Privacy Notice
Prepared under Article 10 of Turkish Personal Data Protection Law No. 6698 to inform visitors to www.sagrosa.com and everyone who uses the forms on the site.
Data Controller and Scope
This privacy notice has been prepared by Sagrosa Gıda ve Teknoloji Sanayi Ticaret Limited Şirketi (“Sagrosa” or “the Company”) as data controller, under Article 10 of Turkish Personal Data Protection Law No. 6698 (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
| Data controller | Sagrosa Gıda ve Teknoloji Sanayi Ticaret Limited Şirketi |
|---|---|
| Address | Büyük Kayacık OSB Mahallesi, 515 Sokak No: 4/1, Selçuklu / Konya, Türkiye |
| MERSİS number | [BEKLİYOR: MERSİS numarası] |
| info@sagrosa.com [BEKLİYOR: kişisel veri başvuruları için kvkk@sagrosa.com gibi ayrı bir adres açılacak mı?] | |
| Registered electronic mail (KEP) | [BEKLİYOR: KEP adresi] |
The notice covers everyone who visits the www.sagrosa.com website, uses the contact, quote, sample and career forms on it, or reaches us by email or telephone. Our employees and the representatives of the customers, suppliers and business partners with whom we have contractual relations are informed separately within the relevant processes. The cookies and similar technologies used on the site are explained in a separate document, the Cookie Policy.
Personal Data We Process
Which of your personal data we process through the site depends on the form or channel you use. For visitors who only browse the site, processing is limited to the “Transaction security” row in the table below.
| Data category | Examples | Channel |
|---|---|---|
| Identity | First name, last name, title or role | All forms, email, telephone |
| Contact | Email address, telephone number, company name, city and country, postal address where given | All forms, email, telephone |
| Request and customer transaction data | Message content; the product or solution of interest; for quote and sample requests, the intended application, estimated volume and delivery address; preferred contact channel | Contact, quote and sample forms |
| Professional experience | CV, education and work experience, language level, the position applied for, portfolio link where given | Career form and career emails |
| Transaction security | IP address, browser and device information, date and time of access, form submission record, cookie and local storage preferences | Automatically, while the site is viewed and forms are submitted |
| Legal proceedings | Data subject requests, the related correspondence and our responses | If you submit a request to us |
Our forms do not ask for special categories of personal data such as health, religion, union membership or criminal convictions. Please do not add such information to your messages or your CV. Where special category data reaches us nonetheless, it is disregarded and deleted at the first opportunity unless it is needed to assess your request or application.
Purposes and Legal Grounds of Processing
We process your personal data on the processing conditions listed in Article 5 of the Law and only for the purposes set out below.
| Activity | Purpose of processing | Legal ground (Article 5) |
|---|---|---|
| Contact form, email and telephone calls | Receiving, answering and recording your questions and requests | Art. 5/2(f): our legitimate interest, provided it does not harm your fundamental rights and freedoms; where the request concerns a contract, Art. 5/2(c) |
| Quote request (Sagrosa Technology) | Understanding your requirement, preparing a quote, arranging meetings and presentations, following up the quote process | Art. 5/2(c): directly related to the conclusion of a contract; Art. 5/2(f) |
| Sample request (Veracoa) | Preparing and sending the sample, keeping shipment and food safety records, holding a review meeting after the sample | Art. 5/2(c); Art. 5/2(f); Art. 5/2(ç) for the record-keeping obligations arising from food legislation |
| Job application | Assessing the application against an open position, contacting the candidate, arranging interviews | Art. 5/2(c): related to the conclusion of an employment contract; Art. 5/2(f) |
| Keeping a job application for positions that open later | Contacting you again when a suitable position opens | Art. 5/1: your explicit consent (the checkbox on the form, which is not selected by default) |
| Operating and securing the site | Keeping the site running, fixing errors, preventing attacks and unwanted submissions (spam), keeping access logs | Art. 5/2(f); Art. 5/2(ç) for the traffic log obligation of the hosting provider under Turkish Law No. 5651 |
| Legal obligations and disputes | Responding to requests from authorized public bodies; retaining commercial books and records; establishing, exercising and protecting legal rights | Art. 5/2(ç); Art. 5/2(e) |
| Visit statistics (Google Analytics 4) | Where cookie consent is given, measuring which pages are viewed and how often, in aggregate form and without identifying visitors | Art. 5/1: your explicit consent; see the Cookie Policy for details |
There is no newsletter subscription on our site and we do not send you commercial electronic messages. If such a channel is opened in future, your consent will be obtained separately under Turkish Law No. 6563.
How Personal Data Is Collected
Your personal data is collected through the following channels, by partly automated and non-automated means:
- Site forms: The information you enter in the contact, quote, sample and career forms is stored in the system of our form infrastructure provider (Netlify) and delivered to the relevant team as an email notification (see “Transfer of Personal Data”).
- Email and telephone: The information you share when you contact us at info@sagrosa.com or sagrosa@sagrosa.com, or on our company telephone numbers.
- In person: Business cards and information you give at trade fairs, visits and meetings.
- Automatic records: The access logs created on the hosting server when you view the site, together with the cookie and local storage preferences held on your device.
Transfer of Personal Data
Your personal data may be transferred to the recipient groups below, limited to the purposes above and in line with Articles 8 and 9 of the Law. Your data is not sold and is not shared with third parties for advertising purposes.
| Recipient group | Purpose of transfer | Location |
|---|---|---|
| Form infrastructure provider: Netlify, Inc. (USA) | Receiving form submissions, storing them in the provider’s dashboard, delivering them to us as email notifications and filtering out unwanted submissions. The provider acts as a data processor; submission records can be deleted from the account dashboard. | Outside Türkiye (USA) |
| Email service provider | Hosting our corporate mailboxes | [BEKLİYOR: e-posta sağlayıcısı ve sunucu ülkesi] |
| Web hosting provider: Netlify, Inc. (USA) | Publishing the site and keeping access logs. The provider acts as a data processor. | Outside Türkiye (USA) |
| Analytics service provider: Google LLC (USA) | Where cookie consent is given, measuring visit statistics with Google Analytics 4 in aggregate form and without identifying visitors. Without consent the measurement script is not loaded and no request is sent from your browser to Google servers. | Outside Türkiye (USA) |
| Courier and logistics providers | Name, address and telephone details for sample shipments | Türkiye (the country concerned for sample requests from abroad) |
| Legal, accounting and audit advisors | Meeting legal obligations and handling disputes, under a duty of confidentiality | Türkiye |
| Authorized public bodies | Responding to information requests arising from legislation | Türkiye |
Third-party resources. The fonts used on our pages are served from our own server and no map is embedded on the contact page, so simply viewing a page does not in itself transfer any data to a third party. External links such as the directions link next to the address send a request to the service concerned only when you click them.
Cross-Border Transfer
The transfer of personal data abroad is subject to Article 9 of the Law. As the Personal Data Protection Board has not issued an adequacy decision for any country to date, transfers to the service providers outside Türkiye named above are made on one of the following grounds: [BEKLİYOR: avukat kararı — (a) Kurulca ilan edilen standart sözleşmenin sağlayıcıyla imzalanması ve beş iş günü içinde Kurula bildirilmesi; (b) m. 9/6-a uyarınca, muhtemel riskler hakkında bilgilendirilmiş açık rızanız; (c) form ve e-posta altyapısının yurt içine taşınarak aktarımın ortadan kaldırılması].
This notice is based on option (b): by selecting the checkbox on our forms, which is not selected by default, you give explicit consent to the transfer of your form content abroad through the provider described above. The same applies to visit statistics: Google Analytics 4 is loaded only if you allow it in the cookie banner, and where you do not, the transfer never takes place. The risk of the transfer is that your data is processed in a country without a level of protection equivalent to the one in Türkiye and may be accessible to the authorities of that country. If you would rather not give consent, you can send your request by telephone or by post to the address above. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of the processing carried out before it.
Retention Periods
We keep your personal data for as long as the purpose of processing requires and legislation prescribes.
| Data | Retention period | Basis |
|---|---|---|
| Contact, quote and sample requests (where no commercial relationship follows) | 2 years from the conclusion of the request [BEKLİYOR: avukat onayı] | Legitimate interest; possible disputes |
| Records of requests that lead to a commercial relationship | 10 years, together with the related commercial documents | Art. 82 of Turkish Commercial Code No. 6102; Art. 253 of Tax Procedure Law No. 213 |
| Job applications | 6 months from the conclusion of the assessment; 1 year where explicit consent is given [BEKLİYOR: avukat onayı] | Art. 5/2(c); explicit consent |
| Data subject requests and our responses | 10 years | General limitation period (Art. 146 of Turkish Code of Obligations No. 6098) |
| Server access logs | At least 1 and at most 2 years at the hosting provider | Art. 5 of Turkish Law No. 5651 |
| Form submission records held by Netlify | As set by the provider’s policy; can be shortened in the account settings [BEKLİYOR: sağlayıcı veri işleme sözleşmesi teyidi] | Data processor agreement |
| Cookie and local storage preferences | Held in your browser; kept until you clear your browser data or change your preference | Cookie Policy |
Once the period ends, your data is deleted, destroyed or anonymized in the first periodic destruction cycle, in line with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
Your Rights under Article 11 of the Law
- To learn whether your personal data is processed
- To request information where it has been processed
- To learn the purpose of processing and whether the data is used in line with that purpose
- To know the third parties in Türkiye or abroad to whom the data is transferred
- To request correction where the data is incomplete or inaccurate
- To request deletion or destruction within the conditions of Article 7 of the Law
- To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred
- To object to a result against you arising from analysis of the processed data solely by automated systems
- To claim compensation where you suffer loss because of unlawful processing
How to Submit a Request
You can submit requests relating to your rights under Article 11 of the Law in one of the following ways, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- In writing: By delivering a signed letter in person to Büyük Kayacık OSB Mahallesi, 515 Sokak No: 4/1, Selçuklu / Konya or by sending it through a notary. Marking the envelope “Information Request under the Personal Data Protection Law” speeds up the process.
- KEP: With a secure electronic signature or mobile signature, to [BEKLİYOR: KEP adresi].
- Email: From the email address you have previously given us and that is registered in our system, to info@sagrosa.com, with “Personal Data Request” in the subject line.
Your request must state: your first name and last name (and your signature in a written request); your Turkish identity number, or your nationality and passport or identity number if you are a foreign national; your address of residence or place of business for notification; your email address, telephone and fax number for notification, if any; and the subject of your request. Attaching the information and documents relating to your request makes the assessment easier. We may ask for further information to verify your identity. [BEKLİYOR: isteğe bağlı — indirilebilir başvuru formu (PDF) hazırlanacaksa bağlantısı buraya eklenecek]
Your request is concluded free of charge as soon as possible and, depending on its nature, within thirty days at the latest. Where the response requires an additional cost, the fee in the tariff set by the Board may be charged. If your request is refused, you find the response insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board within thirty days of learning the response and in any case within sixty days of the date of your request.
Effective Date and Updates
This notice may be updated in line with changes in legislation and in our data processing activities. The current version is always published on this page and the effective date is stated at the top. Versions in other languages are provided for information only; in the event of any discrepancy, the Turkish version prevails. Effective date: September 7, 2026.