Privacy Notice

Data controller

Data controller: Hayır Tatlısı, Barbaros Mah. Venüs Sok. No:9/B, Ataşehir/İstanbul, Türkiye. Email: [email protected]. Phone: +90 530 060 80 60.

Personal data we process

• Contact form: full name, phone number, email address (optional), your message, submission time, consent record and a short-lived IP address used to prevent abuse.
• Phone and WhatsApp contact: your phone number and the content of the conversation. On WhatsApp the terms of WhatsApp (Meta Platforms) also apply.
• Orders: full name, phone, delivery address, delivery date and the details required for invoicing. Orders are currently taken by phone.
• Site usage data: IP address, browser and device information, pages and sections viewed, buttons clicked, referring address, approximate (city-level) location and, with your consent, cookie identifiers.

Purposes

• Answering your requests, questions and order enquiries and contacting you.
• Taking, preparing, delivering and invoicing orders.
• Keeping the site secure and preventing spam and abuse.
• Measuring site usage and performance and improving our content and services.
• Measuring the effectiveness of advertising campaigns (only with your cookie consent).
• Meeting obligations under tax, consumer and commercial law and responding to requests from competent authorities.

Legal grounds

• Necessity for the conclusion or performance of a contract (KVKK Art. 5/2-c): order and request processes.
• Compliance with a legal obligation (Art. 5/2-ç): invoicing and retention duties.
• Legitimate interest (Art. 5/2-f): site security, access logs and cookieless usage statistics without identifiers.
• Explicit consent (Art. 5/1): statistics and marketing cookies and the related transfers abroad. You can withdraw consent at any time through the cookie banner.

Recipients and transfers abroad

Limited to the purposes above, your personal data may be shared with the following groups of recipients:

• Service providers: site hosting (Hostinger International Ltd., servers in the European Union); with your consent Google Analytics, Google Ads and Google Tag Manager (Google LLC / Google Ireland Ltd.) and Microsoft Clarity (Microsoft Corporation). Google Fonts and Google Maps requests also reach Google servers. These providers may keep servers abroad; transfers rely on your explicit consent or the applicable law under KVKK Art. 9.
• Shipping and delivery companies: name, address and phone number for delivery.
• Competent public authorities: where required by law.

How data is collected

Your data is collected by automated or partly automated means through the contact form on the site, phone and WhatsApp conversations, cookies and similar technologies, and server logs.

Retention periods

• Contact form records: 2 years after the request is closed.
• Order and invoice records: the period required by law (at least 10 years).
• Server access logs: up to 8 days; QR code redirect log up to 90 days.
• First-party interaction log (no IP address): up to 14 months.
• Google Analytics data: 14 months; cookie lifetimes are listed in the Cookie Policy.

Your rights

Under Article 11 of KVKK you have the right to:

• Learn whether your personal data is processed and request information about it.
• Learn the purpose of processing and whether the data is used in line with it.
• Know the third parties to whom the data is transferred in Türkiye or abroad.
• Request correction of incomplete or inaccurate data.
• Request erasure or destruction under the conditions of Article 7.
• Request that corrections, erasure and destruction are notified to third parties who received the data.
• Object to a result against you produced exclusively by automated analysis.
• Claim compensation for damage caused by unlawful processing.

How to apply

You can submit requests about your rights in writing to Barbaros Mah. Venüs Sok. No:9/B, Ataşehir/İstanbul or by email to [email protected], in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests are answered free of charge within 30 days at the latest; where the process has an additional cost, the fee set by the Personal Data Protection Board may apply.