Effective: April 20, 2026
This notice is issued under the Turkish Personal Data Protection Law (KVKK, No. 6698) and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Data Controller
- Fatih Mehmet Kaya — Academy Coffee
- Sultantepe Mah., Selmani Pak Cad., Ekşioğlu Apt. No: 63/H, Apt. 11, 34672 Üsküdar/Istanbul
- Tax Office / No: Üsküdar — 5310806742
- hello@academyroastery.com
2. Data We Process
- Identity and contact: name, email, phone, delivery and billing address.
- Order data: products, quantities, invoice records.
- Payment data: processed by iyzico; card numbers are not stored by us.
- Technical data: IP, browser, device, session identifier.
- Communications sent through forms or email.
3. Purposes and Legal Basis
Processing is based on KVKK Art. 5 and GDPR Art. 6:
- Performance of a contract: account, order, payment, shipment, invoice.
- Legal obligation: tax, accounting and consumer-law records.
- Legitimate interest: platform security and fraud prevention.
- Explicit consent: newsletter and optional analytics cookies.
4. Processors
- iyzico Ödeme Hizmetleri A.Ş. — Ödeme altyapısı (region: Türkiye)
- Vercel Inc. — Barındırma ve CDN (region: AB (Frankfurt))
- Supabase Inc. — Oturum ve veri depolama (region: AB (Frankfurt))
- Sanity.io — İçerik yönetimi (region: AB (İrlanda))
- Functional Software, Inc. (Sentry) — Hata izleme (region: AB (Frankfurt))
- Vercel Analytics — Anonim ziyaretçi ölçümü (region: AB)
- Cloudflare, Inc. — Form bot koruması (Turnstile) (region: Global)
Cross-border transfers rely on standard contractual clauses and equivalent safeguards.
5. Retention
- Order and invoice records: 10 years (VUK Art. 253).
- Account data: while the account is active, plus 3 years.
- Communications: 3 years from last interaction.
- Security logs: 90 days.
- Marketing consent: until withdrawn.
6. Your Rights
Under KVKK Art. 11 and GDPR Art. 15–22 you may:
- learn whether your data is processed;
- request information on the processing;
- learn the purpose and whether it is used accordingly;
- know third parties to whom the data is transferred;
- request correction, erasure or anonymisation;
- object to automated decisions affecting you;
- claim compensation for unlawful-processing damage;
- withdraw consent at any time;
- lodge a complaint with the KVKK Board (or your EEA supervisory authority).
7. Contact
Applications are submitted in Turkish or English to hello@academyroastery.com or by post to the registered address above. Formal KVKK applications follow the template published by the Personal Data Protection Authority. We respond within 30 days.