Legal

Privacy Policy

At Baharat Çiftliği we take the privacy of our visitors and customers seriously. This document explains what personal data we collect, how we use it and how we protect it, in line with Turkish Data Protection Law (KVKK) No. 6698.

Last updated · May 2026

Data Controller

The data controller for this policy is Baharat Çiftliği. Contact: aromoragida@gmail.com / +90 532 577 05 76.

Data We Collect

  • Contact details: name, email, phone number — via contact form, orders and customer correspondence.
  • Order details: shipping address, order contents, payment information (card data is processed only by the payment provider; we do not store it).
  • Technical data: IP address (in hashed form), browser metadata, session cookies.

How We Use Your Data

  • To receive, prepare, deliver and track orders.
  • To respond to contact requests.
  • To comply with legal obligations (invoicing, commercial records).
  • To secure the website, prevent fraud and operate technical infrastructure.
  • For marketing communications, only with your explicit consent.

Data Sharing

Your data may be shared on a limited basis with courier providers (for delivery), payment providers (for transaction processing) and authorised public bodies (for legal obligations). We never sell personal data to third parties for commercial purposes.

Cookies

The site uses essential cookies for session management and basic user experience. Analytics or marketing cookies, if added, are opt-in. You may change cookie settings in your browser at any time.

Retention Period

Order and invoice records are kept for 10 years under the Turkish Commercial and Tax Codes. Contact form messages are deleted or anonymised after a reasonable period following resolution of the request.

Security Measures

Your data is protected by HTTPS encryption, security headers (HSTS, CSP, X-Frame-Options), CSRF protection, rate limiting and access controls. Payment information is processed via PCI-DSS-compliant providers; we do not store card data.

Your Rights

Under KVKK Article 11 you have the right to:

  • Learn whether your data is being processed.
  • Request information about the purpose and scope.
  • Have inaccurate data corrected.
  • Have data erased once legal retention obligations expire.
  • Be informed of any third-party transfers, domestic or abroad.

To exercise these rights, write to aromoragida@gmail.com.

Changes

We may update this policy from time to time. Material changes are announced on the site; the current version is identified by the "last updated" date at the top of the page.