Privacy Policy and Data Protection Notice
Effective date: 1 August 2026 · Version 1.0
This Privacy Policy and Data Protection Notice is issued by Tatlas in its capacity as data controller, pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "KVKK") and the accompanying Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. Where a data subject is located in the European Union, the General Data Protection Regulation (the "GDPR") shall additionally apply. The purpose of this notice is to set out, clearly and intelligibly, which categories of your personal data are processed in connection with your use of the service, on what legal basis, for what purposes, and what rights you hold in respect of that data.
1. Identity of the Controller and Scope
For the purposes of Article 3/1(ı) of the KVKK, the data controller determining the purposes and means of processing is Tatlas. This notice applies to the web application made available at the tatlas.com.tr domain (and the tatatlasiniztatlas.com, tatlas.app, tatlas.online and tatlas.site addresses that redirect to it), its associated application programming interfaces, and the transactional emails sent to you. Third-party websites accessible from the service are governed by their own privacy policies, and Tatlas accepts no responsibility for their processing activities.2. Categories of Personal Data Processed
(a) Identity and contact data: your display name, username and email address. (b) Transaction data: the taste records you create, including venue name, city, country, address, date of visit, your flavour, value-for-money and service scores, your written notes, uploaded images, reactions, follow relationships and blocked accounts. (c) Location data: coordinates shared solely at your initiative, either through the "Add location" function or by manual entry. (d) Security data: IP address, browser and device information (user-agent), session records, successful and failed sign-in attempts, and audit records of administrative actions. (e) Communication content data: if you use the in-app private messaging feature, the text of messages you send and receive, together with their timestamps and read status. Your password is stored only as an irreversible Argon2 hash; it is at no point retained or displayable in plain text.3. Purposes of Processing
Your personal data is processed strictly for the following purposes: creating and administering your membership; providing authentication and session management; storing your taste records and presenting them in accordance with the visibility setting you select; operating community features (following, comments, reactions); delivering notification emails where you have requested them; establishing the security of the service and detecting and preventing abuse, unauthorised access and brute-force attacks; responding to your requests; and discharging our obligations under applicable law.4. Legal Bases for Processing
Processing is carried out on the following legal bases under Article 5/2 of the KVKK and Article 6 of the GDPR: (a) processing necessary for the establishment and performance of the membership contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)): your account, taste and content data; (b) processing necessary for the legitimate interests pursued by the controller (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)): data relating to information security and the prevention of abuse; (c) your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)): optional notification emails and location sharing; and (d) compliance with a legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)). Where processing rests on consent, you may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing carried out beforehand.5. Content Visibility and User Control
Every taste record you create is private by default and visible only to you. If you mark a record as public, its venue details, your scores, your written note and your images are published in the discovery feed and on the relevant venue page together with your display name and username. You can reverse this choice at any time. You can also make your account private: your profile details, taste history, map and follower and following lists are then visible only to followers you approve, while your display name, username and bio stay visible so that your account can be found and follow requests can be sent to you. Even with a private account, records you have individually marked public continue to be published as described above. You can also block any account. Control over your privacy settings rests exclusively with you.6. Transfers of Personal Data
Your personal data is not sold, leased or transferred to third parties for advertising purposes. Data is transferred only to the extent necessary for the provision of the service and in accordance with Articles 8 and 9 of the KVKK and Articles 44 et seq. of the GDPR, namely: to our email infrastructure provider for the delivery of transactional messages; to Google LLC for authentication where you elect to use it; and to the map tile provider for rendering the map view. Where a transfer abroad occurs, it is effected subject to safeguards affording an adequate level of protection. Data may additionally be disclosed to competent public authorities in discharge of our obligations under applicable law.7. Retention Periods and Erasure
Your personal data is retained for as long as required by the purposes of processing and, in any event, subject to the limitation periods prescribed by applicable legislation. Account and content data is retained for so long as your account remains open. Taste records you delete are removed from the service interface immediately and permanently erased upon expiry of the technical retention window. Session records are cleared upon expiry, and sign-in attempt and audit records are deleted within a reasonable period once the security purpose has ceased to apply. Your private messages are retained for as long as either party to the conversation keeps their account open; as with taste records and comments, deleting your account does not delete the other party's copy of the conversation. Upon expiry of the retention period, data is erased, destroyed or anonymised in accordance with Article 7 of the KVKK.8. Rights of the Data Subject
Pursuant to Article 11 of the KVKK and Articles 15 to 22 of the GDPR, you have the right to: ascertain whether your personal data is being processed and, if so, to request information in that regard; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties, whether domestic or abroad, to whom the data has been transferred; request rectification of incomplete or inaccurate data; request erasure or destruction subject to the conditions in Article 7 of the KVKK; require that such operations be notified to third parties to whom the data has been transferred; object to an adverse outcome arising from analysis carried out exclusively by automated means; and claim compensation for loss suffered by reason of unlawful processing. Under the GDPR you additionally hold rights of data portability and objection to processing.9. Exercising Your Rights and Application Procedure
A substantial part of your profile and taste data may be viewed, corrected or deleted directly through the Settings and My Journal pages. Any other request may be submitted to us through the channel set out on the Contact page, together with information sufficient to verify your identity. In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, applications are concluded free of charge and within thirty (30) days at the latest, having regard to the nature of the request. Where the operation entails additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged. Should your application be refused, your right to lodge a complaint with the Personal Data Protection Board is reserved.10. Data Security and Amendments
In accordance with Article 12 of the KVKK, appropriate technical and organisational measures are implemented to ensure a level of security suited to preventing the unlawful processing of and access to personal data and to ensuring its safekeeping. To that end, passwords are hashed with Argon2, sessions are managed by means of short-lived tokens, all state-changing requests are protected against cross-site request forgery, and administrative operations are recorded in an audit trail. As the absolute security of any system cannot be warranted, we ask that you contact us without delay should you identify anything untoward. Amendments to this notice are published on this page; material changes are additionally notified to you.