

Approved reviews are public. They appear on both the English and Turkish review pages together with the name you entered, your rating, your text and any photos. Anyone on the internet can read them, and search engines may index or cache them.

Please choose a name you are comfortable seeing online — a first name or initials is fine. Do not include other people’s personal details in your text, and do not upload photos in which other people can be identified unless they have agreed to it. Photos can also carry embedded metadata such as the place they were taken; remove it before uploading if you would rather not share it.

Reviews wait in a queue and are shown only after a member of our team has approved them. We may decline to publish a review, or remove one later, without giving a reason.

5. How long we keep data

• Published reviews and their photos: for as long as the review stays on the site, or until you ask us to delete it.
• Reviews we decline to publish: deleted within 30 days of the decision, together with any photos.
• The hashed IP address: kept with the review record and deleted with it.
• Server logs: kept by our hosting provider Vercel for the period set in Vercel’s own policies. We do not keep separate copies.

When a review is deleted, the database record and the photo files are removed together. Copies that search engines or other websites have already made are outside our control.

6. Service providers and transfers abroad

We do not run our own servers. The website and its data are handled by the following companies acting on our behalf as data processors:

• Vercel Inc. (USA) — website hosting, the serverless functions that run the review form and the admin area, and Vercel Blob storage for review photos.
• Neon Inc. (USA) — the Postgres database that stores reviews, provisioned through Vercel.

Their servers may be located outside Türkiye, in the European Union and/or the United States, so your personal data may be transferred abroad. We rely on the contractual data-protection commitments these providers give (their data processing agreements and standard contractual clauses) and, where the law requires it, on your explicit consent, in line with Article 9 of the KVKK and Chapter V of the GDPR.

We do not share your data with anyone else, we do not sell it, and we do not use it for advertising. If the law obliges us to, we may have to disclose data to a competent authority.

7. Your rights and how to use them

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is being processed, and request information about it if so;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties, in Türkiye or abroad, to whom the data has been transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for the data to be deleted or destroyed when the reasons for processing no longer apply;
• ask that corrections and deletions be passed on to third parties who received the data;
• object to a result that is to your detriment and produced solely by automated analysis of your data;
• claim compensation for damage caused by unlawful processing.

If you are in the European Economic Area you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection under Articles 15–21 of the GDPR, and the right to withdraw consent at any time without affecting the lawfulness of earlier processing.

How to exercise them: email [EMAIL] or send a direct message to @rootsroasted on Instagram. Tell us which review is yours (the name you used and the approximate date are enough) and what you would like us to do. We answer as soon as possible and within 30 days at the latest, free of charge. We may ask you to confirm that the review is yours before we act.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Authority of Türkiye (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr). If you are in the European Economic Area, you can also complain to the data protection authority of your country.

8. Cookies and embedded content

This website sets a single cookie, named rr_admin, and only when a member of our staff signs in to the admin area. It is a strictly necessary session cookie (HttpOnly, Secure, valid for 7 days) that keeps the staff member signed in. Ordinary visitors never receive it, and no consent banner is needed for it.

We use no analytics, advertising or social-media tracking cookies, and no third-party scripts that follow visitors. Our fonts are served from our own site, not from a font provider.

The map in the “Visit us” section is a Google Maps embed. It loads only when you click the “Load map” button; until then nothing is sent to Google. Once you click, Google receives your IP address and may set its own cookies, and Google’s privacy policy applies from that point. If you would rather not load it, use the “Open in Google Maps” link instead.

9. Children

This website and its review form are meant for adults. Reviews should be submitted by people aged 18 or over. We do not knowingly collect personal data from children; if you believe a child has submitted a review, contact us and we will delete it.

10. Changes to this notice

We may update this notice when the website or the law changes. The current version is always at this address, with the effective date shown at the top, and substantive changes will be noted here.

This notice complements the short privacy note shown on the review form itself. If the two differ, this notice prevails.