KVKK Data Protection Notice

1. Data Controller

Your personal data is processed by the following legal entity acting as data controller:

• Registered Name: EBSM Et Balık Satış Mağazaları Sanayi ve Ticaret Anonim Şirketi
• Brand: iyikurban (iyikurban.com)
• Address: Osmanağa Mahallesi, Söğütlüçeşme Caddesi, Mutlu Çiçeğim Apt. No: 96-98A, Kadıköy / İstanbul
• MERSİS No: 0381076257100001
• Email: iletisim@iyikurban.com
• Phone: +90 216 550 35 35

2. Personal Data Processed

The following categories of personal data may be processed as part of your use of our services:

• Identity data: first name, last name.
• Contact data: phone number, email address, delivery and billing address.
• Customer transaction data: order records, cart contents, request and complaint records.
• Payment data: payment transactions are processed through a licensed payment institution (e.g. iyzico); your card details are not stored by us.
• Wakalah/proxy data: the full names of individuals on whose behalf a sacrificial animal is to be slaughtered (see Section 8 below).
• Transaction security data: IP address, session and login records, data collected via cookies.

3. Purposes and Legal Bases for Processing

Your personal data is processed for the following purposes and on the following legal bases under Articles 5 and 6 of KVKK:

• Creating your membership, receiving your order, and fulfilling the Adak/Qurbani and wakalah service — necessary for the establishment or performance of a contract (Art. 5/2-c).
• Issuing invoices and fulfilling accounting and tax obligations — compliance with a legal obligation (Art. 5/2-ç).
• Responding to requests, questions, and complaints, and improving service quality — legitimate interest (Art. 5/2-f).
• Sending commercial electronic messages (campaigns/announcements) and carrying out marketing activities — explicit consent (Art. 5/1). This processing is carried out only if you separately give your consent, which you may withdraw at any time. Commercial electronic messages are additionally managed via the Message Management System (İYS) under Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages; you may also withdraw your consent through İYS.

4. Transfer of Personal Data

Your personal data may be transferred, limited to the fulfilment of the purposes above and in accordance with Article 8 of KVKK, to payment institutions, shipping/logistics companies, suppliers providing slaughter and event services, IT and hosting service providers, and legally authorised public institutions and organisations.

5. International Transfers

The platform's technical infrastructure is operated through cloud-based service providers whose servers are located abroad. Accordingly, your personal data is transferred abroad, limited to the provision of the relevant service, to the following recipient groups:

• Hosting and application infrastructure providers (web and application servers) — European Union (Germany);
• Database service provider — European Union (Germany);
• Content delivery network (CDN) and file/document storage provider — European Union;
• Email delivery service provider (order and invoice notifications) — United States;
• Error monitoring and technical logging service provider (personal data is masked/anonymised before transmission).

SMS delivery and payment services are carried out through providers established in Türkiye (İleti Merkezi and iyzico respectively); therefore no international transfer is made for these services.

These transfers are carried out on the basis of your explicit consent under Article 9 of Law No. 6698. Your explicit consent is obtained through a separate consent notice, distinct from this disclosure text, and may be withdrawn at any time.

6. How Personal Data is Collected

Your personal data is collected through membership and order forms on iyikurban.com, communication channels (email, phone, contact form), and cookies during your use of the platform, by automated and partly automated electronic means.

7. Retention Period

Your personal data is retained for as long as required by the processing purpose and by the limitation and retention periods set out in applicable legislation; upon expiry of those periods it is deleted, destroyed, or anonymised. Certain data such as financial records is retained for the statutory period required by the relevant legislation.

8. Third-Party Data Under Wakalah

Given the nature of the Adak/Qurbani service, you provide us with the full names of the individuals on whose behalf the animal is to be slaughtered when placing your order. This information is processed solely for the purpose of performing the wakalah/proxy mandate, organising the slaughter, and fulfilling the religious obligation.

When sharing data relating to these individuals, you are responsible for informing them and, where required, obtaining their consent. iyikurban will not use this data for any purpose other than those stated or share it with third parties.

9. Your Rights as Data Subject

Under Article 11 of KVKK, you have the following rights by applying to the data controller:

• To learn whether your personal data is being processed,
• To request information about the processing if it is,
• To learn the purpose of processing and whether it is used in accordance with that purpose,
• To know the third parties to whom your data has been transferred, domestically or abroad,
• To request correction if your data is incomplete or inaccurately processed,
• To request deletion or destruction of your data within the conditions set out in KVKK,
• To request that correction, deletion, and destruction be notified to the third parties to whom the data has been transferred,
• To object to a result arising to your detriment from analysis of the processed data exclusively through automated systems,
• To claim compensation for damages suffered due to unlawful processing of your data.

10. How to Submit a Request

You may submit requests relating to the above rights, together with information verifying your identity, in writing to the address above or via ebsm@hs1.kep.tr / iletisim@iyikurban.com. Requests will be finalised as soon as possible and within thirty (30) days at the latest, depending on their nature.