KVKK Privacy Notice

Privacy Notice on the Protection of Personal Data

Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, we, Ülker Sofuoğlu (the "Data Controller"), in our capacity as data controller, process the personal data we obtain through the ulkersofuoglu.com website, our sales stores and our communication channels within the scope described below.

1. Data controller

• Trade name: Ülker Sofuoğlu
• Address: Rumeli Hisarüstü Mah., Bebek Yolu Sk., Sümer Apt. No:1 D:1, 34075 Sarıyer / İstanbul
• London office: ULKER SOFUOGLU GLOBAL LIMITED, 24-26 Arcadia Avenue, Fin009/16118, London, United Kingdom, N3 2JU
• Phone: 0 532 156 15 73
• E-mail: satis@ulkersofuoglu.com · info@ulkersofuoglu.com

2. Personal data processed

• Identity: first name, surname; for corporate purchases, the name of the authorised person; where required for invoicing, Turkish national identity number (T.C. Kimlik No.)
• Contact: e-mail address, telephone number, delivery and billing address
• Customer transactions: membership, order, basket, favourites, payment notification and return / exchange information, requests and complaints, order notes, gift notes
• Finance: invoice details; for corporate purchases, company name, tax office and tax number; bank transfer / EFT details. Your credit card details are neither seen nor stored by us; payment is made on the secure page of the licensed payment institution.
• Transaction security: IP address, browser and device information, session and login records, your password (stored in irreversibly encrypted form)
• Marketing: only if you give your consent, newsletter / campaign preferences, personalised coupon codes and their usage, shopping preferences
• Visual / audio: photographs you voluntarily share in your correspondence with customer services (e.g. an image of a returned product)

Special categories of personal data such as health, religion or race are neither requested nor processed; please do not include such information in your order notes or messages. Our website is not intended for persons under the age of 18.

3. Method of collection and legal grounds

Your personal data are collected electronically, by automated or partly automated means, through the membership, order, payment notification, contact and return forms on our website, cookies, e-mail, telephone, WhatsApp and social media channels, and from the marketplaces through which you place your order (Trendyol, Hepsiburada, n11, Çiçeksepeti, PttAVM, İdefix, Amazon, Pazarama, OZON).

• Establishment and performance of a contract (KVKK Art. 5/2-c): membership, orders, payment, delivery, returns and customer services
• Legal obligation (Art. 5/2-ç): invoicing, accounting and tax records, distance sales records, provision of information to competent authorities
• Being expressly provided for by law (Art. 5/2-a): Law No. 6502 on Consumer Protection, Turkish Tax Procedure Law No. 213, Turkish Commercial Code No. 6102, Law No. 6563 on the Regulation of Electronic Commerce
• Establishment, exercise or protection of a right (Art. 5/2-e): resolution of disputes and complaints
• Legitimate interest (Art. 5/2-f): website security, fraud prevention, measurement of service quality
• Explicit consent (Art. 5/1): campaign, coupon, special occasion and newsletter mailings, non-essential (analytics / marketing) cookies and transfers abroad to service providers through these cookies

4. Purposes of processing

• Creating and managing your membership account
• Receiving orders and carrying out payment, invoicing (e-Archive / e-Invoice), shipping and delivery processes
• Managing withdrawal, return, exchange, customer support and complaint processes
• Sending order, shipping, password and account notification e-mails
• Fulfilling legal retention, notification and audit obligations
• Ensuring information security and preventing fraud
• Sending personalised coupon, campaign, special occasion and newsletter e-mails, if you have given your consent

5. Transfer

Your personal data may be transferred, only for the purposes above and to the extent necessary, to the following groups of recipients:

• Courier companies: first name, surname, address and telephone number for delivery
• Payment institutions and banks (e.g. iyzico, PayTR, Tami, Pay'nKolay): collection and refund of payments
• E-invoice / e-archive integrators and accounting service providers (e.g. BirFatura): invoicing
• Marketplaces: processing of the orders you place through the relevant marketplace
• Hosting, e-mail and software service providers: operation of the website and e-mails
• Legally authorised public institutions and organisations and judicial authorities: upon request and to the extent permitted by law

6. Transfer abroad

Our website is exclusively for sales within Türkiye. Your personal data relating to orders placed through our website and our marketplace stores in Türkiye are not transferred abroad; they are processed in Türkiye.

Our customers abroad can buy our products only from our store on the Amazon UK marketplace. Only the personal data relating to these orders (first name, surname, delivery address, contact and order details) are shared with Amazon UK and our office in the United Kingdom, ULKER SOFUOGLU GLOBAL LIMITED, for the purposes of delivering and invoicing the order and providing customer services, and are processed in the United Kingdom. This transfer is carried out pursuant to KVKK Art. 9, on the grounds that it is necessary for the performance of the contract and subject to appropriate safeguards such as the standard contract determined by the Personal Data Protection Authority. Other than this, your personal data are not shared with third parties abroad.

If you consent to non-essential analytics / advertising cookies, the information collected through these cookies may be processed on servers abroad belonging to the cookie service providers; in this case the transfer is based on your explicit consent, which you can withdraw at any time via Cookie Preferences. Details can be found in the Cookie Policy.

7. Retention period

• Invoice, accounting and commercial book records: 10 years from the year following the relevant year (Turkish Tax Procedure Law, Turkish Commercial Code)
• Distance sales contracts and order records: at least 3 years (Distance Contracts Regulation) and, in the event of a dispute, throughout the limitation period
• Records of consent to and refusal of commercial electronic messages: 3 years from the date on which consent is withdrawn
• Membership information: for as long as the membership continues; after the membership ends, for the statutory periods
• Transaction security records: for the period stipulated in the relevant legislation (maximum 2 years)

When the period expires, your data are erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

8. Security

The necessary technical and administrative measures are taken under KVKK Art. 12 to ensure the security of your data; these include SSL encryption on the website, storage of passwords in irreversible form, authorisation-based access to the administration panel, regular backups and logging.

9. Commercial electronic messages and withdrawal of consent

Campaign, coupon and special occasion e-mails are sent only if you have given your consent. You may withdraw your consent at any time, without giving reasons and free of charge, via the "unsubscribe" link in every e-mail, the preference box on the My Account → My Details page, or by writing to satis@ulkersofuoglu.com. Order, shipping and account notification e-mails are not affected by this preference. Details about cookies can be found in the Cookie Policy.

10. Your rights (KVKK Art. 11)

By applying to the Data Controller, you have the right to:

• learn whether your personal data are processed,
• request information in this regard if they have been processed,
• learn the purpose of processing and whether the data are used in line with that purpose,
• know the third parties in Türkiye or abroad to whom the data have been transferred,
• request their correction if they have been processed incompletely or inaccurately,
• request their erasure or destruction under the conditions set out in KVKK Art. 7,
• request that the correction, erasure and destruction be notified to the third parties to whom the data have been transferred,
• object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
• claim compensation for any damage you suffer as a result of unlawful processing.

These rights are granted to you under KVKK Art. 11.

11. Method of application

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests to our address above in writing (a petition bearing your wet signature), by registered electronic mail (KEP), with a secure electronic signature or mobile signature, or by e-mail to satis@ulkersofuoglu.com from the e-mail address registered in our system.

Your application must include your first name and surname, your signature if the application is made in writing, your Turkish national identity number (or, for foreign nationals, your nationality and passport or identity number), your residential or business address for service of notices, your e-mail address for notifications (if any), your telephone number and the subject of your request.

Your application will be concluded free of charge within 30 days at the latest, depending on its nature; if the procedure entails an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, if you find the response insufficient or if no response is given in due time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in any event, within 60 days of the date of application.

Last updated: 18.10.2026