Under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles of the Obligation to Inform, this notice is for visitors to Poros (porosmantar.com) and for people who use its forms and photo identification. Poros is a Markention company.
Data controller
Markention Dijital Pazarlama San. ve Tic. Ltd. Şti.
Cevizli Mah. Zuhal Cad. Ritim İstanbul A5 Blok No:46E/179 Maltepe / İstanbul, Türkiye
Email: [email protected]
MERSİS (central registry) no: [to be filled in by Cihat]
What we process, why, and on what legal ground
| Activity | Data | Purpose | Legal ground |
|---|---|---|---|
| Waiting list (“Tell me when it’s available”) | Email, chosen product and size, language, page the form was sent from; time sent, consent text version, irreversible hash of the IP address | Telling you once when the product goes on sale; preventing abuse | Explicit consent (Art. 5/1) |
| Corporate gift quote | Company name, contact name, email, phone, quantity, size, species preference, delivery date, notes, company logo (optional); time sent, consent text version, irreversible hash of the IP address | Preparing a quote and contacting you about it; preventing abuse | Directly related to entering into a contract (Art. 5/2-c) |
| Contact form | Name, email, topic, message, language | Replying to your question or request | Legitimate interest (Art. 5/2-f) |
| Photo identification (once open) | Mushroom photos you send (not stored); irreversible hash of the IP address (daily limit) | Showing candidate species for the mushroom in the photo; preventing misuse | Explicit consent (Art. 5/1); Art. 9 for the transfer abroad (below) |
| Visiting the site | IP address, browser details, requested address, time | Information security, running and speeding up the site | Legitimate interest (Art. 5/2-f) |
| Analytics and advertising cookies (in future) | Cookie IDs, page views, device details, approximate location | Visit statistics, ad measurement | Explicit consent (Art. 5/1) |
With “Use my location” on the map and home page, your location is processed only on your device; it is never sent to us, so we do not process it.
How we collect it
Data is collected electronically, partly by automated means (server logs, browser storage), from what you type into forms, the photos you send and the information your browser sends when you visit the site.
Who receives it
- Service providers: Cloudflare, Inc. (security and speed, USA), Hostinger International Ltd. (hosting, server in Germany), Google LLC (Google Workspace: delivering quote and contact notifications to our team’s email, USA). Once photo identification opens, only the photos you send go to OpenAI, L.L.C. (USA). For map tiles, your browser sends your IP address directly to the OpenStreetMap Foundation (United Kingdom).
- Authorities: public bodies legally entitled to request it, on request and as far as the law requires.
Waiting list, quote and contact details are never given or sold to third parties for marketing.
Transfers abroad
Because the site is served through Cloudflare’s global network, our server is in Germany and our company email runs on Google Workspace, visit and form data is processed outside Turkey. These transfers are made within the conditions of Article 9 of the KVKK.
Photo identification: your photos are sent to OpenAI (USA) for identification. This transfer relies on the explicit consent you give after being informed, before using the feature (KVKK Art. 9). If you do not consent, no photo is sent and you can keep using the rest of the site. On the date of this notice the feature is switched off.
Retention
- Waiting list: until the on-sale announcement is sent, or until you ask for deletion.
- Corporate quote requests and logos: until the quote process ends, or until you ask for deletion; if it becomes an order, the periods required by commercial law.
- Contact messages: until your request has been answered and the purpose has ended.
- Identification photos: never stored. Result cache (against a photo hash) 24 hours; usage counter (IP hash) one day.
- Rate-limit counters (IP hash): one hour at most.
- Server access logs: for the hosting server’s log rotation period.
Data whose period has expired or whose purpose has ended is deleted, destroyed or anonymised.
Your rights under Article 11 of the KVKK
By applying to us, you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used for that purpose,
- know the third parties in Turkey or abroad to whom it has been transferred,
- request correction if it is incomplete or inaccurate,
- request deletion or destruction under the conditions of Article 7 of the KVKK,
- request that third parties who received the data are notified of any correction, deletion or destruction,
- object to a result against you that arises solely from automated analysis of the data,
- claim compensation if you suffer damage because of unlawful processing.
Where processing is based on explicit consent, you can withdraw it at any time.
How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in writing to the address above or to [email protected]. It should include your full name, a signature for written applications, your Turkish ID number (or, for foreign nationals, nationality and passport or ID number), an address for notifications, email and phone if any, and what you are requesting. We reply free of charge within 30 days at the latest; if the action involves an additional cost, the fee set by the Personal Data Protection Board may be charged.
If your application is refused, the reply is insufficient or there is no reply in time, you can complain to the Personal Data Protection Board within 30 days of learning the reply, and in any case within 60 days of applying (KVKK Art. 14).