1. Data controller
Under Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller is:
This notice has been prepared to inform individuals who visit the endercikolata.com website, use the contact form, or otherwise get in touch with our company through the website.
2. Personal data processed
Depending on how you use the site and communicate with us, the following categories of data may be processed:
- Identity information: First and last name.
- Contact information: Email address, phone number, address you provide, or other contact details.
- Request and communication information: Message subject, message content, product or partnership request, and correspondence records.
- Professional and commercial information: The company you represent, your role, and information you submit as part of a B2B request.
- Transaction security information: IP address, access date and time, page viewed, browser, device and security logs, to the extent recorded by our hosting and security infrastructure.
The contact fields are not designed to receive health data, biometric data, criminal conviction records, political opinions or similar special category personal data.
3. Purposes of processing personal data
- Receiving, evaluating and responding to contact, information, product, export, distribution, supplier and B2B partnership requests.
- Directing requests to the relevant department and following up the communication process.
- Ensuring the security, accessibility and technical continuity of the website; preventing misuse and attacks.
- Fulfilling legal obligations, responding to requests from authorised bodies, and establishing, exercising or protecting a legal right.
- Improving communication quality and corporate processes.
This website has no membership, online ordering, cart, payment or e-commerce functionality. Accordingly, no payment, order or membership data is processed.
4. Method of collection and legal grounds
Data is obtained wholly or partly through automated means, or through non-automated means provided they form part of a data recording system, via the information you enter in the contact form being delivered to us through a form-delivery service (Web3Forms), direct email/phone communication, and technical records that may arise during access to the website.
Depending on the specific activity, processing relies on the following grounds under Article 5 of the KVKK:
- Being directly related to the establishment or performance of a contract.
- Being necessary for the data controller to fulfil a legal obligation.
- Being necessary for the establishment, exercise or protection of a right.
- Being necessary for our company's legitimate interests, provided this does not harm your fundamental rights and freedoms.
If a new activity based on explicit consent is introduced, the notice and consent processes will be carried out separately.
5. Transfer of data
Your personal data may be shared, only to the extent required by the purposes above and in accordance with Articles 8 and 9 of the KVKK, with the following recipient groups:
- Suppliers providing hosting, content delivery network, cybersecurity, corporate email, contact-form delivery and information technology services.
- Persons and organisations providing legal, audit and consultancy services.
- Authorised units within the company and service providers involved in related business processes, where the request requires it.
- Legally authorised public institutions, organisations and judicial authorities.
Because the website's global hosting, security or email infrastructure is used, technical data may be processed through service providers located abroad. Such a transfer is carried out only where one of the transfer conditions of Article 9 of the KVKK is met and appropriate safeguards are in place.
6. Retention periods
| Data group | Maximum retention approach |
|---|---|
| General communication and request records | Up to 3 years from the closure of the request |
| Correspondence that develops into a contract or commercial relationship | For the duration required by applicable legislation and statute-of-limitations periods; generally up to 10 years |
| Technical access and security records | For as long as required for security and legal obligations; generally up to 2 years |
| KVKK application records | 3 years from the conclusion of the application |
When the grounds for processing no longer apply, data is deleted, destroyed or anonymised in accordance with legislation. Records legally required to be kept longer are retained only for the period that obligation requires.
7. Your rights under the KVKK
Pursuant to Article 11 of the KVKK, by applying to our company you have the right to:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used in accordance with that purpose,
- Know the third parties to whom it is transferred domestically or abroad,
- Request correction if it has been processed incompletely or incorrectly,
- Request its deletion or destruction under the conditions set out in Article 7 of the KVKK,
- Request that correction, deletion or destruction be notified to third parties to whom the data was transferred,
- Object to a result that is to your detriment arising solely from automated analysis,
- Request compensation if you suffer damage due to unlawful processing.
8. How to apply and data-deletion requests
You can submit all your KVKK requests — including deletion, correction or requests for information about your personal data — by writing “KVKK Application” in the subject line and sending an email to sosyal@endercikolata.com. Your application should include your full name, contact information, the subject of your request, and information sufficient to verify your identity. Properly submitted applications are concluded free of charge, as soon as possible and no later than 30 days, depending on the nature of the request.
Effective date: 21 July 2026