Translation notice: This English version is provided for information. The Turkish original governs legal interpretation.
Personal Data Processing and Protection Information Notice
Dear customers, members and visitors: this notice explains the principles governing the processing of your personal data by Çalcalar Gıda Turizm İnşaat Ticaret ve Sanayi Limited Şirketi (“Çalcalar” or the “Company”), the data controller located at Gökova Mah. Fethiye_1 Bulv. No:88, Ula/Muğla, Türkiye, under Turkish Personal Data Protection Law No. 6698 (“KVKK”) and related legislation.
1. Personal data we process and why
Customers shopping in our stores
When you shop in our stores, we may process identity, contact, customer-transaction, legal-transaction and financial information. This includes your name, address, purchase and payment information to conclude and perform the sales contract and issue an invoice; your email address if you ask to receive the invoice electronically; and card information, transmitted to the relevant payment institution, when you pay by credit or debit card.
Store visitors
We may process audio and image recordings captured by security systems in our stores. These systems are used to protect customers, employees and third parties against unlawful acts, offences and security incidents, and to fulfil our duties to provide information or documents to competent administrative and judicial authorities.
Website visitors
Cookies permitted by applicable law may be used to improve the browsing experience and, where legally allowed, to provide relevant communications. You can review the Cookie Policy shown on our website and manage preferences through your browser. We may also process IP-address and browsing information to maintain information security and conduct our activities in compliance with the law.
Members
If the website offers membership, we may process your name, email address, mobile number and security logs to create and administer the account, perform the membership agreement and provide service. If you choose to add them, gender, date of birth and address information may also be processed. Order date, order number, products, delivery information and payment method are processed so that you can view order history. If you request a stock notification, we process the relevant product, request and email address solely to send that notification.
Customers shopping through online channels
Whether you buy as a member or guest, we may process identity, contact, customer-transaction, legal-transaction and financial data to complete the sale, perform the distance-sales agreement, issue an invoice, deliver goods to the stated address and provide requested after-sales service. Card data is transferred to the payment institution where necessary to collect payment.
If you ask us to send a product to another person, we process that person’s name, address and mobile number only to deliver the order, provide delivery information and perform related after-sales services. Unless the recipient has separately consented, this information is not used for marketing. You are responsible for informing a person whose details you provide. We process your identity and contact details on the same limited basis if another person sends a product to you.
Customers who permit commercial electronic communications
If you give Çalcalar permission through any channel to send commercial electronic communications, we may use your name, mobile number, email address and consent logs to send advertising, promotions, campaigns, advantages, product and service introductions, market-research surveys and customer-satisfaction communications through the channels you select. Data may be shared with contracted service providers solely for these purposes. You may withdraw the permission at any time, without giving a reason, by using the refusal mechanism in the relevant channel or the controls available in your account.
People who contact Çalcalar
If you contact us through the website form, postal address, call centre, email or social media, we may process your name, account identifiers, contact details, order details where relevant, legal-transaction information, requests, complaints and supporting information to answer you, resolve the matter, manage and improve the customer experience and establish or protect rights in a possible dispute. Calls may be recorded for service quality and evidential purposes where permitted by law.
2. Collection methods and legal grounds
Personal data may be collected automatically through store cameras and systems, automatically through store and website transaction systems, semi-automatically when information provided orally to a sales adviser is entered into a system, and non-automatically from documents supplied by judicial or administrative authorities or recorded during return-review procedures. We may also collect data electronically through social media, telephone and call-centre channels.
Depending on the activity, processing relies on one or more of the grounds in Article 5 of the KVKK:
- your explicit consent, including consent for commercial electronic communications;
- processing expressly required by law or necessary for the Company to fulfil a legal obligation;
- processing necessary to conclude or perform a membership or sales contract, complete a sale or provide after-sales support;
- processing necessary to establish, exercise or protect a right, including the management of official and judicial proceedings;
- processing necessary for Çalcalar’s legitimate interests, provided that your fundamental rights and freedoms are not harmed, including store security, transaction security and business operations.
When the purpose requiring processing ends, or the statutory limitation and retention periods expire, personal data is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK.
3. Recipients and purposes of transfer
The purpose of a transfer is aligned with the purpose for which the data was collected. In accordance with Articles 8 and 9 of the KVKK, data may be shared with contracted institutions and service providers when necessary to provide logistics, resolve requests and complaints, carry out authorised marketing, operate business processes or support processing activities. If you use a credit or debit card, payment data is shared with the electronic-payment institution and relevant banks. Data may also be disclosed to competent public authorities and official bodies when required to fulfil legal information duties or exercise our legal rights.
How to apply to the data controller and your rights
Under Article 11 of the KVKK, you may ask whether your personal data is processed; request information if it is; learn the purpose of processing and whether the data is used accordingly; learn the recipients in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request notification of correction, deletion or destruction to recipients; object to a result against you produced exclusively by automated analysis; and claim compensation for damage caused by unlawful processing.
You may submit a request concerning data processed by Çalcalar in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests may be made in writing, through a registered electronic-mail address (KEP), with a secure electronic or mobile signature, or from an email address that you previously notified to Çalcalar and that is registered in our systems. We protect your data with care and thank you for your trust.