Clarification Text

[ Effective Date: 27.07.2026 ]

Introduction:

This disclosure text has been prepared, pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), by our Company in its capacity as Data Controller, within the framework of Article 10 titled "Data Controller's Obligation to Inform" and Article 11 titled "Rights of the Data Subject," in order to fulfill our legal obligation regarding the purposes for which your personal data will be processed, to whom and for what purpose your processed personal data may be transferred, the method and legal basis of collecting your personal data, and your other rights listed in Article 11 of the KVKK.

Definitions:

Explicit consent: Consent relating to a specific matter, based on being informed, and declared with free will.
Anonymization: Rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even when matched with other data.
Personal Data Subject: Website Visitor.
KVKK: Law No. 6698 on the Protection of Personal Data.
Recording Medium: Any medium containing personal data processed wholly or partly by automated means, or by non-automated means provided that they form part of a data recording system.
Destruction: The deletion, destruction, or anonymization of personal data.
Personal data: Any information relating to an identified or identifiable natural person.
Processing of personal data: Any operation performed on personal data, such as collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or prevention of use, whether wholly or partly by automated means or by non-automated means provided that they form part of a data recording system.
Anonymization of Personal Data: Rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even when matched with other data.
Deletion of personal data: Rendering personal data inaccessible and unusable in any way for Relevant Users.
Destruction of Personal Data: The process of rendering personal data inaccessible, unrecoverable, and unusable by anyone in any way.
Special Category Personal Data: Data relating to persons' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data.
Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
Company: Refers to Guzzi Coffee & Croissant.

Data Controller:

Your personal data may be processed within the purpose and scope described in this disclosure text by Guzzi Coffee & Croissant, located at Cumhuriyet Mah. Mehmet Gözaçan Cad. No:5 C Beşikdüzü / Trabzon, acting as the data controller (hereinafter referred to as "Guzzi Coffee").

Within the scope of applicable legislation, as the data controller, we take the necessary technical and administrative measures to ensure an appropriate level of security in order to process personal data lawfully, prevent unlawful access to data, and ensure the safekeeping of personal data.

Categories of Personal Data Processed:

Identity: Name, surname, title.
Contact: Phone number, address information, e-mail address.
Transaction Security Data: IP addresses, log records, username, password and passcode information.

Purpose of Processing Your Data:

The personal data of our website visitors is processed for purposes including, but not limited to;

Carrying out communication activities,
Responding to your information requests,
Creating and resolving your complaints,
Receiving your job applications,
Providing information regarding our products and services,
Fulfilling obligations arising primarily from the Turkish Code of Obligations, the Turkish Commercial Code, and other relevant laws,
Providing information to public officials upon request and as required by legislation regarding matters relating to public security,
Fulfilling legal obligations and exercising rights arising from applicable legislation,
Fulfilling legal obligations where a competent authority requests and a response is mandatory within the scope of judicial and administrative investigations,

Primarily for the above purposes; your personal data may, within the personal data processing conditions and purposes set out in Articles 5 and 6 of the KVKK, in a manner connected, limited, and proportionate to the purpose of processing, in compliance with the law and the principle of good faith, be collected, recorded, retained, updated in order to continue the provision of services, reorganized, and — where and to the extent permitted by legislation — disclosed, transferred, assigned, and shared with third parties, and processed in other ways permitted by law, with the necessary administrative and technical measures being taken.

Your personal data may be processed while preserving its accuracy and being kept up to date as notified by you or as otherwise notified, and may be retained for the maximum period stipulated in the relevant legislation or required for the purpose for which it is processed, and in any case for the statutory limitation periods.

Method and Legal Basis of Collecting Your Personal Data:

Your personal data is collected through your electronic completion of the information requested on the various forms/screens presented to you on our website at guzzicoffee.com.

Your personal data collected through the methods stated above is processed within the framework of the purposes set out in this disclosure text, in cases where: pursuant to Article 5/2-c of the KVKK, it is necessary for the processing of personal data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract; pursuant to Article 5/2-ç, it is mandatory for the data controller to fulfill its legal obligation; pursuant to Article 5/2-e (referred to as 5/e above), data processing is mandatory for the establishment, exercise, or protection of a right; and pursuant to Article 5/2-f, data processing is mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject.

Persons/Institutions to Whom Personal Data May Be Transferred for the Purposes Stated Above:

Our Company may transfer your personal data — subject to obtaining the explicit consent of the data subject, or in other cases provided for in Article 5/2-f of the KVKK, and by taking all technical and administrative measures in accordance with the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVKK — within the scope of the purposes stated above, to authorized public institutions and organizations, to companies and affiliates of Guzzi Coffee & Croissant, and to other third parties.

Transfer Abroad:

Personal data is transferred abroad in light of the principles set out in Article 4/2 of the KVKK, either by obtaining explicit consent, or, where the circumstances set out in Articles 5/2 and 6/3 exist, without obtaining explicit consent, and in other cases by obtaining the explicit consent of the data subject in accordance with Article 9 of the KVKK. However, where the conditions permitting the processing of personal data — including special category personal data — without the explicit consent of the data subject exist, our Company may also transfer personal data abroad without seeking the explicit consent of the data subject, provided that adequate protection exists in the foreign country to which the personal data will be transferred.

Because the headquarters and data storage locations of the video and voice messaging services and e-mail service providers used within the scope of the Company's communication activities are located abroad, data is transferred abroad by obtaining the explicit consent of the data subject in accordance with Article 9 of the KVKK.

Furthermore, where your personal data is shared for the purposes listed above on our corporate social media accounts or our website, it is transferred abroad — because the headquarters and data storage locations of these are located abroad — by obtaining the explicit consent of the data subject in accordance with Article 9 of the KVKK.

Retention Period and Deletion of Personal Data:

Your personal data is retained in accordance with the KVKK and for the periods specified in the relevant laws. At the end of these periods, it will be deleted, destroyed, and/or anonymized pursuant to the relevant legislation. Personal data whose retention period has ended is destroyed in 6-month periods. As the Data Subject, you may withdraw your consent to the processing of your data at any time.

Your Rights Under Article 11 of the KVKK:

Pursuant to Article 11 of the KVKK, by applying in writing, you have the right to;

1. Learn whether your personal data is being processed,
2. Request information regarding your personal data if it has been processed,
3. Learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
4. Know the third parties to whom your personal data is transferred, domestically or abroad,
5. Request the correction of your personal data if it has been processed incompletely or incorrectly, and request that the transactions made in this regard be notified to third parties to whom the data has been transferred,
6. Request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the Law,
7. Request that the transactions made pursuant to items (d) and (e) above be notified to third parties to whom your personal data has been transferred,
8. Object to the emergence of a result against you by means of the analysis of your personal data exclusively through automated systems,
9. Request compensation for damages in the event that you suffer damage due to the unlawful processing of your personal data.

You must complete the application form found on Guzzi Coffee's website in a clear and understandable manner, attach documents verifying your identity and address information, and deliver it in writing with a wet signature — in person, by mail, or through a notary — to Cumhuriyet Mah. Mehmet Gözaçan Cad. No:5 C Beşikdüzü / Trabzon, or send it, signed with a "secure electronic signature," via Registered Electronic Mail (KEP), writing "Personal Data Protection Law Information Request" in the subject line of the e-mail, to hello@guzzicoffee.com. Depending on the nature of your request and your application method, Guzzi Coffee may request additional information from you in order to determine whether the application belongs to you and thereby protect your rights.

Applications made within this scope will be concluded as soon as possible and within a maximum of 30 days.