Privacy Notice (KVKK / GDPR)

Çağrıbaba takes the security of your personal data seriously. This notice is provided as data controller under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and, for visitors from the EU/EEA and the UK, under Articles 13–14 of the GDPR.

1. Data controller

2. Personal data we process

• Identity and contact: name, company, country, e-mail, phone/WhatsApp, delivery address
• Invoicing: company name, tax office and tax number for company purchases
• Transactions: quotation requests (RFQ), orders, basket and correspondence records
• Security: IP address, session data, time of form submission and order confirmation

Card details are never seen or stored by us; card payments are processed by the licensed payment institution PayTR. We do not request national identity numbers.

3. Purposes

• Answering quotation requests, issuing proforma invoices and communicating with you
• Taking orders, collecting payment, delivering and invoicing products
• After-sales support, returns and complaints
• Creating and managing member accounts
• Meeting tax, commercial, customs and consumer-law obligations
• Information and transaction security, prevention of abuse

4. Legal bases

Data is processed for the conclusion and performance of a contract, compliance with legal obligations, the establishment, exercise or protection of rights, and our legitimate interests where these do not override your fundamental rights (KVKK Art. 5/2-c, ç, e, f; GDPR Art. 6(1)(b), (c), (f)). Measurement cookies are used only with your explicit consent.

5. Recipients and international transfers

Only to the extent necessary for the purposes above, data may be shared with carriers and freight forwarders, banks, the payment institution (PayTR), the e-invoice provider (BirFatura), customs brokers and competent public authorities. Our hosting, content delivery network (Cloudflare), e-mail (Google) and measurement providers operate servers outside Türkiye; such transfers are carried out in line with Article 9 of the KVKK and, where applicable, Chapter V of the GDPR.

6. Retention

Quotation requests are kept for 2 years; order and invoice records for the periods required by law (5 years under the Tax Procedure Law, 10 years under the Turkish Commercial Code). Data is then deleted, destroyed or anonymised.

7. Your rights

You have the right to learn whether your data is processed, to request information, to learn the purpose and whether it is used accordingly, to know the third parties it is transferred to, to request correction, erasure or restriction, to object, and to claim compensation for damage (KVKK Art. 11; GDPR Arts. 15–22). Send requests to [email protected]; they are answered free of charge within 30 days.