Personal Data Protection and Processing Notice

1. Data Controller

Inquiries received through the KRD & EKAM website are handled by one of the following companies, depending on the inquiry. The company handling quotations and orders varies accordingly. KARDEŞLER KARADENİZ TARIM ÜRÜNLERİ İÇ VE DIŞ TİCARET LİMİTED ŞİRKETİ Kadıköy Mah., Genel Müdür Osman Tural Sk., No: 8/1, Alaçam, Samsun, Türkiye EKAM TARIM ÜRÜNLERİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ İnönü Mah., 167 Sk., No: 11, Torbalı, İzmir, Türkiye To identify the company handling your inquiry or submit a personal data request: info@ekamspice.com

2. Categories of Personal Data Processed

The personal data we process falls into the following categories:

• Identity Data: First name, last name
• Contact Data: Email address, phone number, company name, country
• Message Content: The content of messages you submit
• Technical Data: IP address, browser type and version, operating system, screen resolution, language preference, timezone, referrer URL
• Usage Data: Pages visited, duration of visit, in-site behaviour (via Google Analytics, only with explicit consent)

3. Purposes of Processing

Your personal data is processed for the following purposes:

• To respond to your contact requests and establish commercial communication
• To provide information about our products and services
• To ensure the security of our website and prevent misuse
• To analyse and improve website usage (with explicit consent)
• To fulfil our legal obligations

4. Legal Basis for Processing

Your personal data is processed under KVKK Art. 5/2(f) "processing is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject" and GDPR Art. 6/1(f) legitimate interest. For analytics and marketing cookies, your explicit consent is obtained under KVKK Art. 5/1 and GDPR Art. 6/1(a).

5. Third Parties

Your personal data is shared with or processed through the following third parties:

• Google Analytics — measures pages and defined interactions only when analytics is enabled. Form contents, URL queries and referrer addresses are excluded from analytics events.
• Cloudflare Turnstile — bot protection on the contact page, with server-side verification.
• ipapi.co — approximate location is requested only with analytics permission to calculate automatic day/night appearance.
• Sunrise-Sunset.org — sun times are requested from approximate coordinates with the same permission. It is not used to choose your language.
• Hostinger — website hosting, contact database and server services.
• Yandex Metrica — usage measurement only with analytics permission. Session replay, click maps and automatic link tracking are disabled; events exclude form contents.
• Google SMTP and recipient email services — deliver contact notifications to the company’s contact recipients and support replies.

Requests to these services require the provider to process your IP address and technical connection information; processing may occur outside Türkiye. Providers’ own privacy terms also apply.

6. Retention Periods

Retention differs by the system holding the data:

• General enquiries are actively followed up for 12 months from the last meaningful customer communication. Records are removed when no further retention basis remains; expiry of this period does not mean statutory commercial records are deleted.
• Server-log retention depends on the hosting service and log type; this page does not promise one fixed period for every log.
• GA4 settings checked on 6 September 2026: event data 2 months, user data 14 months; reset on new user activity enabled. These are not cookie lifetimes or the retention period of all aggregated reports.
• Browser preferences remain until changed or browser data is cleared. Sun data is cached for at most 6 hours and removed when analytics permission is withdrawn.
• Commercial correspondence and documents covered by Article 82 of the Turkish Commercial Code are held in a separate archive with restricted access for 10 years from the end of the relevant calendar year. Records needed for an ongoing dispute or another legal obligation are preserved while that basis remains.
• Spam and test messages have a 30-day retention period. Deletion is coordinated across the database, notification emails and other copies. Maintenance backups of enquiry records are cleaned on a 30-day retention cycle; deletion records are kept for at least 3 years. Contact info@ekamspice.com about your record.

7. Rights of the Data Subject

Under KVKK Art. 11 and GDPR Art. 15-22, you have the following rights:

• To learn whether your personal data is being processed
• To request information about the data processed
• To learn the purpose of processing and whether data is used in accordance with that purpose
• To know the third parties to whom data is transferred domestically or abroad
• To request correction of incomplete/incorrectly processed data
• To request deletion or destruction of your data
• To request restriction of processing
• To object to results arising from automated processing
• To request compensation for damages arising from unlawful processing
• To lodge a complaint with the Personal Data Protection Authority (KVKK)

8. How to Apply

To exercise the rights listed above, you may submit a written request to info@ekamspice.com. Your request must clearly state your identity and the subject of your request. Requests will be responded to within 30 days at the latest, depending on the nature of the request. If your request is rejected, the response is found insufficient, or not answered in time, you retain the right to file a complaint with the Personal Data Protection Authority.

9. Cookie Policy

Preferences may use local storage and measurement identifiers may use cookies. Google Analytics, Yandex Metrica and location-based theme requests do not start while analytics is off. Withdraw permission in cookie preferences; this does not automatically delete records already received by a server.

10. Changes to This Policy

This notice may be updated from time to time. Significant changes will be announced on our website. The last update date is shown at the top of the document. We recommend that you review the policy regularly.