The Personal Data Protection Law No. 6698 (hereinafter referred to as “KVKK”) was adopted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. Parts of KVKK entered into force on the publication date, while other parts became effective on October 7, 2016.

Data Controller

Calibre Kahve A.Ş., located at Merkez Mah. Cendere Cad. Seba Suites No:16/1F Kağıthane, Istanbul (hereinafter referred to as "Calibre Kahve" or the "Company"), has prepared this Information Notice on the Processing of Personal Data (“Information Notice”) to inform data subjects regarding the processing, storage, and transfer of their personal data within the framework of activities stemming from KVKK, relevant regulations, and legal arrangements.

This Information Notice will be effective as of the date it is published by Calibre Kahve. The Company reserves the right to make changes to this Information Notice as necessary. Any changes made will become effective immediately upon publication on the Company’s website.

1. Data Subjects

Customers

CATEGORIES OF DATA

1.1.1 - Identity Information

Personal Data Processed: Full Name, Date of Birth, Gender, Turkish ID Number

Purposes of Processing Personal Data:

Conducting financial and accounting activities, communication activities, and loyalty processes related to the company/products/services in compliance with legislation;
Managing legal affairs and ensuring business continuity;
Managing goods/services sales and post-sales support services and processes;
Executing customer relationship management processes and activities aimed at customer satisfaction;
Conducting advertising, campaign, and promotion processes;
Performing storage and archiving activities;
Managing contract and membership processes;
Tracking requests and complaints;
Planning and executing commercial and/or business strategies;
Carrying out necessary activities to provide access to offered products and services and managing related business processes;
Providing information to authorized persons, institutions, and organizations.

Legal Grounds for Processing Personal Data:
The personal data specified within this scope is processed by the Company for the purposes mentioned above based on the legal grounds outlined in Article 5 of KVKK, including:

Explicit stipulation in the law;
Necessity for the establishment or performance of a contract to which the data subject is a party;
Necessity for compliance with the data controller’s legal obligations;
Necessity for processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

For situations outside the scope of these purposes, your personal data is processed based on your explicit consent as detailed in the Consent Statement.

Methods of Collecting Personal Data:
The aforementioned personal data is collected through membership forms on our website, fields on the "My Account" page that you can fill out optionally, your requests and applications, contracts, campaigns, and third-party identity verification systems (e.g., Google Login, Facebook Login, etc.).

1.1.2 - Contact Information

Personal Data Processed: Email Address, Billing & Delivery Addresses, Mobile Phone Number

Purposes of Processing Personal Data:

Conducting financial and accounting activities, communication activities, and loyalty processes related to the company/products/services in compliance with legislation;
Managing legal affairs and ensuring business continuity;
Managing goods/services sales and post-sales support services and processes;
Executing customer relationship management processes and activities aimed at customer satisfaction;
Conducting advertising, campaign, and promotion processes;
Performing storage and archiving activities;
Managing contract and membership processes;
Tracking requests and complaints;
Planning and executing commercial and/or business strategies;
Carrying out necessary activities to provide access to offered products and services and managing related business processes;
Providing information to authorized persons, institutions, and organizations.

Explicit stipulation in the law;
Necessity for the establishment or performance of a contract to which the data subject is a party;
Necessity for compliance with the data controller’s legal obligations;
Necessity for processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

For situations outside the scope of these purposes, your personal data is processed based on your explicit consent as detailed in the Consent Statement.

1.1.3 - Legal Process Information

Personal Data Processed:
Information within litigation files in case of disputes, notices, correspondence with judicial and administrative authorities.

Purposes of Processing Personal Data:

Managing and conducting legal affairs;
Executing and supervising business activities;
Providing information to authorized persons, institutions, and organizations;
Ensuring compliance with regulations in activities;
Performing storage and archiving activities;
Managing risk processes;
Managing contract processes;
Tracking requests/complaints;
Ensuring the security of the data controller's operations.

Necessity for compliance with the data controller’s legal obligations;
Necessity for the establishment, exercise, or protection of a legal right;
Necessity for processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Methods of Collecting Personal Data:
The aforementioned personal data is collected through official letters from judicial and administrative authorities as well as other printed/electronic documents.

1.1.4 - Customer Transaction Information

Personal Data Processed:
Invoice Information, Request Information, Order Information, Customer Reviews

Purposes of Processing Personal Data:

Managing supply chain processes;
Conducting and supervising business activities;
Providing information to authorized persons, institutions, and organizations;
Ensuring compliance with regulations in activities;
Managing financial and accounting activities;
Performing storage and archiving activities;
Managing contract processes;
Executing goods/services sales processes;
Managing post-sales support services for goods/services;
Executing customer relationship management processes;
Conducting activities aimed at customer satisfaction;
Carrying out marketing analysis;
Managing advertising, campaign, and promotion processes;
Tracking requests/complaints;
Managing the marketing processes of products/services.

Explicit stipulation in the law;
Necessity for the establishment or performance of a contract to which the data subject is a party;
Necessity for compliance with the data controller’s legal obligations;
Necessity for processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

For situations outside the scope of these purposes, your personal data is processed based on your explicit consent as detailed in the Consent Statement.

Methods of Collecting Personal Data:
The aforementioned personal data is collected through printed/electronic forms, call center records, emails, and SAP programs.

1.1.5 - Transaction Security Information

Personal Data Processed:
IP Address Information, Website Login/Logout Information, Username Information, Traffic Data (e.g., Connection Time/Duration)

Purposes of Processing Personal Data:

Managing information security processes;
Conducting audit/ethics activities;
Conducting and supervising business activities;
Performing storage and archiving activities;
Ensuring the security of data controller operations;
Providing information to authorized persons, institutions, and organizations;
Ensuring compliance with regulations in activities;
Managing and conducting legal affairs;
Managing goods/services sales processes;
Tracking requests/complaints.

Explicit stipulation in the law;
Necessity for compliance with the data controller’s legal obligations;
Necessity for processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

For situations outside the scope of these purposes, your personal data is processed based on your explicit consent as detailed in the Consent Statement.

Methods of Collecting Personal Data:
The aforementioned personal data is collected through information security systems and electronic devices.

1.1.6 - Financial Information

Personal Data Processed:
Encrypted Credit Card Information, Bank Account/IBAN Number Information

Purposes of Processing Personal Data:

Ensuring compliance with regulations in activities;
Managing and conducting legal affairs;
Conducting financial and accounting activities;
Managing return processes;
Conducting and supervising business activities;
Managing goods/services sales processes;
Performing storage and archiving activities;
Managing risk processes;
Managing contract processes;
Providing information to authorized persons, institutions, and organizations.

Necessity for the establishment or performance of a contract to which the data subject is a party;
Necessity for compliance with the data controller’s legal obligations.
Methods of Collecting Personal Data:
The personal data mentioned above is collected through printed and electronic forms, emails, and requests or messages submitted via the Company’s website.
1.1.7 - Location Information
Personal Data Processed:
Location Information
Purposes of Processing Personal Data:
- Managing customer relationship processes;
- Conducting marketing analysis;
- Managing advertising, campaign, and promotion processes;
- Conducting activities aimed at customer satisfaction;
- Managing marketing processes of products/services;
- Executing goods/services sales processes;
- Managing production and operation processes of goods/services.
Legal Grounds for Processing Personal Data:
The personal data mentioned in this scope is processed by the Company to achieve the purposes stated above, based on the legal ground of explicit consent as specified in Article 5 of KVKK, detailed in the Consent Statement.
Methods of Collecting Personal Data:
The personal data mentioned above is collected through your preferences in the internet browser you use and the Company’s mobile application.
TRANSFER OF PERSONAL DATA
Personal data belonging to customers may be transferred, in compliance with the provisions of Article 8 (“Transfer of Personal Data”) and/or Article 9 (“Transfer of Personal Data Abroad”) of KVKK, and by taking necessary technical and administrative measures, only to the extent required to achieve the relevant purpose.
This data may be shared for the purposes stated above with our affiliates and subsidiaries, product sellers (for product delivery), courier companies (for shipment), banks (for payment of products), partners working on bulk SMS/email delivery (to provide information about delivery, etc.), and suppliers or authorized service providers (when required for post-sales services). Personal data may also be shared with authorized persons and official institutions to fulfill legal obligations in accordance with applicable legal regulations. Furthermore, it may be recorded in programs and/or systems provided by or made available through our technology infrastructure suppliers.
2 - Retention, Rights, and Requests Regarding Personal Data
2.1 - Retention and Disposal
Our Company has established a Retention and Disposal Policy for managing personal data retention and deletion processes. Retention and disposal processes for personal data are carried out within the framework of this policy.
According to KVKK and other relevant laws and regulations, if a specific retention period is stipulated for data, the relevant data must be retained for at least that period. To account for the possibility of delayed legal or administrative requests related to the data or potential disputes, retention periods are extended by 6 months to 1 year beyond the statutory retention periods. After the end of these periods, the relevant data is deleted, destroyed, or anonymized.
If no retention period is stipulated in the relevant legislation, your data will be retained for 10 years after the termination of our legal relationship, in consideration of potential disputes and the statute of limitations. Once this period has elapsed, your data will be deleted, destroyed, or anonymized without requiring any action on your part.
If all conditions for processing personal data cease to exist or the specified retention period has expired, your data will be deleted, destroyed, or anonymized within the first periodic disposal period or no later than 6 months.
In cases where you request the deletion of your data, it will be deleted within 30 days, provided it is legally possible. However, if your data is subject to a statutory retention period, it cannot be deleted or destroyed before this period expires.
2.2 - Your Rights
Under KVKK and related legislation, you have the following rights regarding your personal data:
- To learn whether your personal data is being processed;
- To request information if your personal data has been processed;
- To learn the purpose of processing your personal data and whether it is being used in line with this purpose;
- To know the third parties to whom your personal data has been transferred;
- To request correction of your personal data if it has been processed inaccurately or incompletely;
- To request the deletion or destruction of your personal data under the conditions stipulated by KVKK;
- To request notification of the actions taken for correction, deletion, or destruction to the third parties to whom your data has been transferred;
- To object to the occurrence of any adverse outcome for you as a result of the analysis of your personal data exclusively by automated systems;
- To request compensation for damages in case you incur losses due to unlawful processing of your personal data.
2.3 - Requests
You may submit your requests or applications regarding your personal data:
- By sending a signed petition with a copy of your ID to **Merkez Mah. Cendere Cad. Seba Suites No:16/1F Kağıthane / İST

Information Notice on the Protection of Personal Data

1.1.2 - Contact Information

1.1.3 - Legal Process Information

1.1.4 - Customer Transaction Information

1.1.5 - Transaction Security Information

1.1.6 - Financial Information

Methods of Collecting Personal Data:

1.1.7 - Location Information

TRANSFER OF PERSONAL DATA

2 - Retention, Rights, and Requests Regarding Personal Data

2.1 - Retention and Disposal

2.2 - Your Rights

2.3 - Requests