Privacy Policy for QR Menu Users

This PRIVACY POLICY is the entire personal data protection policy (hereinafter “Privacy Policy”) for the product or service provided by Bambulabs, Inc.

We appreciate that you are trusting us with your personal information. We take your privacy very seriously. In this Privacy Policy, we seek to explain to you in the clearest way possible what information we collect, how we use it, and what rights you have in relation to it.

Before accessing or using the application, please ensure that you have read and understood our Privacy Policy. If there are any terms in this Privacy Policy that you do not agree with, please discontinue the use of our Services immediately.

If you have any queries about this Privacy Policy or data protection in general, please contact: info@finedinemenu.com

1. GENERAL INFORMATION

• This Privacy Policy was drawn up by Bambulabs, Inc., a company registered at 2035 Sunset Lake RoadSuite B-2 Newark 19702 Delaware, USA (hereinafter “FineDine”, “we,” “us,” or “our”), who is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share, and protect data that identifies or is associated with you (“personal data”) in relation to showing the website or menu on the browser and other features in it, and your choices about the collection and use of your information. Also, FineDine offers a unique web application (“Platform”) to its Business and Individual Members however these circumstances are bound by a different policies, this policy covers the person who are not a member to the Platform yet use FineDine’s online web application viewing services.
• This Privacy Policy will enter into force on the date stated above. If this document is updated, we will notify you of the revised versions through our regular channels. For more information regarding updates please see the section titled “Updates to the Privacy Policy” below.
• As FineDine is a company residing and operating in the State of Delaware in the United States of America, it is subject to any and all federal and state laws applicable to Delaware entities. Please note that this Privacy Policy was prepared in line with the applicable laws of the State of Delaware relating to data privacy. Recognizing the global nature of the Internet, throughout the Privacy Policy, reference has been made to other jurisdictions and regulations that may be applicable to some users. However, we hereby expressly state that any such reference was made for ease of understanding of users and those persons who choose to access the Platform from other locations do so on their own initiative and do not mean or imply that FineDine is subject to the laws and regulations of said jurisdiction.
• Hereinafter, any person who is registered to the Platform as an individual and for individual purposes or commercial purposes on behalf of an entity shall be referred to as “Member” whether Individual or Business Member, and any person who visit the webpage without being a Member whether Business or Individual shall be referred to as “User” this Privacy Policy.
• This Privacy Policy has been prepared solely with regard to the data of persons who are identified as Users. Any person who registers on the FineDine Platform as either an Individual Member or a Business Member is subject to a separate privacy policy. Please note that if you register on the Platform as a member, whether as an Individual or a Business Member, you will be subject to a policy that differs from this policy.
• FineDine Platform enables Users to seamlessly access websites and digital menus via links and QR codes and sometimes make reservations, place orders and receive promotional advertisement. If you want to use more features, such as making payments, viewing your order history, and leaving reviews, providing a convenient and efficient dining or a sort of customer experience, we strongly recommend that you register on the Platform. through the FineDine Platform. This Policy is not applicable to any information collected offline or via channels other than the Platform.

2. WHAT IS PERSONAL DATA?

2.1. “Personal Data” used throughout this Privacy Policy means, in short, personally identifiable information of Users that is collected through online by FineDine and maintained by FineDine in an accessible form, and by definition, may include personal identifiers such as a first and last name, a physical address, an e-mail address, a telephone number, a social security number, or any other identifier that permits the physical or online contacting of a person, and any other information concerning a person collected by FineDine from Users and maintained in personally identifiable form in combination with any identifier described in this paragraph.

2.2. This section is intended to provide you with a definition of personal data. Please see Section 4.2. titled “What Data Do We Use?”, Section 5 titled “Cookie Policy for our Website”, and Section 12 titled “Notice For California Residents; Categories of Personal Data Processed” for details regarding the data actually processed by FineDine as a Data Processor.

3. ON WHAT BASIS DO WE COLLECT OR USE PERSONAL DATA?

3.1. Data protection laws require that we meet certain conditions before we are allowed to use your personal data in the manner described in this Privacy Policy. To use your personal data, we will rely on one of the following conditions, depending on the activities we are carrying out:

• You have given us consent;
• Processing is necessary for our legitimate business interests or those of a third party, provided this does not override any interests or rights that you have as an individual.
• Processing is necessary for compliance with our legal obligations.
• Processing is necessary for legal claims.
• Processing is necessary for substantial public interest.

3.2. Below you will find detailed information on the basis that we collect and use your personal data. If we look to use your personal data for any other purpose not covered in this Privacy Policy, we will let you know about any proposed new purposes before using your personal data in this way.

3.3. Consent

• We ask that you provide affirmative and informed consent to the use of your personal data as described in this Privacy Policy when you access and participate in the Services. Please discontinue using the Services if you do not have such consent.
• We may provide you with marketing information about our, Business Member’s or Business Member’s business partner’s services or products where you have indicated your consent for us to do so (to the extent that we are required to collect consent under data protection laws). We may contact you by social media and electronic notifications (where you have agreed to those methods of communication) to provide you with the information, special offers, research, promotions, and similar products and services. Where you have indicated your consent to us doing so, we may also pass your details to our group companies for marketing purposes. You can always opt out by e-mailing us via info@finedinemenu.
• We will also provide you with access to, or transfer your personal data at your written request, provided that we aren’t legally restricted from doing so or otherwise prevented from doing it due to circumstances beyond our reasonable control. Please relate your request for access to or transfer of personal data to info@finedinemenu.com.
• If we are relying solely on your consent to process your personal data, you may withdraw your consent to our processing of your personal data at any time; however, withdrawing consent may result in your inability to continue using some or all of the services. Please note that the withdrawal of your previous consent will not affect the lawfulness of the processing before its withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent.

3.4. Legitimate Interest

• Sometimes our collection and use of your personal data may not depend on your informed consent but on our legitimate interests. It is in our legitimate interests to collect your personal data as it provides us with information that we need to provide our Services to you and to make our Platform available.
• This requires us to carry out a balancing test of our interests in using your personal data (for example, in order to provide you with access to the Platform, against the interests you have as a person and the rights you have under Delaware Online Privacy and Protection Act and other applicable Data protection law.
• The outcome of this balancing test will determine whether we may use your personal data in the ways described in this Privacy Policy. We will always act reasonably and give full and proper consideration to your interests in carrying out this balancing test.
• Our legitimate interests are managing our business and relationship with you; understanding and responding to inquiries and feedback; understanding how our Users use the Platform and/or Services; identifying what our Users want, and developing our relationship with you, improving our Platform and offerings; managing our supply chain; developing relationships with business partners; sharing data in connection with acquisitions and transfers of our business.

3.5. Legal Obligations and Legal Claims

• We are permitted to process your personal data when it is necessary for compliance with our legal obligations. We are also permitted to process your personal data where it is necessary to establish, pursue or defend a legal claim.
• We may disclose your personal data to third parties without your consent if we have reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users of the Services, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. We may disclose personal data when we believe in good faith that such disclosure is required by and in accordance with the law.

3.6. Substantial Public Interest

• We are permitted to process your personal data where it is necessary for reasons of substantial public interest, on the basis of data protection laws.

4. USE OF COLLECTED DATA

4.1. We use your personal data to help us provide and support our Services. This section provides you with details of what personal data we use and why we use it.

4.2. What Data Do We Use?

• We collect information directly from you and, in some instances, from third-party service providers whom you authorize to share your information with FineDine.
• As a User, we only ask you to provide your phone number in limited cases.
• Also, we collect directly and/or via third party service providers, including:
• technical information that we collect from you when you scan the QR code and visit the digital menu, such as your Internet Protocol (IP) address used to connect your computer to the internet, browser type and version, time zone setting, browser plug-in types and versions, operating system, platform and traffic data, cookies data, weblogs and other communication data and details of the resources that you access;
• your user activity data on the webpage is collected automatically, including transaction history, purchase records, and other interactions
• For more details on the personal data we process, please see Article 12, titled “Notice for California Residents; Categories of Personal Data Processed,” below.
• You are able to view and update much of the information collected about you by reaching us via e-mail at info@finedinemenu.com.
• We automatically collect certain information when you visit, use or navigate the Platform. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Platform and other technical information which may lead to your identification. This information is primarily needed to maintain the security and operation of our Platform, and for our internal analytics and reporting purposes. Please refer to the section titled “Cookie Policy” and the sub-section titled “Service Providers Processing Data on Our Behalf” for more information on automatically collected personal data.
• Our Platform and Services is intended for the use of persons above the age of 13 only. We do not knowingly collect personal information from children or minors without parental consent. If FineDine is made aware that a child has provided us with personal information without parental consent, we will endeavor to delete that information from our databases. If you have questions about personal information that may have been submitted by a child, please email us at info@finedinemenu.com.

4.3. Why Do We Use Your Data?

• Service provision: we use the information to carry out and administer the Platform which enables us to provide our Services.
• Platform monitoring: to check the Platform and our other technology services are being used appropriately and to optimize their functionality for the purpose of administering and improving our Services.
• Platform optimization: improve, test, and monitor the effectiveness of our Platform and diagnose or fix technology problems;
• Managing suppliers: we use information to manage third-party suppliers who deliver services to us;
• Statistics: monitor metrics such as total number of visitors, traffic, demographic patterns, and patterns in our test results (on an anonymized and aggregated basis) regarding the website;
• Development: develop and test new products and features.

4.4. If we plan to use your personal data in the future for any other purposes not identified above, we will only do so after informing you by updating this Privacy Policy. See further the section of this Privacy Policy entitled “Updates to the Privacy Policy”.

5. COOKIE POLICY FOR OUR WEBSITE AND MENU WEBPAGE

5.1. We use cookies on our website (https://www.finedinemenu.com) to distinguish you from other users of our Site. This helps us to provide you with a good experience when you browse our website and also allows us to improve the website.

5.2. A cookie is a commonly used automated data collection tool. Cookies are small text files that are placed on your computer or device by websites that you visit or HTML-formatted emails you open, in order to make websites work, or work more efficiently, as well as to provide information to the owners of the website.

5.3. We use session cookies to enable certain features of the website, to better understand how you interact with the website and to monitor aggregate usage by users and web traffic routing on the website. Session cookies are deleted from your computer when you log off from the website and then close your browser. We may also use advertising cookies which enables our advertising service providers to collect some data regarding your device in order to be able to determine your interests and provide targeted advertising services. Details of the cookies used on our website are set out in our cookie policy available at https://www.finedinemenu.com/en/privacy-and-terms/. Please be advised that our cookie policy is an integral part of this Privacy Policy with regard to our website.

5.4. We also use cookies on the webpage that helps us show the website and menu online. We use functional cookies to ensure the proper operation of the webpage, improve user experience, and enable essential features such as language preferences, page navigation, and maintaining session states. These cookies help enhance usability and ensure that the webpage functions as intended. Functional cookies do not collect personal data and cannot be disabled via our systems as they are necessary for the proper use of the webpage.

5.5. We may also use advertising cookies, which allow our advertising service providers to collect certain data about your device and browsing behavior. These cookies help determine your interests and enable the delivery of relevant, targeted advertising. Advertising cookies may track your interactions across different websites to build a profile of your preferences.

5.6. The list of the cookies we use in the online menu webpage are listed below:

For more details on the cookies we use in the online menu webpage please check our cookie policy available at https://www.finedinemenu.com/en/privacy-and-terms/.

5.7. You can set up your browser options, to stop your computer or mobile device accepting cookies that require consent (such as social plug-in tracking cookies like those used for behavioral advertising, analytics or market research; third party cookies used for behavioral advertising) or to prompt you before accepting a cookie from the websites you visit. If you do not accept cookies, however, you may be unable to access certain parts of our website or to receive certain Services. Please note that some cookies are necessary for the website to perform its functions and may not be stopped (such as cookies that allow the processing of web server requests over a pool of machines instead of just one, authentication cookies, etc.) if the website is to be used; these are noted as “necessary cookies” in our cookie policy.

5.8. Your browser may feature a preference which alerts websites you visit that you do not want them to collect certain information about you. This is referred to as a Do-Not-Track (“DNT”) signal. Please note that our website may not recognize or take action in response to DNT signals from your browser.

6. WHERE WE STORE YOUR DATA

6.1. Platform is hosted, stored and processed by FineDine leveraging data centers which are located in USA Region. Processing of the information collected about you is only undertaken for the purposes described in this Privacy Policy.

6.2. For Users located in Europe, considering the fact that FineDine is a Delaware (US) corporation, and data centers are located in USA, we would like to expressly state that the personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA") or the UK. It may also be processed by staff operating outside the EEA or the UK who work for us or for one of our suppliers or partners. Such staff or subcontractors may be engaged in, among other things, the processing of your payment details or the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing outside of the USA, EEA or the UK.

6.3. Also, for Users located in Türkiye, considering the fact that FineDine is a Delaware (US) corporation, and data centers are located in USA, we would like to expressly state that the personal data that we collect from you may be transferred to, and stored at, a destination outside Türkiye. It may also be processed by staff operating outside Türkiye who work for us or for one of our suppliers or partners. By submitting your personal data, you agree to this transfer, storage, or processing outside of Türkiye. For more information on the processing and transfer of your personal data within the scope of KVKK, please check the Section titled “NOTICE FOR TURKIYE RESIDENTS; KVKK LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER KVKK” below.

6.4. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. In particular, this means that your personal data will only be transferred where the recipient is bound by contractual clauses requiring the confidentiality and protection of personal data.

6.5. Our Platform is accessible via the internet and may potentially be accessed by anyone around the world. Other users may access the Platform from outside the USA, Türkiye, BAE, EEA or the UK. This means that where you chose to post your data on our Platform, it could be accessed from anywhere around the world and therefore a transfer of your data outside of the Türkiye, BAE, EEA or the UK may be deemed to have occurred. You consent to such transfer of your data for and by way of this purpose.

7. DISCLOSURE OF YOUR PERSONAL DATA

7.1. We do not sell, lease, rent or give away the information collected about you without your permission. In case of you permit us to sell your data by clicking separate button within the opening the digital menu or the website we may sell your personal data to a third party. While selling your information we will perform our best effort to pseudonymize or anonymize the personal information as much as possible. You can always opt out by e-mailing us via info@finedinemenu. When you choose to opt-out, we will immediately stop selling your information, however we will continue to disclose the purposes described below. If we disclose your information, we require those we share it with to comply with adequate privacy and confidentiality requirements, and security standards.

7.2. Disclosure to Affiliates: FineDine is a global business, headquartered in the United States. Your personal information collected by us in accordance with this Privacy Policy is used and shared by FineDine to our affiliate company based in Türkiye (Bambulabs Teknoloji Anonim Şirketi) and United Arab Emirates (FineDine FZE) for the purposes of providing the Platform, delivering our Services, managing your accounts, IT, support, billing, marketing, and communications.

7.3. We may disclose your personal data to third parties without your consent if we have reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users of the Services, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. We may disclose personal data when we believe in good faith that such disclosure is required by and in accordance with the law. In certain instances, it may be necessary for FineDine to disclose the information that we’ve collected about you to government officials or otherwise as required by applicable law. No personal data will be disclosed to any law enforcement agency or governmental agency except in response to:

• A subpoena, warrant or other process issued by a court of competent jurisdiction;
• A legal process having the same consequence as a court-issued request for information, in that if FineDine were to refuse to provide such information, it would be in breach of local law, and it or its officers, executives or employees would be subject to liability for failing to honor such legal process; or
• Where such disclosure is necessary for FineDine to enforce its legal rights pursuant to the laws of the jurisdiction from which such information was gathered.

7.4. We may also disclose your personal data, subject to appropriate confidentiality protections, in connection with a corporate re-organization, a merger or amalgamation with another entity, a sale of all or a substantial portion of our assets or stock, including any due diligence exercise carried out in relation to the same, provided that the information disclosed continues to be used for the purposes permitted by this Privacy Policy by the entity acquiring the information.

7.5. The Platform may contain links to third party websites. When you click on a link to any other website or location, you will go to another site, and another entity may collect personal or anonymous data from you. We have no control over, do not review, and cannot be responsible for these outside websites or their content. Please be aware that this Privacy Policy does not apply to these outside websites or content, or to any collection of your personal data after you click on links to such outside websites. We encourage you to read the privacy policies of every website you visit. The links to third party websites or locations are for your convenience and do not signify our endorsement of such third parties or their products, content, or websites.

7.6. Service Providers Processing Data on Our Behalf

• We may use contractors and service providers to process the information collected about you on our behalf for the purposes described in this Privacy Policy. We contractually require service providers to keep information secure and confidential and we do not allow our data processors to disclose your information to others without our authorization, or to use it for their own purposes. However, if you have an independent relationship with these service providers their privacy statements will apply.
• reCAPTCHA (Google LLC): This third-party service enables FineDine to protect our Platform from spam and abuse by distinguishing between human users and automated bots. reCAPTCHA is a service provided by Google LLC that collects and processes data such as cookies, usage data, your unique IP address, and device information to determine user interactions and prevent fraudulent activities. reCAPTCHA processes data in the United States and other regions where Google operates data centers. For users in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, Google declares that it complies with the General Data Protection Regulation (GDPR) and ensures data protection through appropriate safeguards, including Standard Contractual Clauses (SCCs).  If you wish to manage or opt out of reCAPTCHA’s data collection, you can adjust your browser settings or use the opt-out mechanisms provided by Google. For more details, please refer to Google’s privacy policy: https://policies.google.com/privacy.
• Facebook Pixel (Meta Platforms, Inc): This third-party service enables FineDine to track User interactions on our Platform, such as page views, clicks, and other User activities. Facebook Pixel is a web analytics service provided by Meta Platforms, Inc. The service collects and processes data such as cookies, usage data, and device information to understand how users interact with the site and to help improve the website’s functionality. Facebook Pixel processes data in the United States and other regions where Meta operates data centers. For users in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, Meta declares that it complies with the General Data Protection Regulation (GDPR) and ensures data protection through appropriate safeguards, including Standard Contractual Clauses (SCCs). For more details, please refer to Meta’s privacy policy: https://www.facebook.com/privacy/policy.
• AWS Firehose (Amazon Web Services, Inc.): This third-party service enables FineDine to collect, process, and analyze streaming data in real time. AWS Firehose is a service provided by Amazon Web Services, Inc. It facilitates the secure transmission of data from our platform to various storage and analytics solutions. AWS Firehose collects and processes data such as usage data, log files, and system events to help optimize the performance and security of our platform. AWS processes data in the United States and other regions where it operates data centers. For users in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, AWS declared that it complies with the General Data Protection Regulation (GDPR) and applies appropriate safeguards, including Standard Contractual Clauses (SCCs), to ensure data protection. For more details, please refer to AWS’s privacy policy: https://aws.amazon.com/privacy .

8. TARGETED AND BEHAVIORAL ADVERTISING

8.1. We may provide ad companies with information that allows them to serve you with more useful and relevant ads and to measure their effectiveness only with your consent. We ask you to consent within the registration process for the targeting and behavioral advertising by clicking the button on the registration page. While disclosing the effectiveness of third-party ads with that third party we will perform our best effort to anonymize the personal information as much as possible. While we do not share your specific shopping actions like purchases, product views, or searches with ad companies, we may share an advertising identifier and an estimate of the value of the ads they show you on our behalf so they can serve you with more effective ads. Some ad companies also use this information to serve you relevant ads from other advertisers. You can always opt-out by e-mailing us via info@finedinemenu.com.

9. RETENTION OF YOUR PERSONAL DATA

9.1. We will retain your personal data for as long as needed to fulfill the purpose for which we collected it and for a reasonable period thereafter in order to comply with audit, contractual, or legal requirements, or where we have a legitimate interest in doing so. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

9.2. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

9.3. We may retain aggregated or de-identified data indefinitely or to the extent allowed by applicable law. We may retain personal data, which is preserved in automatically generated computer backup or archival copies generated in the ordinary course of our information technology systems procedures.

9.4. All retained personal data will remain subject to the terms of this Privacy Policy. Please note that if you request that your personal data be removed from our databases, it may not be possible to completely delete all of your personal data due to technological or legal constraints, though we will use reasonable efforts to do so.

9.5. No purpose in this notice will require us to keep your personal information for longer than twelve (12) months past your last use of the Platform unless necessary to comply with our legal obligations, resolve disputes, prevent and detect fraud, and enforce our agreements.

10. SECURITY POLICY

10.1. The security of your personal data is important to us. We use commercially reasonable efforts to store and maintain your personal data in a secure environment. We also take technical, contractual, administrative, and physical security steps designed to protect any and all personal data you provide. We have implemented procedures designed to limit the dissemination of your personal data to only such designated staff as are reasonably necessary to carry out the stated purposes we have communicated to you in this Privacy Policy.

10.2. Please note that you are also responsible for helping to protect the security of your personal data. For instance, never give out the credentials you use in connection with accessing the Platform so that other people will not have access to your personal data. Furthermore, you are responsible for maintaining the security of any personal computing device on which you utilize the Services.

10.3. We are not liable for disclosure of data due to errors in transmission, unauthorized access or acts by third parties, or omissions or acts beyond our reasonable control. Although we employ commercially reasonable measures of security, we also cannot guarantee that your personal data may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards by persons or systems with malicious intent.

10.4. In the event we become aware of a security breach that could result in your personal data being disclosed in a manner that is not authorized under this Privacy Policy, we will notify you via e-mail (or other communication channel you have provided to us) if we can and use other means (such as posting a notice on our Platform) to try to alert you as appropriate.

10.5. We have implemented the following security measures to protect our product or service:

• The (database) servers can be accessed only via FineDine’s trusted network locations.
• Procedures are in place to ensure only authorized personnel have access to the personal data. A non-disclosure and confidentiality agreement ensures this still applies when a member of staff leaves the company.
• All mobile carriers (such as laptops, USB sticks and portable HDs) of FineDine are password protected.
• Our web servers and database servers are firewall-protected.
• All data within FineDine will be stored as securely as possible.
• Encryption will be used when possible.
• All data will be transmitted with the highest possible form of encryption that is supported.
• We ask for confirmation mail while registering.
• We prevent two different users from logging in using the same browser.
• We keep our content on AWS S3 subject to private access.
• Only authorized people can see any details in any FineDine started by a User.
• We use the PostgreSQL database, and here, we control all access with Role Level Security policies so that only the invitees of a FineDine can see the details of it.
• We have a rate limit definition for requests from the same IP.
• We work together with external security service providers regularly to perform penetration test to ensure our protection against unauthorized access.
• AWS Identity and Access Management (IAM): Access to the meeting recordings and files is strictly controlled.

10.6. We regularly revise the security measures outlined in this Privacy Policy to ensure that we are always fully prepared and up to date with regard to data protection.

11. DATA LEAK PROTOCOL

11.1. In the unfortunate event that something does go wrong, FineDine will follow the following data breach protocol to ensure that data subjects are notified of incidents.

11.2. A relevant internal data breach procedure is in place. FineDine will set up a team in order to analyze the cause, the impact, and the affected Users. Depending on the outcome of this analysis, data subjects will be notified as soon as possible. Data subjects (you) shall be notified within 24 hours of FineDine’s learning of the data leak if possible. If required by any applicable law, FineDine shall also notify any applicable Data Protection Authority about the leak.

11.3. FineDine will provide highly detailed information about:

• The nature of the breach, including a description of the incident, the nature of the personal data or categories of affected data subjects, an estimate of the number of affected data subjects and databases that may be affected, as well as an indication of when the incident occurred;
• Any measures already taken by FineDine in order to stop the breach;
• Any measures to be taken by the affected data subjects (what the affected data subjects themselves can do, such as “keep an eye on your e-mails”, etc.);
• Any measures to be taken by FineDine in order to prevent a future breach.

12. NOTICE FOR CALIFORNIA RESIDENTS; CATEGORIES OF PERSONAL DATA PROCESSED

12.1. Please note that this notice for residents of the State of California is provided for the ease of said persons; however, the other provisions of this Privacy Policy are equally valid and in force for residents of the State of California. Also, Users accessing this Privacy Policy from other locations may find this section useful.

12.2. Please refer to Article 17 below for more information regarding your rights related to the personal information processed and how to pose questions or requests to us regarding your personal information.

12.3. The chart below includes details on personal data or “personal information” collected from Users. Within the last twelve (12) months, we may have collected the following categories of personal information from the sources identified below for the business and commercial purposes indicated and disclosed, shared, or sold (as indicated) such categories of personal information with the specified categories of third parties:

13. NOTICE FOR EU RESIDENTS; GDPR LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER GDPR 

13.1. If you are a resident of one of the countries in the European Economic Area, the following provisions apply to you.

13.2. We may process Personal Data under the following conditions: 

• Consent: You have given Your consent for processing Personal Data for one or more specific purposes. If we are relying solely on your consent to process your personal data, you may withdraw your consent to our processing of your personal data at any time; however, withdrawing consent may result in your inability to continue using some or all of the services in the Platform. Please note that the withdrawal of your previous consent will not affect the lawfulness of the processing before its withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent.
• Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof. 
• Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the FineDine is subject.
• Vital interests: Processing Personal Data is necessary in order to protect Your vital interests or of another natural person. 
• Public interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in the FineDine. 
• Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by FineDine. Our legitimate interests are: managing our business and relationship with you; understanding and responding to inquiries and feedback; understanding how our Users use the Platform; identifying what our Users want and developing our relationship with you; improving our Platform and offerings; managing our supply chain; developing relationships with business partners; sharing data in connection with acquisitions and transfers of our business.

13.3. In any case, the FineDine will gladly help to clarify the specific legal basis that applies to the processing, and in particular, whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract. 

13.4. Your Rights under the GDPR 

• The Company undertakes to respect the confidentiality of Your Personal Data and to guarantee You can exercise Your rights. 
• You have the right under this Privacy Policy, and by law if You are within the EU, to: 
• Right to access: You have the right to access, update or delete the information We have on You. Whenever made possible, you can access, update or request deletion of Your Personal Data directly within Your account settings section. If you are unable to perform these actions yourself, please contact Us to assist You. This also enables You to receive a copy of the Personal Data We hold about You. 
• Right to request correction of the Personal Data: You have the right to have any incomplete or inaccurate information We hold about You corrected. 
• Right to object: This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation, which makes You want to object to our processing of Your Personal Data on this ground. You also have the right to object to where We are processing Your Personal Data for direct marketing purposes. 
• Right to erasure: You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it. 
• Right to data portability: You have the right to transfer your information to a third party in a structured, commonly used and machine-readable format, in circumstances where the information is processed with your consent or by automated means. You have the right to receive your Personal Data from us in a structured format and you have the right to (let) transmit such Personal Data to another controller. In that case we will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format.
• Right to withdraw Your consent. You have the right to withdraw Your consent on using your Personal Data. If You withdraw Your consent, we may not be able to provide You with access to certain specific functionalities of the Service. 

13.5. Exercising of Your GDPR Data Protection Rights 

• You may exercise Your rights of access, rectification, cancellation and opposition by contacting Us. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, we will try our best to respond to You as soon as possible. 
• You have the right to complain to a Data Protection Authority about Our collection and use of Your Personal Data. For more information, if You are in the European Economic Area (EEA), please contact Your local data protection authority in the EEA. 

14. NOTICE FOR TURKIYE RESIDENTS; KVKK LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER KVKK

If you are a resident of Turkiye, the following provisions will also apply to you.

14.1. What Kind of Personal Information Do We Collect?

We collect below mentioned personal data from you when you use the Platform by scanning the QR code and viewing the menu, including:

• details of your correspondence with us;
• technical information, such as your Internet Protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, screen resolution, flash version, time zone setting, browser plug-in types and versions, operating system, platform and traffic data, cookies data, web logs and other communication data, and details of the resources that you access, as well as your sessions records, which we collect from you when you access the Platform;
• Browsing history, search history, and interaction with Web sites, apps & ads, and other similar information; and
• any other information you provide to us.

14.2. What Lawful Reasons Do We Have To Process Personal Data?

We collect and process your Personal Data one or more of the below-listed reasons:

• Contract - We may process personal data to fulfill our contractual obligations.
• Consent - We may rely on your freely given consent at the time you provide your personal data to us.
• Legitimate interests - We may rely on legitimate interests based on our assessment that the processing is fair, reasonable and balanced.
• Legal obligations and public interest - We may process personal data to fulfill legal obligations.

14.3. Your Rights under KVKK

You have the right under this Privacy Policy and, in accordance with the Law on the Protection of Personal Data (KVKK) if You are a resident of Turkiye, to:

• Right to Access: You have the right to access, update, or delete the information We hold about You. Whenever possible, you can access, update, or request the deletion of Your Personal Data directly within Your account settings section. If you are unable to perform these actions yourself, please contact Us to assist You. This also enables You to receive a copy of the Personal Data We hold about You.
• Right to Request Correction of Personal Data: You have the right to have any incomplete or inaccurate information We hold about You corrected.
• Right to Object: You have the right to object where we are relying on legitimate interest as the legal basis for processing Your Personal Data, and there is something about Your particular situation which makes You want to object to our processing on this ground. You also have the right to object to the processing of Your Personal Data for direct marketing purposes.
• Right to Erasure: You have the right to request the deletion or removal of Your Personal Data when there is no good reason for Us to continue processing it.
• Right to Data Portability: You have the right to transfer Your Personal Data to a third party in a structured, commonly used, and machine-readable format, in circumstances where the information is processed based on Your consent or by automated means. You have the right to receive Your Personal Data from Us in a structured format, and You can (request to) transmit such Personal Data to another data controller. In that case, we will provide Your Personal Data in a structured, commonly used, machine-readable format to You or a third party You have chosen.
• Right to Withdraw Your Consent: You have the right to withdraw Your consent for the use of Your Personal Data at any time. If You withdraw Your consent, We may not be able to provide You with access to certain specific functionalities of the Service.

14.4. Exercising of Your KVKK Data Protection Rights 

You may exercise Your rights of access, rectification, cancellation and opposition by contacting Us via channels stated below. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, we will try our best to respond to You as soon as possible. 

15. NOTICE FOR UNITED ARAB EMIRATES (UAE) RESIDENTS; PDPL LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER PDPL

If you are a resident of the United Arab Emirates, the following provisions will also apply to you:

15.1. What Kind of Personal Information Do We Collect?

We collect the following personal data when you sign up to the Platform as a User, in compliance with the Federal Decree Law No. 45 of 2021 on Personal Data Protection (PDPL) of the UAE:

• Technical Information: such as your Internet Protocol (IP) address used to connect your computer to the internet, login information, browser type and version, screen resolution, flash version, time zone setting, browser plug-in types and versions, operating system, platform, traffic data, cookies data, web logs, and other communication data, as well as details of the resources you access and your session records when using the Platform.
• Other Information: any additional information you provide to us voluntarily.

15.2. What Lawful Reasons Do We Have to Process Personal Data?

Under PDPL, we process your personal data based on one or more of the following lawful bases:

• Contractual Necessity: We process your personal data to fulfill our contractual obligations with you.
• Consent: We may rely on your freely given, specific, and informed consent at the time you provide your personal data. You have the right to withdraw your consent at any time.
• Legitimate Interests: We process personal data when it is necessary for our legitimate interests, provided that such processing does not override your rights and freedoms.
• Legal Obligations and Public Interest: We may process personal data to comply with legal obligations, regulatory requirements, or when processing is necessary for public interest, including the protection of national security or public health
• Vital Interests: We may process personal data where necessary to protect an individual’s vital interests (e.g., life or safety).

15.3. Your Rights under PDPL

If you are a resident of the United Arab Emirates (UAE), you have the following rights regarding your personal data under PDPL:

• Right to Access: You have the right to request access to your personal data and obtain a copy of the information we hold about you.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data when there is no legal or legitimate reason for us to continue processing it.
• Right to Restrict Processing: You have the right to request that we restrict processing of your personal data under certain circumstances.
• Right to Object: You have the right to object to the processing of your personal data when we rely on legitimate interests as the legal basis. You may also object to direct marketing processing.
• Right to Data Portability: Where processing is based on your consent or performed by automated means, you have the right to request the transfer of your personal data to another service provider in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: If you have provided consent for the collection and processing of your personal data, you have the right to withdraw your consent at any time.
• Right to Object to Automated Decision-Making and Profiling: You may object to decisions based solely on automated processing, including profiling, that significantly affects you.

15.4. Exercising of Your PDPL Data Protection Rights 

You may exercise Your rights of access, rectification, cancellation and opposition by contacting Us via channels stated below. Please note that we may ask You to verify Your identity before responding to such requests. If You make a request, we will try our best to respond to You as soon as possible. 

16. UPDATES TO THE PRIVACY POLICY

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Entry Into Force" date and the updated version will be effective as soon as it is accessible. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes on the Platform or by directly sending you a notification through the Platform. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your personal data.

17. QUESTIONS AND REQUESTS ABOUT YOUR PERSONAL DATA ("CONSUMER REQUEST”)

17.1. As a User of FineDine you may request the following from FineDine as Data Controller;

• Access to your personal data.
• Rectification or deletion of your personal data.
• A restriction on the processing of your personal data.
• Object to the processing of your personal data.
• A transfer of your personal data (data portability) in a structured, machine readable and commonly used format.
• Withdraw your consent to us processing your personal data, at any time.

17.2. Please note that withdrawing your consent is only effective provided that consent is the only basis for the processing of relevant personal data. Similarly, even if you request the deletion of any personal data, we will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

17.3. You can make a request in relation to any of the above rights by writing to us at the contact address given at the end of this Privacy Policy. Only you, or someone legally authorized to act on your behalf, may make a consumer request related to your personal data. You may also make a consumer request on behalf of your minor child.

17.4. We will respond to such queries as soon as reasonably possible and deal with requests we receive from you, in accordance with the provisions of any applicable data protection law. Please note that you also have the right to appeal our responses to your consumer requests regarding this privacy policy. You can make your appeals to us using the same contact information below.

18. CONTACT US

18.1. You can contact us via email.

info@finedinemenu.com with “Privacy” in the subject line

18.2. If your email involves one of the requests listed above in the section titled “Questions and Requests About Your Personal Data”, we may ask you to verify your identity before fulfilling your request depending on the method of your request.