KVKK Privacy Notice

1. Data controller

The data controller is Kumsal Bodrum Patisserie, trading in Bodrum / Muğla, Türkiye. Contact details are in the business details block at the foot of this page.

This notice covers only the data you send us directly. The website itself collects nothing; that is set out in the Privacy Policy.

2. Personal data processed

When you contact us to place an order, the following data is processed:

• Identity and contact: name, phone number, email address if you give one.
• Delivery: delivery address or venue name, delivery date and time.
• Order: guest count, flavour and design preferences, any reference images you send, type of event.
• Health data (special category): only if you tell us — allergies, gluten, lactose or sugar restrictions.
• Financial data: invoice details where an invoice is issued.

3. Collection method and legal basis

Your data is collected directly from you, by WhatsApp message, phone call or in person.

Identity, contact, delivery and order data are processed under KVKK Art. 5/2-c, as necessary for the conclusion and performance of a contract. Invoice and accounting records rest on Art. 5/2-a and 5/2-ç: expressly provided for by law and necessary for compliance with a legal obligation.

Allergy and dietary information is special-category data. If you share it, it is processed under KVKK Art. 6/2 on the basis of your explicit consent, and solely so that your order can be made safely. You are not obliged to tell us; if you do not, we cannot take responsibility for the ingredients used.

4. Purposes

Your data is processed only for the following:

• Receiving your order request and preparing a quote.
• Planning production and adjusting the recipe to your preferences.
• Delivering to the right address at the right time.
• Staying in contact with you while the order is open.
• Issuing invoices and meeting statutory retention obligations.

5. Transfers

We do not sell or transfer your data to any third party for marketing.

We deliver ourselves; no courier or shipping company is involved.

If you choose to contact us through WhatsApp, your message travels over Meta Platforms infrastructure and may be processed on servers outside Türkiye. That transfer follows from your choice of channel. If you would rather not use WhatsApp, you can call us.

Where an invoice is issued, data is shared with our accountant and with public authorities legally entitled to it, only to the extent the relevant legislation requires.

6. Retention

Order and correspondence records are kept for a reasonable period after the order is completed, to handle possible complaints or claims, and are then deleted.

Invoice and accounting records are kept for the periods set out in the Turkish Tax Procedure Law and the Turkish Commercial Code.

7. Your rights

Under KVKK Art. 11 you may apply to the data controller and ask to:

• Learn whether your personal data is processed.
• Request information if it has been processed.
• Learn the purpose of processing and whether the data is used accordingly.
• Know the third parties, in Türkiye or abroad, to whom the data has been transferred.
• Request correction where the data is incomplete or inaccurate.
• Request erasure or destruction under the conditions set out in the law.
• Request that correction, erasure or destruction be notified to third parties who received the data.
• Object to a result against you produced solely by automated analysis.
• Claim compensation for damage suffered through unlawful processing.

8. How to apply

Send your request to the phone number or email address in the business details block. Under the Communiqué on Application Procedures to the Data Controller, your application is concluded within thirty days at the latest.

If your application is refused or goes unanswered within that period, you retain the right to complain to the Turkish Personal Data Protection Board.