Personal data notice
This notice explains how we process personal data when you use this website or make a reservation under Türkiye’s Personal Data Protection Law No. 6698 (KVKK).
Data controller and contact
The restaurant operating this website and responsible for the processing described here is Bona Cafe Restaurant. Contact us about your personal data at:
Küçük Ayasofya, Kadırga Limanı Cd. no:108 Fatih[email protected]
+90 545 507 73 81
Data collected and collection method
The online form sends us your name, email, phone, visit date and time, guest count, preferred language and any optional note. We record the booking reference and status, the notice version you acknowledged and the time of acknowledgment. We receive these electronically from the form. Calls and emails provide the information you choose to share through those channels.
Our server may receive technical connection data such as IP address, request time and browser information. The site uses cookies needed for session and form security. We do not collect payment card details or use advertising or analytics cookies on this site.
Purposes and legal grounds
We use booking data to check availability, create and manage reservations, contact you, send confirmation, reminder or cancellation emails, and answer requests. This is necessary to establish or perform the reservation arrangement (KVKK Article 5(2)(c)). We use limited technical and booking records for security, preventing duplicate or abusive requests and resolving service problems under our legitimate interests, without overriding your fundamental rights (Article 5(2)(f)). A specific legal record or disclosure obligation is based on Article 5(2)(ç). Acknowledging this notice is not consent to marketing.
Recipients and external services
Authorized restaurant staff access bookings to serve you. The website and reservation database are hosted on a Hostinger VPS in Germany, where submitted booking data and technical connection data are stored or processed. Our booking email provider receives the details needed to deliver booking messages. Privacy requests sent to the Gmail address above are also handled by Google. We may disclose data to competent public authorities when legally required. We do not sell reservation data.
Storage on the German VPS is an international transfer. Gmail and our email provider may also process data outside Türkiye. Google Maps loads only if you choose to open the map; Google may then receive your IP address and other connection data under its own terms. Social, WhatsApp and directions links take you to external providers. Transfers abroad are governed by KVKK Article 9.
Retention and security
At each calendar year end, we delete completed reservations and their contact data, unless a specific legal duty or claim requires longer retention. Future reservations remain until their visit has passed and the next year-end deletion occurs. When a lawful reason for keeping data ends, we delete, destroy or anonymize it under KVKK Article 7. Access is restricted to authorized staff and the site uses transport encryption and security controls. Please do not enter health information or other special-category data in the optional note.
Your rights and requests
Under KVKK Article 11, you can ask whether and why we process your data, learn the recipients, request correction or, when legal conditions apply, deletion or destruction and notice to recipients, object to an adverse result based solely on automated analysis, and seek compensation for unlawful processing. Send a request using a method allowed by the applicable application rules to the postal or email contact above, with enough information to identify you and your request. We answer as soon as possible and within 30 days. You may complain to the Personal Data Protection Board under the statutory conditions if our answer is missing or inadequate.