Last updated Nov 14, 2026
Data Processing Agreement
This agreement governs the personal data of a restaurant’s guests and staff that Nucleic Table handles for the restaurant. The restaurant (the controller) decides why and how that data is used; Nucleic Table (the processor) works on its instructions. The restaurant owner accepts it when signing up, and it forms part of the Terms of Service.
1. Parties
The controller is the restaurant that signed up, as named in its account. The processor is:
- Legal name: Not yet published
- Registered address: Not yet published
- Tax office: Not yet published
- Tax number: Not yet published
- MERSIS number: Not yet published
- E-mail: Not yet published
2. What is processed, and why
| Item | Detail |
|---|---|
| Purpose | Providing the QR menu, guest accounts, ordering, waiter calls, loyalty, campaigns, reviews and reports to the restaurant. |
| People concerned | The restaurant’s guests, and the restaurant’s staff accounts. |
| Data | E-mail, name and optional phone number, password hash, orders and waiter calls, reviews and likes, loyalty points and coupons, the documents accepted, session records. |
| Duration | For as long as the restaurant uses the service, then as set out in section 8. |
3. Instructions and confidentiality
- We process the data only to provide the service and on the restaurant’s documented instructions, which are its use of the product and this agreement.
- We do not use guests’ data for our own purposes, advertising or sale, and we do not mix it between restaurants.
- Everyone with access to the data at our side is bound to confidentiality.
- If an instruction would break the law, we tell the restaurant.
4. Security measures
- Each restaurant has its own database schema and its own accounts.
- Passwords are stored as salted hashes; sessions use cookies that scripts cannot read and that apply to one address only.
- Access is limited by role. Sign-up and sign-in are rate-limited and protected by a captcha.
- Changes to data are recorded in an audit log that the owner can read.
- Our staff reach a restaurant only through a time-limited support session of at most 60 minutes, recorded with its reason.
5. Sub-processors
We use infrastructure providers to host the platform. The servers and database run in: Not yet published. Polar handles only the owner’s billing and receives no guest data. We bind every sub-processor to duties at least as strong as these, and we remain responsible for it. We tell the restaurant before we add one that processes guest data.
6. Helping the restaurant with guests’ rights
- A guest can ask for deletion in the product. The deletion runs within 24 hours: the account, profile, phone, reviews, likes, coupons and loyalty records are removed, and past orders stay with the person reference cleared.
- A guest can export their own data from the product.
- If a guest writes to us, we pass the request to the restaurant, and we help it answer inside the 30 days that KVKK allows.
7. Data breaches
If we learn of a breach that affects the restaurant’s data, we tell the restaurant without undue delay and give it what it needs to meet its own duty to notify the Personal Data Protection Board and the people concerned.
8. When the service ends
When a restaurant is closed its data is archived and then deleted after a limited retention period, together with its database schema. Data we must keep by law stays with us, protected, only for the legal period.
9. What the restaurant must do
- Have a lawful basis for the data it collects, and tell its guests with its own privacy notice and terms. We supply default texts that it may replace.
- Register with the data controllers’ registry (VERBİS) where the law requires it.
- Give us only lawful instructions, and collect no more than it needs.
10. Information and checks
On request we give the restaurant the information it needs to show we meet this agreement, and we allow reasonable checks, agreed in advance and without harm to other restaurants.
11. Law
This agreement follows the Personal Data Protection Law No. 6698 and is governed by Turkish law. In a conflict between it and the Terms of Service about personal data, this agreement wins.