This page explains in plain language how your personal data is handled when you use the İstanbul Turkish Restaurant website in Belgrade.
In force since:
In short
We use your data only to fulfil your order or table request, to contact you and to keep the website running safely.
We do not sell your data and do not use it for advertising, profiling or automated decisions.
You can call the restaurant at any time to access, correct or delete your data.
You can complain to the Serbian Commissioner for Personal Data Protection (Poverenik).
Who is responsible for your data?
The controller of your personal data is the İstanbul Turkish Restaurant business in Belgrade. All requests on this subject go directly to the restaurant.
This list covers the data the site actually processes. Until online ordering and table requests go live, the data in those two rows is not collected.
Browsing the site
Data processed
IP address, date and time, requested page, browser and device type (server log). Your chosen language and cart draft stay in your browser.
Purpose
Showing the site, keeping it secure, finding errors and abuse; remembering your language and cart.
Legal basis
Legitimate interest: keeping the site secure and working. For language and cart: providing the service you ask for.
Retention
Server logs 14 days. Cookie and browser storage durations are on the Cookies page.
Is it required?
You do not need to provide anything to view pages. The server log is created automatically for technical reasons.
Usage events
Data processed
Event name (for example add to cart), page, amount, time and a technical request number. No name, phone, address or e-mail.
Purpose
Seeing that the ordering flow works properly.
Legal basis
Legitimate interest: service quality and troubleshooting.
Retention
14 days.
Is it required?
Automatic; we do not ask you for anything.
Table request
Data processed
Full name, phone, e-mail (optional), date, time, number of guests, seating preference, note (optional) and a record that you ticked the notice box on the form (notice version number and time).
Purpose
Assessing your request and calling or writing to you to confirm availability.
Legal basis
Taking steps at your request to provide the service (pre-contract step).
Retention
Personal fields are deleted or made non-identifying 90 days after the reservation date.
Is it required?
Name, phone, date, time and number of guests are required; without them the request cannot be received. Other fields are optional.
Order
Data processed
Name, phone, delivery address and delivery point (only for delivery), order contents, note, order time and status. The delivery point is your browser's location or the neighbourhood you choose from the list; it is used only to calculate the delivery distance and fee and is not stored with the order.
Purpose
Preparing and delivering your order and reaching you if needed.
Legal basis
Performing the order contract.
Retention
Name, phone and address are deleted or made non-identifying 180 days after the order date. Information that forms an accounting record, such as amount and contents, may be kept for the legally required period.
Is it required?
Name, phone and, for delivery, address and delivery point are required; without them the order cannot be accepted. You do not have to share your location; you can choose your neighbourhood from the list. The note is optional.
Contact by phone or message
Data processed
Your phone number and the information you send us.
Purpose
Answering your question.
Legal basis
Replying at your request; legitimate interest.
Retention
At most 12 months after the conversation ends.
Is it required?
Optional; you can use the site without calling or writing.
Who do we share your data with?
Only the restaurant's authorised staff see your data. The person making a delivery sees the name, phone and address needed for that delivery.
The server that runs the site is provided by DigitalOcean, which hosts the data only on our behalf. The server is in the Netherlands (Amsterdam). The Netherlands is a party to Council of Europe Convention 108 on personal data protection; apart from the road-distance measurement described below, we do not knowingly transfer data to any other country.
If we turn on measuring the delivery distance by road (optional), for delivery orders only the coordinates of the delivery point and the restaurant's location are sent to Google's Google Maps service for this measurement; your name, phone and address are not sent. Google may process this data in other countries, including the United States. While this measurement is off, the distance is calculated as a straight line on our server and no data goes to Google.
We do not give your data to advertising or marketing companies, or to third-party reservation or ordering platforms. We disclose information to authorities only where the law requires it.
Your rights and how to use them
You can find out which data we hold about you and ask for a copy; ask for wrong data to be corrected, data to be deleted or its processing to be restricted; ask for your data to be moved elsewhere; and withdraw any consent you gave at any time. Withdrawal does not affect processing done before it.
To do so, call the restaurant or write to the address above. To verify your identity we may ask for a few details about your request, such as the order or reservation date. We answer within 30 days at the latest, free of charge.
Your right to object
Where we process your data on the basis of legitimate interest (server logs and usage events), you can object to that processing at any time on grounds relating to your particular situation. We do not use your data for direct marketing. Call or write to the restaurant to object.
Children and sensitive information
We do not knowingly collect personal data from children under 15; ordering and table requests are for people aged 15 or over, or their parents or guardians.
You do not have to write allergy, health or belief information (for example halal) in note fields. If you do, we use it only to prepare your order or table and delete it when the retention period of that record ends; writing it means you explicitly consent to this use, and you can withdraw consent at any time. A note field does not replace allergen information on products; ask the staff about allergens.
Automated decisions
We do not make automated decisions about you and do not profile you.
Cookies
The site uses only technical cookies and browser storage: your language preference, your cart draft and your choice to hide suggestions. There are no advertising or tracking cookies. Details and removal instructions are on the Cookies page.
Security
The site is served over an encrypted connection (HTTPS); data is reachable only through authorised staff accounts with access control; backups are encrypted. The site does not ask for or store card numbers.
Changes to this notice
We update this notice when our services or the law change; the effective date is at the top of the page. We inform you before processing your data for a new purpose.
Your right to complain
If you think your rights have been violated, please contact the restaurant first. You can always complain to the authority below or go to court.
Name
Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (Commissioner for Information of Public Importance and Personal Data Protection)