Pursuant to Article 10 of the Law No. 6698 on the Protection of Personal Data (“KVKK”), titled “Obligation of the Data Controller to Inform”, our company BAFURYA GIDA SANAYİ VE TİCARET LİMİTED ŞİRKETİ (“Bafurya”), acting in the capacity of data controller, is obliged to inform data subjects regarding its identity, the purposes of processing personal data, the parties to whom personal data is transferred and the purposes of such transfers, the legal grounds and methods of data collection, and the rights of data subjects listed under Article 11 of the KVKK.

Accordingly, this Information Notice has been prepared to inform you, the data subjects, in accordance with Article 10 of the KVKK.

a. Identity of the Data Controller

Under Article 3/1(ı) of the KVKK, the data controller is defined as “the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.” Furthermore, Article 10/1(a) of the KVKK imposes an obligation to inform data subjects about the identity of the data controller.

In this context, Bafurya, due to the personal data you share with us through this website and other channels, holds the title of “data controller” within the scope of the KVKK.

The identity details of the data controller are as follows:
BAFURYA GIDA SANAYİ VE TİCARET LİMİTED ŞİRKETİ, duly incorporated as a Limited Company in accordance with the laws of the Republic of Türkiye, registered with the Konya Trade Registry Office under registration number 73071, with MERSIS number 0833080607700001, and having its registered office at:

KULUOSB MAH. 139523. SK. NO: 2/1 KULU / KONYA, TÜRKİYE

b. Purposes of Processing Personal Data

All personal data processing activities carried out within Bafurya Gıda are conducted in strict compliance with the general principles set forth in Article 4 of the KVKK. These principles represent the legal reflection of the company’s vision of “World-Class Production.”

The principle of compliance with law and good faith requires that data subjects are not misled during data collection and that all processes remain within legal boundaries. While adopting sustainability principles in its cocoa supply chain, Bafurya Gıda manages related data flows transparently.

In line with the principle of accuracy and, where necessary, being up to date, the data of business partners and employees are periodically verified and updated.

The principle of processing for specific, explicit, and legitimate purposes requires Bafurya Gıda to determine its data processing purposes in advance. Accordingly, the company processes personal data for concrete purposes such as managing the sales processes of cocoa powder, cocoa butter, and cocoa liquor, documenting quality control processes, and fulfilling occupational health and safety obligations.

The principle of being relevant, limited, and proportionate to the purposes for which data is processed—also known as “data minimization”—means that only necessary data is collected. For example, visitors entering the factory are required to provide only the identification information necessary for security purposes.

The principle of retention for the period stipulated by relevant legislation or necessary for the purpose of processing dictates that data cannot be stored indefinitely. Bafurya Gıda implements a data retention and destruction schedule based on limitation periods set forth under the Turkish Commercial Code and the Tax Procedure Law (10 years), as well as retention periods prescribed by labor legislation.

Personal data is processed not only for collection purposes but also to enhance production quality and operational efficiency, in line with the company’s corporate policies and legal obligations.

Your personal data is processed in accordance with the personal data processing conditions set forth in Articles 5 and 6 of the KVKK and in compliance with the principles stated in Article 4. All data processing activities carried out by Bafurya are conducted in accordance with the KVKK and all applicable legislation.

Your personal data may be processed for the following purposes:

• Ensuring that you benefit from the products and services offered by our Company,
• Customizing and recommending products and services in line with your preferences, usage habits, and needs,
• Ensuring the legal and commercial security of our Company and persons in business relations with our Company,
• Determining and implementing our Company’s commercial and business strategies.

You may access detailed information regarding the processing purposes of your personal data via bafurya.com/tr or within the Personal Data Processing and Protection Policy of BAFURYA.

c. Transfer of Personal Data

Your collected personal data may be transferred, in line with the purposes stated above, to our business partners, suppliers, shareholders, legally authorized public institutions, and private parties, within the scope of Articles 8 and 9 of the KVKK and limited to the purposes specified in the Personal Data Processing and Protection Policy available at bafurya.com/tr.

d. Method and Legal Basis for Collecting Personal Data

Your personal data is collected by Bafurya through various channels, including but not limited to:

• Registrations made via our website,
• Forms completed in our sales points and other locations,
• Contracts concluded with our Company,

in accordance with applicable laws.

Your data is processed based on the legal grounds set forth in Articles 5 and 6 of the KVKK, including:

• Explicit provision by law,
• Necessity for the establishment or performance of a contract,
• Fulfillment of the Company’s legal obligations,
• Necessity for the legitimate interests of the Company, provided that fundamental rights and freedoms are not harmed,
• Your explicit consent.

Data collection is carried out through both digital and physical channels:

Electronic Channels: Corporate website (bafurya.com), contact forms, email correspondence, call center (0850 304 33 78), and B2B platforms.
Physical Channels: Visitor logs at factory entrances, job application forms, signature circulars, delivery notes, and closed-circuit camera systems (CCTV).

e. Rights of the Data Subject

As data subjects, you may submit your requests regarding your rights through the methods specified in the Personal Data Processing and Protection Policy available at bafurya.com/tr.

Bafurya will finalize your request as soon as possible and within a maximum of thirty (30) days, free of charge. However, if the process requires additional cost, fees determined by the Personal Data Protection Board may apply.

Pursuant to Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing and whether it is used in accordance with its purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction of incomplete or inaccurate data and notification of such correction to third parties,
• To request deletion or destruction of personal data and notification of such action to third parties,
• To object to adverse results arising from automated processing,
• To request compensation for damages in case of unlawful processing.

You may submit your requests in writing in Turkish or via registered electronic mail (KEP), secure electronic signature, mobile signature, or through your registered email address in accordance with Article 13 of the KVKK and the Communiqué on the Principles and Procedures for Application to the Data Controller dated 10.03.2018 and numbered 30356.

Applications must include:

• Name, surname, and signature (if written),
• Turkish ID number (or passport/ID details for foreigners),
• Address for notification,
• Email, phone, and fax (if available),
• Subject of the request,
• Supporting documents, if any.

Written applications may be submitted to our registered address:

KULUOSB MAH. 139523. SK. NO: 2/1 KULU / KONYA, TÜRKİYE

Email applications may be sent to: [email protected]

Only information relating to the applicant will be provided; information about third parties cannot be shared. The Company reserves the right to verify identity before responding.

Incomplete or inaccurate applications may result in delays or inability to process the request. Therefore, all required information and documents must be submitted completely and accurately.

Bafurya Gıda Sanayi ve Ticaret Limited Şirketi, in its journey of delivering quality from Konya Kulu to the world, treats the personal data of its stakeholders as entrusted assets and fulfills the requirements of modern legal frameworks with this awareness.