As EKMAS GIDA MAKINALARI (“EKMAŞ” or the “Company”), acting as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), we inform you about the purposes and legal bases on which your personal data are processed, the parties to whom they may be transferred, the methods by which they are collected and your rights.

Your personal data may be collected electronically through membership, contact, quotation and order forms on the website, account and order transactions, email and telephone communications, cookie preferences and website usage records; and, where necessary, through physical documents and records by non-automated means.

Identity: Name, surname; and, where required for a commercial transaction, company title and tax information.

Contact: Telephone number, email address, billing address and delivery address.

Customer Transaction: Membership, order, quotation, product, delivery, return, withdrawal, request and complaint information, and purchase history.

Financial: Invoice, collection and payment-transaction information. If full card details are not stored by EKMAŞ, payment transactions are carried out through the secure infrastructure of the relevant payment institution.

Transaction Security: IP address, session, access, cookie-preference and system records, where such data are actually generated by EKMAŞ systems or the infrastructure used.

Membership, orders, quotations, payments, delivery, returns and after-sales support: Processing is necessary for the establishment or performance of a contract to which the data subject is a party.

Invoice, accounting, tax and statutory obligations: Processing is necessary for the data controller to comply with a legal obligation.

Management of requests, complaints, warranties, returns and disputes: Processing is necessary for the establishment, exercise or protection of a right.

Website, account and transaction security: Processing is necessary for the legitimate interests of the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject, and, where applicable, for compliance with legal obligations.

Analytics and marketing cookies: The user’s separate, freely given explicit consent. Reading this privacy notice or completing a membership or order transaction does not constitute explicit consent.

To the extent necessary for the relevant activity and legally permissible, your personal data may be transferred, for the relevant purpose only, to banks/payment institutions for payment and collection, courier/logistics companies for delivery and returns, service providers supplying e-commerce and information-technology infrastructure, advisers for financial and legal obligations, and public authorities and institutions legally authorised to receive such data.

If explicit consent is given for Google Analytics and Google Ads and those services are activated, online identifiers and usage data may be processed by Google outside Türkiye. Regular international transfer activities must be carried out by relying on an appropriate condition under Article 9 of KVKK and by providing the required safeguards.

Essential cookies may be used on an appropriate legal basis because they are necessary for the secure and basic operation of the website. Analytics cookies within Google Analytics and marketing cookies within Google Ads are not activated without the user’s consent. Detailed information is provided in the Cookie Notice.

Your personal data are retained for as long as required by the purposes of processing and for any mandatory retention periods prescribed by applicable legislation. When the reason for processing ceases to exist and there is no other legal retention obligation, the personal data are deleted, destroyed or anonymised in accordance with applicable law.

To exercise your rights under Article 11 of KVKK, you may apply to EKMAS GIDA MAKINALARI using one of the methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application must contain sufficient information to identify you and your request.

This text is a privacy notice; it is not an explicit-consent form. If a processing activity requires explicit consent, that consent is obtained separately from this notice and separately from membership/order acceptance. As a rule, refusal to provide explicit consent does not prevent use of membership or order services that do not require such consent.

If there is a change in personal-data processing activities, purposes, legal bases, recipient groups or applicable legislation, this Privacy Notice will be updated to reflect the relevant changes.