Cookie Policy

Data controller: 19 MAYIS 55 GIDA RESTORAN VE KAFETERYA LİMİTED ŞİRKETİ (trading as "Küll Amazon"), Mimar Sinan Mah. Adnan Menderes 1. Kısım Bulv. No:175/B, 55200 Atakum/Samsun, Türkiye · Tax: Gaziler Tax Office / 0012620877

1. In brief

The KÜLL Amazon website currently only uses cookies and storage necessary for the website to work; as no analytics or marketing tool is active, no cookie preference banner is shown either. If the Restaurant decides to use such tools in future, they will only be activated after your explicit consent has been obtained via the cookie banner, and the website will then show a cookie preference banner on your first visit. No option will be pre-selected; the "Accept all" and "Reject" buttons will be equally prominent; with "Preferences" you will be able to choose categories individually. If you reject or choose nothing, analytics and marketing tools are not loaded.

This banner set-up is based on the following: consent is obtained before analytics and marketing cookies are loaded; no option is pre-selected; not consenting does not block access to the website; your choice is recorded with date and category information.

The banner set-up follows the approach cited as an example of good practice in section 7.3 of the Turkish Data Protection Authority’s Guide on Cookie Practices: "Accept all", "Reject" and "Preferences" are offered on an equal footing, and cookies requiring consent are switched off by default. In addition, on this website, remaining silent or closing the banner is not treated as explicit consent; you are asked again after 12 months.

Under section 5.9 of the Guide, first-party analytics cookies that are used only to measure website performance, produce anonymous statistics, do not track across sites and do not transfer data to third parties may not require explicit consent. Google Analytics 4, Hotjar and Yandex Metrica on our website do not meet these conditions and are therefore only used with your explicit consent.

This policy has been prepared on the basis of Articles 3, 4, 5, 6, 9, 10, 11 and 12 of KVKK No. 6698 and the Authority’s Guide on Cookie Practices of July 2025. For transfers of data abroad, the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad also applies.

2. Cookie categories

You can withdraw your consent at any time (see section 6). From the moment of withdrawal, the tools are stopped.

3. Necessary cookies and storage

The cookie banner is not active at present, so no kull_consent record is created. kull_consent is not a cookie; it is a first-party record kept in the browser’s localStorage and used only to remember your cookie choices. It is limited to this purpose and expires after 12 months.

Once the banner is enabled, a record is also kept on the server to provide minimal proof of your consent choice: a randomly generated consent ID, time of the action, the action taken, the categories chosen, text/version information and language. No IP address and no browser identifier (User-Agent) are stored in this record; it can only be accessed with administrator rights. Retention period: 12 months. Details: Privacy Notice, item 13.

Staff cookies are not set for guests visiting the website or making a booking. The cookie only contains a random session code; a hash of this code is stored on the server. The staff PIN is only kept in memory and not stored in the browser. No analytics or marketing tool runs in the staff area (/personel).

4. Analytics and marketing cookies (only with your consent)

None of these tools is currently active. If the Restaurant decides to use them in future, they will be loaded via Google Tag Manager only after your explicit consent has been obtained via the cookie banner. Google "Consent Mode" is set to "denied" by default. If activated, the tools are managed on behalf of the Restaurant by the Restaurant’s social media team. Chat content and forms are masked for session recording tools; no personal data is sent to the data layer (dataLayer).

Note: The table below shows the tools currently planned. The social media team informs ÖNALTECH before adding a new tag/tool; this table and the Privacy Notice are updated first.

4.1 Analytics

Yandex Metrica may also keep entries in browser storage (e.g. _ym<counter-id>_lastHit, _ym<counter-id>_lsid, _ym<counter-id>_reqNum, _ym_hide_phones, _ym_retryReqs).

Session recording tools (Hotjar, Yandex Webvisor): Hotjar and Yandex Webvisor are only used with your explicit consent and in line with the principle of data minimisation. Booking, chat, contact, password and financial information fields are masked in session recordings; staff logins are excluded from recording. If data is transferred abroad, the transfer will be carried out under Article 9 KVKK.

Yandex Metrica: Under section 5.8 of the Yandex Metrica Terms of Use, visitors are informed about the "Yandex.Metrica opt-out" browser add-on (see section 6). Yandex’s published privacy policy states that personal data may be transferred to Russia and other third countries. The countries of transfer are listed in the Privacy Notice.

4.2 Marketing (only with your consent)

Note: Cookie names and durations may be changed by the providers. The durations in the tables are taken from the providers’ official pages.

5. Other third-party content (independent of the consent categories)

• Cloudflare Turnstile (bot protection): Used in the booking forms (table, Gastro Cinema) and the staff login form; when these forms are opened, a script is loaded from challenges.cloudflare.com. Turnstile is not used on the booking lookup page. A Turnstile bot check is also carried out before the first chat message (Küllü). By default, Turnstile uses a single-use verification token valid for 5 minutes instead of a cookie; only if the "Pre-Clearance" feature is enabled is a cf_clearance cookie also set (its duration depends on Cloudflare’s zone setting). Cloudflare itself acts as data controller for the signals it processes to improve Turnstile’s bot detection. As Turnstile is used only for bot protection and website security, as necessary and proportionate, it is considered a security technology that does not require explicit consent. Where personal data is processed, Article 5(2)(f) KVKK (legitimate interest) is taken into account; if there is a transfer abroad, Article 9 KVKK is complied with. The actual cookie and storage mechanisms used by Turnstile are classified separately.
• Google Maps: The map is loaded only when you click "Load map". When you click, data is transferred to Google (e.g. your IP address and the address/URL of the page you are visiting) and Google may set its own cookies or read existing cookies. If you do not click, no request is sent to Google; you are informed before the map is loaded. Advertising and tracking technologies beyond the map function are subject to separate explicit consent; transfers abroad are carried out in accordance with Article 9 KVKK. There is no separate category for the map in the cookie banner.
• Menu images and videos: Served from our own server; no requests go to third-party servers for them. Menu data is retrieved from Doypos on the server side only.
• Instagram: There is no embedded Instagram content on the website, only a link to the profile. If you click it, Instagram’s cookie policy applies.
• Fonts: Served from our own server (Google Fonts is not used).
• Cloudflare hosting: Cloudflare’s infrastructure may set technical cookies for security purposes (e.g. bot management).

6. How to manage your preferences or withdraw consent

• Once analytics or marketing tools are activated, you can reopen the banner at any time via the "Cookie preferences" link that will then appear at the bottom of the page (footer) to change your preferences or withdraw your consent.
• When you withdraw consent, analytics/marketing tools are stopped, the website’s first-party cookies (_ga*, _gid, _gat*, _gcl_*, _hj*, _ym*, _fbp, _fbc) are deleted and the page is reloaded. The website may not be able to delete cookies kept on the providers’ own domains (e.g. Yandex); you can delete these in your browser settings.
• You can delete or block cookies in your browser settings. Guests do not need optional cookies to use the website; rejecting them does not affect bookings. If necessary cookies are blocked, the staff login will not work.
• Yandex Metrica also offers its own opt-out option (e.g. the "Yandex.Metrica opt-out" add-on) (section 5.8 of the Yandex Metrica Terms of Use requires visitors to be informed about this option). For the information that Yandex Metrica data may be transferred to Russia and other third countries, see section 4.1.

7. Data transfers and your rights

When analytics/marketing tools are used, your data may be transferred to providers abroad (Google, Hotjar/Contentsquare, Yandex). Details, legal grounds and your rights under Article 11 KVKK are set out in the Privacy Notice.

8. Updates

When a new tool (tag) is added to the website, this policy, the category descriptions in the banner and the Privacy Notice are updated before it is added; consent is requested again if necessary (the preference version is increased). Last updated: 9 November 2026.

Contact: [email protected]