Privacy Policy | TürkDeli

1. Controller

TürkDeli: Çağatay Çubukcu
Lange Straße 74, 10243 Berlin, Germany
Email: info@turkdeli.com · Phone: +49 172 7903807

2. What data we process and why

Activity	Data	Purpose and legal basis (Art. 6(1) GDPR)
Visiting the website	IP address, date and time, page requested, browser details (server logs)	Delivering the website securely and reliably: legitimate interest (f)
Customer account	Email, full name, password (encrypted)	Managing your account: contract (b)
Order	Full name, delivery address, phone, order contents	Preparing and delivering your order: contract (b); accounting records: legal obligation (c)
Payment	Payment amount and transaction reference	Taking payment: contract (b). Card and PayPal details never reach our website; they are processed directly by the payment provider.
Product reviews	Name, rating, review text	Publishing the review: consent (a)
Newsletter	Email, date of consent	Promotional emails: consent (a); you can withdraw at any time
Contact form / WhatsApp	Name, email or phone, message	Answering your enquiry: legitimate interest (f)

3. Recipients and processors

We share your data with the following service providers only as far as each service requires:

Netlify, Inc. (USA): website hosting and server logs.
Supabase, Inc.: database and account infrastructure (storing account, order, address, review and newsletter records); servers in Frankfurt (EU).
Sendinblue SAS (Brevo) (France): sending order confirmation emails.
Stripe Payments Europe, Ltd. (Ireland): processing card payments; card data is handled by Stripe alone.
PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): processing PayPal payments.
FormSubmit: forwarding contact form messages to our inbox.
WhatsApp (Meta Platforms Ireland Ltd.): order and contact messages when you choose WhatsApp; WhatsApp's own privacy policy applies.
Google Ireland Limited (Ireland): visit statistics via Google Analytics, only with your consent (see section 4); sign-in when you choose "Sign in with Google". We have a data processing agreement with Google.

Fonts are served from our own server; opening the website sends no request to Google or any other font provider. Payment providers, WhatsApp and Google only come into play when you start the relevant action yourself or have given consent.

Netlify and Google may transfer data to the USA. Such transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Beyond this, your data is not sold or passed on to third parties.

4. Cookies and local storage

Necessary storage. For the website to work, your browser's local storage (localStorage) holds the contents of your cart, your session key if you are signed in, and your cookie choice. No consent is needed for this (§ 25(2) TDDDG). If you choose PayPal at checkout, PayPal sets its own cookies for the payment; if you choose "Sign in with Google", sign-in takes place on Google's page.

Statistics (Google Analytics). Google Analytics 4 is loaded only if you consent in the window shown; without consent no request goes to Google. With consent, pages visited, time on site, approximate location (country/city) and device and browser details are recorded, and "_ga" cookies are set to recognise returning visitors (lifetime up to 2 years). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. Google Analytics keeps event data for 2 months and user data for 14 months.

You can withdraw your consent at any time via the "Cookie settings" link at the bottom of the page. You can also remove everything stored by clearing your browser data.

5. How long we keep data

Account data until you delete your account; order and invoice records for up to 10 years under German tax and commercial retention duties (§ 147 AO, § 257 HGB); newsletter data until you withdraw your consent.

6. Your rights

Under Articles 15–21 GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent at any time with effect for the future. You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (f) (Art. 21 GDPR). To exercise your rights, simply email info@turkdeli.com. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

7. Data security

Connections to the website and the database are encrypted with TLS/SSL. Database access is restricted by row-level security rules: each person can only access their own data.