Cookie Policy

Merilin Yemek – COOKIE POLICY (WEB) Version: 1.0.0 | Effective: October 20, 2026 SUMMARY (for information only; the binding text is the clauses below) • This policy is only for our https://merilinapp.com website. SDKs and identifiers in the mobile application are in Clauses 8 and 10 of the Privacy Policy. • Today we do not use analytics, advertising or marketing cookies on our publicly accessible site. That is why we do not show a cookie consent banner on the site. • The only type of cookie we use is the strictly necessary session cookie for staff Operations area login; it is not for visitors and does not require consent; our infrastructure providers may place technical/security cookies where strictly necessary (Clause 3.3). • If we add a non-essential cookie in the future, we will first update this policy, enable the consent banner and not run that cookie without obtaining your consent. Rejecting will be as easy as accepting. • Your KVKK rights regarding cookies and application: kvkk@merilinapp.com 1. SCOPE AND RELATED TEXTS 1.1. This Cookie Policy has been prepared regarding the cookies and similar technologies used on the Merilin Yemek website (https://merilinapp.com), under the Law No. 6698 on the Protection of Personal Data (KVKK) and the Personal Data Protection Authority's Guide on Cookie Practices. 1.2. This policy complements the Privacy Policy and KVKK Information Notice; the purposes, legal grounds, transfers and rights regarding personal data processed via cookies are read together with the general framework in that text. In case of conflict, on cookie matters this policy applies, and on general personal data matters the Information Notice applies. 1.3. The mobile application is not a website; Firebase, Yandex Mobile Ads, Sentry and TomTom SDK identifiers in the application are not cookies and are explained in Clauses 8 and 10 of the Privacy Policy. This policy does not cover them. 2. WHAT IS A COOKIE, WHAT ARE ITS TYPES 2.1. A cookie is a small text file that the website you visit saves to your device via your browser. Similar technologies (local storage, pixels and tags) are also treated as cookies in this policy to the extent they process personal data. 2.2. By duration: session cookies (deleted when the browser closes) and persistent cookies (remain for a certain period or until you delete them). 2.3. By source: first-party cookies (placed by our site) and third-party cookies (placed by another provider). 2.4. By purpose: (a) strictly necessary cookies – indispensable for the operation and security of the site; (b) functional cookies – remembering preferences such as language; (c) performance/analytics cookies – usage measurement; (d) targeting/advertising cookies – advertising and profiling based on interests. Today only strictly necessary cookies are in use among these categories; details are in Clauses 3 and 4. 3. COOKIES WE USE TODAY 3.1. On our publicly accessible marketing site, no first-party analytics, functional, advertising or marketing cookies are placed on the pages you browse as a visitor. For these pages, only technical infrastructure records (server logs) necessary for the secure presentation of the site are processed from your device; these records are not cookies and are within the scope of Clause 5.4 of the Privacy Policy. 3.2. Staff Operations area: in the staff administration area accessed via our site, a first-party strictly necessary session cookie is used only to maintain the session of logged-in staff and to prevent unauthorised access. Category | Name/source | Purpose | Duration | Party | Legal ground Strictly necessary | Session cookie (merilin_admin_session – staff Operations area) | Maintaining staff session, security | Up to 14 days; ends when staff sign out or the period expires | First party | Performance of contract and legitimate interest – security (KVKK Art. 5/2-c, f) 3.3. Our infrastructure providers (Vercel hosting and Cloudflare network security) may place their own technical/security cookies in case of strict necessity for the presentation of the site and protection against attacks. These cookies are not for marketing or profiling; the providers act as data processors and within the framework in Clause 8.2 of the Privacy Policy. 3.4. As of the effective date of this version, since there are no cookies requiring consent (non-essential) on the publicly accessible site, no cookie consent banner is shown. This policy is the information text replacing the banner. 4. COOKIES WE DO NOT USE 4.1. Currently the following are not used on our site: Google Analytics or similar analytics cookies; advertising, targeting and remarketing cookies; social media tracking pixels; third-party cookies profiling site visitors. 4.2. If any of these cookies is added in the future, it will not be run without applying the consent regime in Clause 6, and this policy and the Clause 3 table will be updated first. 5. LEGAL GROUNDS 5.1. Strictly necessary cookies are used on the legal grounds of performance of contract and legitimate interest (KVKK Art. 5/2-c and f) for the presentation and security of the site, without seeking explicit consent; however, you are informed about them through this policy. 5.2. Non-essential (functional, analytics, targeting/advertising) cookies are used only with your explicit consent (KVKK Art. 5/1). Not giving consent does not prevent you from using the essential functions of the site. 6. RULES OF THE CONSENT MECHANISM (if non-essential cookies are added) 6.1. Consent is obtained without pre-ticked boxes, separately for each cookie category, with "accept" and "reject" options presented with equal prominence and without making access to the site conditional on consent (no cookie wall). Continuing to browse the site does not count as consent. 6.2. Before giving consent, the purpose, duration, party and placing provider of each category are shown to you in this policy; consent is given after this information. 6.3. The consent record is stored with version, date-time and category choices. Consent is requested again at the latest when the relevant cookie expires, when a material change is made to this policy, or in any case 12 months after the last consent. 6.4. You may withdraw your consent at any time via the cookie settings link on the page; withdrawal is effective prospectively, cookies are stopped and those possible are deleted. 7. HOW YOU MANAGE COOKIES 7.1. You can delete, block or allow cookies only for certain sites in your browser settings. Blocking the strictly necessary session cookie may prevent login to the staff Operations area; publicly accessible pages can be viewed without cookies. 7.2. In common browsers, cookie settings are in the "Privacy and security" section of the browser. The detailed path is on your browser's help page. 7.3. If non-essential cookies start to run, a permanent "Cookie Settings" link on the page is offered as an additional and easy withdrawal route alongside browser settings. 8. THIRD PARTIES AND CROSS-BORDER 8.1. Data collected via cookies is limited to the providers in Clause 8.2 of the Privacy Policy. Hosting and security infrastructure may contain cross-border components; in such cases the mechanism in Clause 9 of the Privacy Policy (adequacy or standard contract) applies. 8.2. The own cookie practices of third-party sites to which we link from our site are subject to those sites' policies; we do not control them. 9. RETENTION AND SECURITY 9.1. The session cookie is limited to the period in Clause 3.2; it ends when staff sign out or when that period expires. Retention of server technical records is limited to the periods in Clause 11 of the Privacy Policy; cookie data is not turned into a marketing profile. 9.2. Data processed via cookies is protected by the security measures in Clause 12 of the Privacy Policy. 10. YOUR RIGHTS 10.1. Clause 14 of the Privacy Policy explains your KVKK Art. 11 rights (learning whether your data is processed, requesting information, learning the purpose of processing and whether it is used in line with that purpose, knowing the third parties to whom it is transferred, rectification, erasure, objection to automated analysis, compensation for damage) regarding personal data processed with cookies and the application procedure. Application: kvkk@merilinapp.com – free reply within 30 days at the latest; the Board complaint route is written there. 11. CHANGES 11.1. Before adding a new cookie category or provider, we update this policy and publish it with the effective date; cookies requiring consent are not run without the updated policy and the Clause 6 consent. 11.2. This version enters into force on October 20, 2026. The original of the text is Turkish; in case of conflict the Turkish text prevails. Data controller: Hakan Berber · Address: Yayla Mevkii İnönü SK. No:27.1 Uluğbey Köyü, Senirkent / Isparta, Türkiye · KVKK: kvkk@merilinapp.com · Support: support@merilinapp.com Version: 1.0.0 · Effective: October 20, 2026 · Merilin Yemek