Personal Data Policy

(Clarification Text)

Last Updated: 19.12.2025

1. IDENTITY OF THE DATA CONTROLLER

Pursuant to the Personal Data Protection Law No. 6698 (“KVKK”) and related secondary legislation; your personal data is processed by MOAYA CACAO GIDA VE TİCARET LİMİTED ŞİRKETİ (“MOAYA” or “Company”) as the data controller, within the scope described below. As MOAYA, we value the privacy and trust of our customers as much as the purity of the cocoa beans we offer.

Address: KONUTKENT MAH. 3028 CAD. NO: 6 İÇ KAPI NO: 100 ÇANKAYA/ ANKARA Mersis No: 0621122954900001 Website: www.moayacacao.com

2. CATEGORIES OF PROCESSED PERSONAL DATA

During your use of the products and services offered by MOAYA, data in the following categories may be collected:

Identity Information: Name, surname, Turkish ID number (only when invoicing is mandatory).
Contact Information: Email address, phone number, delivery address, billing address.
Customer Transaction Information: Order history, cart information, requests and complaint records, shopping preferences.
Transaction Security Information: IP address, website login/logout records, password information (as per Law No. 5651).
Marketing Information: Shopping habits, demographic information, cookie records, targeting information, survey responses.
Financial Information: Masked credit card information held by the payment institution (MOAYA does not store your full credit card number).

3. PURPOSES OF PERSONAL DATA PROCESSING

Your personal data is processed within the personal data processing conditions specified in Articles 5 and 6 of the KVKK for the purposes of: Contractual Processes: Establishment of distance sales contract, shipment of products, execution of after-sales support services (returns, exchanges). Legal Obligations: Issuance of e-invoices/e-archive invoices, providing information to authorized public institutions (Tax Office, Consumer Arbitration Committee, etc.). Operational Processes: Execution of information security processes, prevention of fraud. Marketing and Profiling (with explicit consent): Providing personalized experiences tailored to the "The Joy of Missing Out" (JOMO) concept, announcing general and special campaigns, promotions, suggesting products suitable for your taste through profiling and analysis.

4. TRANSFER OF PERSONAL DATA

Your data may be transferred for the realization of the purposes listed above to: Service Providers: Cargo/courier companies for product delivery, Infrastructure Providers: Technology companies from which e-commerce infrastructure and server hosting services are procured (by taking necessary technical measures for the security of your data), Payment Institutions: Banks and BRSA licensed payment institutions (e.g., Iyzico, Stripe) for payment collection, Legal Obligation: Legally authorized public institutions and judicial authorities.

Note: If our Company transfers your data abroad due to server services or analysis tools (Google, Meta, etc.) it uses, compliance with KVKK Article 9 (Explicit Consent or Countries with Adequate Protection) is observed.

5. METHOD AND LEGAL BASIS OF DATA COLLECTION

Your personal data is collected electronically through our website, mobile application, social media accounts, cookies, and call center. This collection activity is based on the following legal grounds: KVKK 5/2-c: It is directly related to the establishment or performance of a contract (Order process). KVKK 5/2-ç: To enable the data controller to fulfill its legal obligation. KVKK 5/2-f: Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. Explicit Consent: Explicit consent is sought for marketing activities and international data transfer situations.

6. DATA SECURITY MEASURES

MOAYA implements technical and administrative measures at the highest level, such as SSL (Secure Socket Layer) encryption, firewalls, authorization matrices, and regular penetration tests, to prevent the unlawful processing and access of your personal data.

7. RIGHTS OF THE DATA SUBJECT (KVKK ARTICLE 11)

By applying to our Company, you have the right to:
Learn whether your personal data is processed, request information if it has been processed, learn the purpose of processing and whether it is used in accordance with its purpose, know the third parties to whom data is transferred domestically or abroad, request rectification if data is incomplete or incorrectly processed, request erasure or destruction in accordance with KVKK Article 7, object to the occurrence of an adverse outcome by analyzing processed data exclusively through automated systems.

8. CONTACT AND APPLICATION

You can submit your requests regarding your rights by filling out the form at https://moayacacao.com/pages/bize-ulasin or by using the registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the e-mail address you previously notified to our Company at hello@moayacollective.com.