Privacy and Data Protection Notice

Data controller and contact

The data controller is Yasin Alkan — No.158 business. Address: Yeşilbayır Mah. Atatürk Cad. No:158/B, Döşemealtı / Antalya. You can send requests under KVKK to kvkk@no158kafe.com.

Data processed and purposes

While creating an account and using Meydan, we may process your display name, email address, the records required for account security, and content you create or manage. This data is used to set up your account, enable sign-in, provide the community service, and support security and anti-abuse measures.

Order and payment data

When you place an order through our website, we process your first and last name, shipping and billing address, phone number, email address, and order details. This data is used to receive the order, complete payment, deliver the product, issue invoices, handle returns and withdrawal requests, and fulfill legal obligations. The legal basis is the performance of the sales contract with you and our legal obligations.

Payment is made by bank transfer / EFT / FAST to our bank account, or in person at the cafe. For transfers, the sender name, amount, and description shown to us by the bank are used only to match the payment to the order. For in-cafe card payments, your card details are processed by the POS terminal and are never seen or stored by No.158. Your name, address, and phone number are shared with the courier (Yurtiçi Kargo, Aras Kargo, or DHL) to deliver your order. Order and invoice records are kept for as long as required by tax and commercial law.

Sign in with Google

If you use "Continue with Google," we receive your verified email address and your Google account's unique user ID. This ID is linked to your account only so we can recognize you when you sign in again. Your Google password, access token, profile photo, or display name on Google are never stored.

The Google sign-in flow runs through Google's own services, so data may be processed abroad on Google's infrastructure during the process. Google's own data-processing practices are covered by the Google Privacy Policy.

Legal basis, transfer, and retention

Account and service data is processed because it is directly related to setting up or using the account you requested, and to ensure service security. Data is never sold to third parties or used for advertising purposes, except where required by law or needed for the technical service.

Pending verification information for Google sign-in is kept for at most 15 minutes. Account data is kept for as long as your account is open, and as needed for deletion, dispute, or legal retention obligations. Operational records are kept for at most 90 days, and security records for at most 2 years.

Analytics cookies

Google Analytics measurement on the homepage only starts with your explicit consent. If you don't allow it, Analytics never loads. You can withdraw your consent at any time from the "Cookie preferences" button on the homepage. Analytics cookies are kept for at most 90 days, and the preference record for at most 180 days.

Your rights

You can exercise your rights under Article 11 of KVKK — to be informed, to access, to request correction, deletion or destruction, to object to processing, and to claim compensation for damages — by contacting the address above.