KVKK DATA PROTECTION POLICY

VELTORI CATERING LİMİTED ŞİRKETİ ("VELTORI" or the "Company") considers the protection and confidentiality of personal data belonging to corporate clients, board members, and executive partners as an uncompromising institutional standard.

This Data Protection Notice is provided in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform data subjects regarding our data processing principles as a "Data Controller."

1. Identification of the Data Controller

Under Law No. 6698, the Data Controller responsible for your personal data is:

2. Categories of Processed Personal Data

Within the scope of our executive boardroom catering operations, we process:

• Identity & Contact Data: Executive name, title, corporate email address, direct phone number, and corporate delivery address.
• Transaction & Fiscal Data: Contract records, e-invoicing data, order history, and payment details.
• Dietary & Allergen Profiles: Custom gluten-free, vegan, lactose-free, or specific allergen requirements (classified as Special Category Personal Data under KVKK Article 6, processed with strict data minimization).

3. Purposes of Processing

Personal data is processed strictly for the following operational and statutory purposes:

• Execution of corporate catering agreements and scheduling executive boardroom tasting sessions,
• Managing 75°C active thermal logistics dispatch and on-time boardroom delivery,
• Preparing isolated culinary portions tailored to executive dietary requirements,
• Complying with statutory accounting and tax obligations (E-Invoicing),
• Maintaining regulatory food-safety audit compliance under Turkish Law No. 5996.

4. Legal Grounds for Data Collection

Data is collected through digital inquiry forms, email correspondence, and corporate agreements pursuant to KVKK Article 5/2: (c) "Performance of a contract", (ç) "Compliance with legal obligations", and (f) "Legitimate interests of the data controller".

5. Data Transfer and Disclosure

We strictly prohibit the commercial sale or unauthorized dissemination of corporate data. Personal data is transferred solely to competent public authorities where legally mandated (e.g., Revenue Administration, Ministry of Agriculture) and to secure, encrypted infrastructure partners essential for service delivery.

6. Your Rights Under KVKK Article 11

As a data subject, you are entitled to:

• Learn whether your personal data is processed and request relevant details,
• Inquire about the purpose of processing and verify adherence,
• Know the domestic or international third parties to whom data is transferred,
• Request the rectification of incomplete/inaccurate data or the deletion of data,
• Object to automated processing outcomes that produce unfavorable results.