Website visit
Server logs may process IP address, request time, visited URL, browser and device information; the session uses a random session identifier. Data is collected automatically.
Privacy & personal data
The name, phone number, email, city/district, investment budget and message submitted with a franchise application are used to evaluate your enquiry and contact you. Company name, country and existing premises area are optional.
Processing of personal data and cookies
This notice explains to website visitors and franchise applicants why and on which legal grounds their data is processed.
Effective and last updated: 2026-10-23
Data controller
The legal entity below determines how personal data is processed for the Why Coffee branded website.
- Registered company name
- ENGROUP AS
- Application and notification address
- Cumhuriyet Mah. Derviş Eroğlu Cad. No: 4 F, Beylikdüzü / İstanbul
- Contact email
- info@engroupas.com
Data processed and collection method
Franchise application
Name, phone, email, city/district, investment budget and message are required; company name, country and existing premises area are optional. Form language, submission time and a random application number are also recorded.
Communication records
After an application, the content of email or telephone conversations, evaluation status and follow-up notes may be processed solely to manage the process.
Purposes and legal grounds
- Review the franchise request, assess suitability and manage a possible contract process.
- Reply to the applicant and manage meetings and follow-up.
- Prevent abuse, secure the form and website and resolve technical issues.
- Meet legal obligations and establish, exercise or protect legal rights.
Application data is processed because it is directly related to establishing a contract, is necessary to establish, exercise or protect a right, and is necessary for the controller's legitimate interests without harming fundamental rights.
Submitting the franchise form does not create an advertising or commercial messaging subscription.
Sharing, retention and security
Recipient groups
Data may be shared with authorised staff limited by their duties; hosting, database and email suppliers; and competent public bodies or courts where legally required. Franchise notifications are sent to the designated corporate recipient through Microsoft 365.
International transfers
When you allow Google Analytics or Google Maps, some connection and usage information may be processed on Google infrastructure. Google services and external links have their own privacy terms.
External links
Instagram, WhatsApp, directions, QR menu and EN Group links go to the relevant service only when you click them. The opened service applies its own data rules; referrer information is withheld where the link permits it.
Retention periods
Ongoing franchise applications are kept until the process ends; closed applications are kept for 6 months after closure and then periodically deleted. Application logs are generally kept for 14 days. A session ends after 30 minutes; the fact that the information notice was seen remains on the device until browser data is cleared. Records may be retained only as long as required by law or a dispute.
Security measures
Application fields are encrypted with the application key; access is role-based, administrator sessions use multi-factor authentication, and transfers use HTTPS. Access and activity logs are retained for a limited audit period.
Your rights under Turkish data law
Under Article 11 of Turkish Law No. 6698, you have the following rights:
- Learn whether your data is processed and, if so, request information and recipient details.
- Request correction of incomplete or inaccurate data and notice to recipients.
- Request deletion or destruction where conditions apply and notice to recipients.
- Object to an adverse result produced solely through automated analysis.
- Claim compensation for damage caused by unlawful processing.
How to apply
Send your request with identity verification details and a clear subject in writing to the address below; by registered electronic mail, secure electronic signature or mobile signature; or from an email address you previously supplied to us and which is registered in our system. Applications are answered as soon as possible according to their nature and no later than 30 days.
ENGROUP AS
Cumhuriyet Mah. Derviş Eroğlu Cad. No: 4 F, Beylikdüzü / İstanbul
info@engroupas.com
Cookies and external content
Necessary storage supports security and forms. Google Analytics and embedded Google Maps are off by default and load only after you allow the relevant service. You can change or withdraw your permission in Cookie choices.
| Name / service | Provider | Purpose | Duration | Basis |
|---|---|---|---|---|
why-coffee-session | Why Coffee | Session security, CSRF protection and form operation. | 30 minutes | Strictly necessary for the requested service |
why_consent_v2 | Why Coffee | Remembers analytics and map permissions, the preference version and expiry. | Up to 180 days | Strictly necessary for the requested service |
why_ga, why_ga_* | Google LLC | Measures page and branch interest, menu and contact clicks, and successful franchise applications for visitors who give permission. | Up to 180 days | Subject to Article 5 and, for overseas transfers, Article 9 of Turkish Law No. 6698 |
| Google Maps frame and possible third-party storage | Google LLC | Show the branch location on an interactive map. | Set by Google | Subject to Article 5 and, for overseas transfers, Article 9 of Turkish Law No. 6698 |
| Locally hosted video files | Why Coffee | Play hero and social-content videos. | Only while viewing | Delivery of site content |
Google Analytics 4 loads only after you allow visitor measurement. Connecting may send your IP address and browser/device information to Google. Events include page type, site language, branch and action type; form fields, application references and personal information in URLs are not sent. Advertising personalisation and Google Signals are off. Withdrawing permission stops measurement and removes this website’s Analytics cookies. This website cannot delete cookies on Google domains.
Service providers' own privacy notices: Google · Microsoft · Instagram · WhatsApp