KVKK / Customer Clarification Text

This Customer Clarification Text has been prepared to inform you about the processing of your personal data within the scope of the Law on Protection of Personal Data No. 6698 ("LPPD").

1. Data Controller

Your personal data is processed by the data controller:

FEDERAL COFFEE INTERNATIONAL GIDA LİMİTED ŞİRKETİ
Address: Cumhuriyet Mah. Arabayolu Cad. No:107/1 Sarıyer / Istanbul
Website: federal.coffee
Email: iletisim@federal.coffee
Phone: 0212 223 30 55

in accordance with the LPPD and relevant legislation.

2. Personal Data Processed

Depending on your relationship with Federal Coffee and the services you use, the following categories of personal data may be processed:

Identity Information

  • Name
  • Surname
  • Other identity information required for invoicing processes

Contact Information

  • Email address
  • Phone number
  • Delivery address
  • Invoice address

Customer Transaction Information

  • Order details
  • Order history
  • Cart details
  • Products purchased
  • Return and exchange information
  • Request and complaint records

Financial Information

  • Payment and transaction details
  • Information related to invoicing

Payment card information may be processed through the technical infrastructure of the payment service provider and financial institutions used.

Transaction Security and Technical Data

  • IP address
  • Session and transaction records
  • Device and browser information
  • Website usage records
  • Security logs

Marketing Information

  • Commercial electronic message consents
  • Campaign and communication preferences
  • Information related to marketing activities, where explicit consent or relevant legal conditions exist

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

  • Execution of product and service sales processes
  • Receiving, preparing, and managing orders
  • Delivering orders
  • Executing payment transactions
  • Performing invoicing and accounting processes
  • Executing membership and customer account transactions
  • Managing return, exchange, and cancellation processes
  • Responding to customer requests and complaints
  • Executing customer relations and support services
  • Ensuring information security and transaction security
  • Preventing fraud and abuse attempts
  • Fulfilling requests from authorized public institutions and organizations
  • Fulfilling legal obligations
  • Establishing, exercising, or protecting rights in legal disputes
  • Improving website performance and user experience
  • Conducting campaigns, promotions, and commercial electronic message activities, where necessary consents exist

4. Legal Grounds for Processing Personal Data

Your personal data may be processed based on one or more of the following legal grounds set out in Article 5 of the LPPD, depending on the processing activity:

  • Clearly stipulated in laws
  • Directly related to the establishment or performance of a contract
  • Mandatory for the data controller to fulfill its legal obligation
  • Mandatory for the establishment, exercise, or protection of a right
  • Mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
  • Explicit consent of the data subject where required for processing operations

The LPPD Institution emphasizes that the processing purpose and legal ground are separate elements and that the legal ground must be explicitly stated in the clarification.

5. Method of Collecting Personal Data

Your personal data may be obtained through fully or partially automated methods or non-automated methods as part of a data recording system, via:

  • federal.coffee website,
  • order and payment screens,
  • membership and customer account forms,
  • contact forms,
  • email and phone communication,
  • customer services,
  • cookies and similar technologies,
  • payment service providers,
  • cargo and logistics service providers

6. Transfer of Personal Data

Your personal data may be transferred to the following recipient groups to the extent necessary for the performance of services and the achievement of the purposes explained above:

To cargo and logistics service providers:
Necessary information such as name, surname, phone number, and delivery address may be transferred for the purpose of delivering orders to your address.

To payment service providers and financial institutions:
Necessary information may be transferred for the purpose of carrying out payment transactions, returns, and financial processes.

To e-commerce and technical infrastructure service providers:
Necessary information may be transferred for the purpose of operating the website, managing orders, and ensuring technical infrastructure and information security.

To accounting and billing service providers:
Necessary information may be transferred for the purpose of fulfilling financial and legal obligations.

To communication and marketing service providers:
Limited data may be transferred for the purpose of sending emails, SMS, or similar communications, where necessary consents exist.

To legal, audit, and consultancy service providers:
Necessary information may be transferred for the purpose of fulfilling legal obligations and protecting rights.

To authorized public institutions and organizations:
Necessary information may be transferred within the scope of legal obligations or official requests.

Under the LPPD, the recipient groups to which data is transferred and the purposes of transfer must also be specified in the clarification text.

7. Transfer of Personal Data Abroad

Since the systems of some e-commerce, cloud, technical infrastructure, or service providers used within the scope of operating the Federal Coffee website are located abroad, personal data may be transferred abroad.

Data transfer abroad is carried out in accordance with the conditions specified in Article 9 of the LPPD and the relevant secondary legislation.

In 2024, the LPPD's system for transferring data abroad changed. In the current system, in addition to adequacy decisions, standard contractual clauses, binding corporate rules, and other appropriate safeguards can be used. If standard contractual clauses are used, there is also an obligation to notify the Authority.

Let's make a special note here: Since we will be using Shopify, before going live, we will need to check which data Shopify and other applications we use process in which countries and align this clause with Federal's actual international data transfer mechanism.

8. Commercial Electronic Messages

Electronic messages for promotional purposes such as campaigns, discounts, new products, or similar, are sent when the necessary conditions or consents exist in accordance with applicable legislation.

Commercial communication consent is evaluated independently of the legal grounds for processing personal data for other purposes.

Users can change their commercial communication preferences through the relevant communication channels or the preference management methods provided.

9. Retention of Personal Data

Your personal data is retained for the period required by the processing purpose and within the mandatory retention periods stipulated in the relevant legislation.

If the processing purpose and legal ground cease to exist, personal data is deleted, destroyed, or anonymized in accordance with the relevant legislation.

10. Your Rights Under the LPPD

Pursuant to Article 11 of the LPPD, by applying to the data controller, you have the right to:

  • learn whether your personal data is processed,
  • request information if your personal data has been processed,
  • learn the purpose of processing and whether it is used in accordance with its purpose,
  • know the third parties to whom your personal data is transferred domestically or abroad,
  • request the rectification of incomplete or inaccurate personal data,
  • request the deletion or destruction of your personal data if the conditions are met,
  • request that third parties to whom your personal data has been transferred be notified of the rectification, deletion, or destruction operations,
  • object to the emergence of a result against you solely through automatic systems analysis,
  • demand compensation for damages if you suffer damage due to unlawful processing of your personal data

these rights.

11. Application Method

You can submit your requests under the LPPD:

FEDERAL COFFEE INTERNATIONAL GIDA LİMİTED ŞİRKETİ
Cumhuriyet Mah. Arabayolu Cad. No:107/1 Sarıyer / Istanbul

in writing to the address above or

iletisim@federal.coffee

via email address.

Your application must contain information sufficient to identify you and your request.

Applications are evaluated within the procedures and timeframes specified in the LPPD and relevant legislation.