Personal Data Protection Notice

1. DATA CONTROLLER

Under Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by Milasso Gıda Tarım San. ve Tic. Ltd. Şti. as data controller, within the scope described below.

2. PERSONAL DATA PROCESSED

• Identity data: first name, last name
• Contact data: email address, phone number, delivery and billing address
• Customer transaction data: order history, return and request records
• Transaction security data: IP address, cookie records, site usage data

3. PURPOSES OF PROCESSING

• Carrying out order processes, delivering products and invoicing
• Responding to customer requests, questions and complaints
• Managing return and withdrawal processes
• Fulfilling legal obligations and complying with retention periods
• Sending campaign and promotional messages where you have given explicit consent

4. LEGAL GROUNDS

Your personal data is processed under Article 5 of the KVKK on the grounds of conclusion and performance of a contract, compliance with legal obligations, legitimate interest and, where required, your explicit consent.

5. TRANSFERS

Your personal data may be transferred to courier and logistics companies, payment institutions, accounting and legal advisers and authorised public institutions, limited to the relevant purpose only.

6. RETENTION PERIOD

Your data is retained for as long as the processing purpose requires and until the end of the statutory retention periods set out in applicable legislation (10 years for commercial books and invoices); it is then deleted, destroyed or anonymised.

7. SITE ANALYTICS

We measure visits on our own server in order to improve the site. No third-party tools such as Google Analytics and no advertising networks are used, and no cookies are set; analytics identifiers are randomly generated and kept in your browser's localStorage.

Analytics runs only with your explicit consent: unless you choose "I agree" on the banner shown on your first visit, no analytics data is sent from your browser to our server. You can withdraw your consent at any time through the "Analytics preference" link in the footer. If your browser sends a GPC (Global Privacy Control) or "Do Not Track" signal, analytics never starts.

Where consent is given, the following data is processed:

• IP address and the approximate location derived from it (country, region, city, postal area, city-level coordinates, time zone)
• Device and browser data: browser and version, operating system, device model, screen and window size, language preference, time zone, light/dark theme preference
• Connection data: connection class and speed, processor cores, memory
• Usage data: pages viewed, time spent on a page, scroll depth, clicks, and cart/checkout steps
• Traffic source: referring address, utm parameters and ad click identifiers (gclid, fbclid and similar)
• Page speed measurements
• Form interaction: which fields in the checkout and contact forms were filled in or left empty, which field failed validation and at which field the form was left (the content you type is never sent to analytics)
• Interaction and technical records: which sections of a page came into view, repeated clicks on the same spot, the fact that something was copied (not the copied text), on-site search terms and software errors occurring on the page

This data is used in aggregate, solely to understand site performance and the sales funnel; it is not shared with third parties for advertising and is not used for automated decision-making through profiling. Raw analytics records are kept for at most 400 days and then deleted automatically. When you place an order, only the order code and amount are written to the analytics side; your name, address, email and payment details are never copied into the analytics database.

If you have consented to analytics, your analytics session identifier and where you arrived from (source and landing page) are added to your order record, so that we can see which channel leads to sales. The steps of the payment process (opening the payment page, returning from the bank, the result and any decline reason reported by the payment institution) are kept as part of the order record, independently of consent, in order to process the order. We also derive aggregate counts from our server access logs that contain no IP address or identifier and cannot be linked to a person (such as how many times a page was opened per day, which site visits came from, and which pages search engine and AI crawlers read).

Legal basis: explicit consent under KVKK art. 5/1 and GDPR art. 6(1)(a).

8. RIGHTS OF THE DATA SUBJECT

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing, to know the third parties to whom it is transferred domestically or abroad, to request correction if it is incomplete or inaccurate, to request its deletion or destruction, and to claim compensation for damages.

You can send your requests to [email protected] or in writing to our company address. Your application will be concluded within 30 days at the latest.

Last updated: September 2026