Mama Ram Spice & Tea Shop · www.mamaram.com

Last updated: 01 August 2026
Effective date: 01 August 2026

1. IDENTITY OF THE DATA CONTROLLER

Pursuant to Turkish Personal Data Protection Law No. 6698 (the “KVKK” or the “Law”), your personal data is processed by our company, whose details are provided below, in its capacity as data controller.

Registered Business Name
DEVRİM KARAGÖZ MAMA RAM GIDA

Brand
Mama Ram Spice & Tea Shop

Address
CAFERAĞA MAH. BADEMALTI SOK. 20/B MODA — KADIKÖY / İSTANBUL, TÜRKİYE

MERSİS No.
4833426624200001

Trade Registry No.
190556-5

Tax Office / Tax No.
KADIKÖY VERGİ DAİRESİ / 5100159804

Email
info@mamaram.com

Telephone
0 545 338 7467

Website
www.mamaram.com

This notice has been prepared to fulfil our disclosure obligation under Article 10 of the Law and the Communiqué on the Procedures and Principles to Be Followed in Fulfilment of the Obligation to Inform, in relation to personal data obtained through the www.mamaram.com website (the “Site”), our physical shop, our corporate/wholesale (B2B) sales processes and our communication channels.

2. CATEGORIES OF PERSONAL DATA PROCESSED

Depending on the nature of your relationship with us, the following categories of personal data may be processed:

a) Identity Data: First name, surname and, where required for issuing an invoice, Turkish Republic identity number or tax identification number.

b) Contact Data: Mobile telephone number, email address, delivery and billing addresses, and country/city/district information.

c) Customer Transaction Data: Order number and contents, order date, shopping basket information, return and exchange requests, shipment tracking information, request and complaint records, user account information, and loyalty programme membership and points information.

d) Financial Data: Invoice information, payment amount, payment method, IBAN and first-name/surname information in the case of a bank transfer, and records relating to refunds.

Your credit card number, expiry date and CVC/CVV information are never viewed, recorded or stored by us at any stage (see Section 9).

e) Transaction Security Data: IP address, access and exit logs, session information, the encrypted (hashed) form of the user account password, and device and browser information.

f) Marketing Data: Browsing and purchasing behaviour data obtained through cookies, email newsletter subscription information, campaign and survey responses, and segmentation information based on your explicit consent.

g) Visual Recording Data: CCTV footage recorded for security purposes at our physical shop.

h) Legal Transaction Data: Correspondence and case-file records maintained in the event of a dispute.

i) Corporate/Wholesale (B2B) Customer Representative Data: The representative’s first name, surname, job title and corporate contact details.

We do not request special categories of personal data through our Site, such as data concerning health, religion, race or biometric information. We strongly ask that you do not enter such data in order notes, contact forms or similar free-text fields.

3. METHOD OF COLLECTING PERSONAL DATA

Your personal data is collected when you:

• create an account, place an order, or complete a contact or return form through the Site;

• subscribe to our email newsletter;

• shop at our physical store or join our loyalty programme;

• contact us by email, telephone, WhatsApp or through our social media accounts;

• share information as part of corporate/wholesale sales discussions; or

• visit the Site, through cookies and similar technologies.

Personal data is collected wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system.

4. PURPOSES AND LEGAL GROUNDS FOR PROCESSING

Your personal data is processed in accordance with the general principles set out in Article 4 of the Law and on the basis of one of the processing conditions specified in Article 5, for the purposes described below.

4.1. Processing necessary for the establishment or performance of a contract (Article 5/2-c of the KVKK)

• Receiving, preparing, packaging and dispatching your order

• Processing and verifying payments

• Creating and managing your user account

• Managing withdrawal, return, exchange and defective-product procedures

• Providing order-status, shipment and delivery notifications (these notifications are not commercial electronic communications)

• Establishing and performing corporate/wholesale sales contracts

• Responding to customer requests and complaints

4.2. Processing necessary for compliance with our legal obligations (Article 5/2-ç of the KVKK)

• Issuing invoices and maintaining accounting and statutory book records pursuant to Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102

• Fulfilling obligations under Consumer Protection Law No. 6502 and the Regulation on Distance Contracts

• Complying with record-keeping and retention obligations under Law No. 6563 on the Regulation of Electronic Commerce and the relevant legislation

• Retaining traffic data (log records) under Law No. 5651

• Responding to lawful requests from authorised public institutions and authorities

4.3. Processing necessary for our legitimate interests (Article 5/2-f of the KVKK)

Where we rely on this legal ground, we ensure that the processing does not prejudice your fundamental rights and freedoms.

• Ensuring the security of the Site and our information systems, and preventing fraud and misuse

• Measuring and improving the quality of the Site and our services, solely within the scope of strictly necessary and functional cookies

• Conducting corporate communications and supply/logistics processes

• Ensuring the security of our physical shop through CCTV recordings

4.4. Processing necessary for the establishment, exercise or protection of a right (Article 5/2-e of the KVKK)

• Retaining transaction and correspondence records for use as evidence in potential disputes

4.5. Processing based on your explicit consent (Article 5/1 of the KVKK)

The following activities are carried out only where you have given separate and explicit consent. Refusing consent does not prevent you from using our products and services.

• Sending commercial electronic communications to you, including email, SMS and instant notifications

• Processing data through non-essential cookies, including analytics, performance, targeting and advertising cookies

• Conducting personalised campaigns, recommendations and segmentation based on your purchase history

• Sharing your data with business partners for advertising and marketing activities

You may withdraw your explicit consent at any time without giving a reason. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

5. TRANSFER OF PERSONAL DATA WITHIN TÜRKİYE

In accordance with the conditions set out in Article 8 of the Law, and solely for the purposes specified above, your personal data may be transferred to the following recipient groups:

Recipient groupPurpose of transfer

Courier and logistics companiesDelivery of orders

Payment institutions and banks, including iyzicoProcessing and verification of payments

Financial adviser / accounting service providerCompliance with statutory bookkeeping and invoicing obligations

E-invoice / e-archive integratorIssuing and delivering invoices

Information technology and infrastructure service providersOperation of the Site and technical support

Legal, audit and consultancy service providersConducting legal processes

Authorised public institutions and authoritiesCompliance with statutory obligations

Your data is not sold, rented or otherwise transferred for commercial purposes to any third party for purposes other than those described in this notice.

6. TRANSFER OF PERSONAL DATA ABROAD

Some of the service providers we use to operate the Site and conduct our marketing activities have servers located outside Türkiye. Your personal data may therefore be transferred abroad within the scope of Article 9 of the Law.

Types of services involving international transfers include:

• Website infrastructure and hosting services (Wix.com Ltd.)

• Email and office infrastructure services

• Email marketing and newsletter distribution platforms

• Measurement and analytics services, only where you have given explicit consent

• Social media advertising platforms, only where you have given explicit consent

Legal basis for the transfer:

Where these transfers are made to countries covered by an adequacy decision issued by the Personal Data Protection Board, they are carried out pursuant to Article 9/1 of the Law. Otherwise, they are carried out pursuant to Article 9/2 of the Law, subject to one of the appropriate safeguards, such as the standard contract published by the Board or binding corporate rules. Executed standard contracts are notified to the Turkish Personal Data Protection Authority within five business days of the date of execution.

For occasional transfers that are not continuous in nature, the exceptions under Article 9/6 of the Law may be relied upon.

You may request an up-to-date list of the service providers to which data is transferred abroad, together with detailed information on the legal basis for such transfers, by contacting us at info@mamaram.com.

7. RETENTION PERIODS FOR PERSONAL DATA

Your personal data is retained for as long as required by the purpose of processing and for at least the periods prescribed by the relevant legislation:

Data / ProcessRetention period

Order, invoice and accounting records5 years under the Tax Procedure Law; 10 years under the Turkish Commercial Code

Membership account dataFor the duration of the membership and for 10 years after termination of membership, corresponding to the limitation period

Request, complaint and communication records3 years from the date of the record

Commercial electronic communication consent records1 year after withdrawal of consent; records relating to the communication are retained for 3 years under Law No. 6563 and the relevant Regulation

Traffic data (log records)For the period prescribed by Law No. 5651 and the relevant regulation

Shop CCTV recordings30 days

Cookie dataAs specified separately for each type of cookie in the Cookie Policy

Personal data whose retention period has expired is erased, destroyed or anonymised during the first periodic destruction cycle in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

8. COMMERCIAL ELECTRONIC COMMUNICATIONS

• Your separate prior consent is obtained under Law No. 6563 before commercial electronic communications, such as campaign, discount or new-product announcements, are sent to you. This consent is not a prerequisite for placing an order or creating an account.

• Your consent records are registered with the Commercial Electronic Message Management System (İleti Yönetim Sistemi — İYS). You may view and change your consent status at any time through iys.org.tr.

• Every commercial electronic communication provides a free and straightforward opt-out method. Your opt-out request will be implemented within three business days of receipt.

• Order confirmation, shipment and delivery notifications are not considered commercial electronic communications and will therefore continue to be sent even if you exercise your right to opt out.

9. PAYMENT TRANSACTIONS AND FINANCIAL SECURITY

• All payment transactions on the Site are processed through the infrastructure of iyzico, a licensed payment service provider.

• Your credit card number, expiry date and CVC/CVV information are never transmitted to us; they are processed directly through the payment institution’s and bank’s infrastructure. Our company cannot view, record, copy or store this information.

• Data transmitted through payment pages and throughout the Site is protected using TLS (SSL) encryption.

• In relation to the processing of card data, the payment institution is subject to PCI DSS standards and acts as an independent data controller under its own privacy policy.

• If you choose to pay by bank transfer/EFT, your first name, surname and IBAN are processed for the purpose of matching the payment to your order.

10. LOYALTY PROGRAMME (LOYAL TEA CLUB)

• As part of your loyalty programme membership, your first name, surname, contact details, purchase records and points records are processed. This processing is based on the legal ground that it is necessary for the performance of the membership agreement under Article 5/2-c.

• Your separate explicit consent is obtained before personalised campaigns and recommendations based on your purchase history are sent to you.

• Your membership account is personal to you. To prevent third-party use, identity verification is applied when transactions are carried out through your loyalty account, for example by means of a one-time SMS verification code, account login or QR-code scan. Merely providing a telephone number or membership number is not considered sufficient to complete a transaction.

• You may terminate your loyalty programme membership at any time.

11. COOKIES

The Site uses strictly necessary, functional, analytics and marketing cookies.

• Strictly necessary cookies are required for the Site to function and do not require explicit consent.

• Analytics and marketing cookies are activated only if you consent through the cookie notice. Refusing these cookies does not prevent you from using the Site.

• You may change your cookie preferences at any time through the cookie settings panel on the Site or through your browser settings.

Please refer to our Cookie Policy for information on the types, purposes and duration of the cookies used.

12. DATA SECURITY MEASURES

Pursuant to Article 12 of the Law, appropriate technical and organisational measures are implemented in line with the guidelines published by the Board to ensure an appropriate level of security, prevent unlawful processing of and access to your personal data, and safeguard that data.

Technical measures: TLS/SSL encryption, up-to-date security software, authorisation matrices and access controls, a strong password policy, log recording, regular backups, and monitoring of security updates.

Organisational measures: A personal data processing inventory, a retention and destruction policy, employee confidentiality undertakings, data security clauses in agreements with data processors, and awareness training.

If personal data is unlawfully obtained by third parties, the incident is reported to the Personal Data Protection Board as soon as possible and, in all cases, within 72 hours; affected data subjects are notified within a reasonably prompt period.

13. USER RESPONSIBILITIES

• You are responsible for maintaining the confidentiality of your account password and for transactions carried out through your account. Do not share your password with third parties.

• Information you share in public areas, such as product reviews, may be visible to other users. We recommend that you do not share personal information in these areas.

• Third-party links on the Site, including social media and map services, are subject to the privacy policies of the relevant providers.

14. CHILDREN’S PERSONAL DATA

The Site and our services are not designed for persons under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that such data has been collected, it will be erased without delay. If you become aware of such a situation, please notify us at info@mamaram.com.

15. YOUR RIGHTS AS A DATA SUBJECT

Pursuant to Article 11 of the Law, you have the right to apply to us to:

1. learn whether your personal data is being processed;

2. request information if your personal data has been processed;

3. learn the purpose for which your personal data is processed and whether it is being used in accordance with that purpose;

4. know the third parties in Türkiye or abroad to whom your personal data has been transferred;

5. request rectification if your personal data has been processed incompletely or inaccurately;

6. request the erasure or destruction of your personal data under the conditions set out in Article 7 of the Law;

7. request that the actions taken pursuant to points 5 and 6 above be notified to third parties to whom your personal data has been transferred;

8. object to any outcome against you arising from the analysis of your personal data exclusively by automated systems; and

9. claim compensation if you suffer damage as a result of the unlawful processing of your personal data.

Application procedure

You may submit your request by one of the following methods in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• In writing: By delivering a wet-ink signed petition in person, or sending it through a notary public, to CAFERAĞA MAH. BADEMALTI SOK. 20/B MODA — KADIKÖY / İSTANBUL, TÜRKİYE.

• By email: By writing to info@mamaram.com from the email address registered in our systems.

• Using a mobile signature or qualified electronic signature.

Your application must include your first name and surname; signature, for written applications; Turkish Republic identity number or, for foreign nationals, nationality and passport number; address for service; email address and telephone number, if any; and the subject of your request.

Your request will be concluded free of charge within no more than 30 days. If processing the request incurs an additional cost, a fee may be charged in accordance with the tariff set by the Board.

If your application is rejected, you consider the response insufficient or no response is provided within the prescribed period, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in all cases, within 60 days of the application date.

16. CHANGES TO THIS POLICY

This Policy may be revised to reflect changes in legislation or updates to our business processes. The current version will always be published on this page, with the date of the latest update stated at the beginning of the document.

If material changes are made, our registered users will also be informed through appropriate channels. The scope of any explicit consent previously obtained from you will not be expanded merely because a new version of the Policy has been published; your consent will be obtained again for any expanded processing activity.

17. ENTRY INTO FORCE

This Privacy Policy and Information Notice entered into force on 01 August 2026 and forms an integral whole with the Terms of Use, Cookie Policy, Distance Sales Agreement, and Cancellation and Returns Policy published on the Site.

DEVRİM KARAGÖZ MAMA RAM GIDA
Mama Ram Spice & Tea Shop