Privacy Policy

1.Data controller

Pano Organic, Şanlıurfa, Türkiye. Contact: [email protected].

2.How this site works

This is a static website: there are no accounts, no logins and no forms that send data to us.

What you enter in the quote and sample form is turned into an email text in your own browser only; it is not sent to us and is not stored anywhere. When you send that text from your own email app, your email reaches us.

We use Google Analytics for visit statistics, and it loads only if you choose “Accept” in the cookie banner. The site uses no advertising, retargeting or social media tools. Fonts, video and images are served from the site itself.

3.Personal data we process

• Information in the emails you send us: your name, company name, email address, country and city, a delivery address for samples, and the content of your request and our correspondence.
• Technical connection data: our hosting provider (Cloudflare) processes data such as your IP address, browser details and the time of your request in order to deliver the pages and protect the site against attacks.
• Visit statistics (only if you consent): the random identifier in the Google Analytics cookies; the pages you view, when and for how long; the site you came from; your device, operating system and browser type; an approximate location (country and city) derived from your IP address; certain actions in the quote builder (a message being created, the “Send by email” or “Copy the text” button, the sample option, printing a product sheet) and the names of the products selected. Your name, company, email address, delivery location and notes in the form are never sent to Google Analytics. Google Analytics does not log or store IP addresses.
• Your cookie choice: the option you select in the cookie banner is stored only in your browser’s local storage and is not sent to us.

4.Purposes

• Replying to your quote and sample requests and preparing quotes
• Sending samples you ask for
• Conducting business correspondence and the commercial relationship
• Keeping the site secure and available
• Understanding, through aggregate statistics, how the site is used and which products attract interest, and improving the site (only with your consent)
• Meeting our legal obligations

5.Legal basis

GDPR Article 6(1)(b) (steps taken at your request before entering into a contract), Article 6(1)(f) (our legitimate interest in conducting business correspondence and operating the site securely) and Article 6(1)(c) (legal obligation).

KVKK Article 5(2)(c) (processing directly related to entering into or performing a contract), Article 5(2)(ç) (legal obligation) and Article 5(2)(f) (legitimate interest). Your data is collected through the emails you send us and the technical operation of the site.

Google Analytics runs only with your consent (GDPR Article 6(1)(a), KVKK Article 5(1)): it does not load unless you choose “Accept” in the cookie banner. You can withdraw your consent at any time through the “Cookie preferences” link at the foot of every page; withdrawal does not affect the lawfulness of processing before it.

6.Recipients and transfers

We do not sell your personal data or share it with others for marketing.

Your data is shared, only as far as necessary, with these providers acting as our processors: Cloudflare for hosting and domain services, and Google (Google Workspace) for email; and, when we send samples, with the courier.

We use Google Analytics for visit statistics. Google acts as our processor for this service under the Google Ads Data Processing Terms. Advertising features, Google Signals and ad personalisation are switched off in our Google Analytics settings; visit data is not used for advertising.

These providers’ servers may be located outside Türkiye and the European Economic Area, in particular in the United States. Such transfers are made with safeguards that meet the GDPR and KVKK rules on international transfers. Google and Cloudflare state that they participate in the EU-U.S. Data Privacy Framework and use the European Commission’s standard contractual clauses.

7.How long we keep it

Correspondence is kept for the duration of the business relationship and for the retention periods required by law (including the periods set by the Turkish Commercial Code for commercial records), and is then deleted or anonymised.

Server logs are subject to the hosting provider’s short retention period. Your cookie choice stays in your browser until you clear your browser data or change your choice.

User-level and event-level data in Google Analytics is kept for 14 months and then deleted by Google. Cookie lifetimes are listed in the Cookie Policy.

8.Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability and to object to processing. Where processing is based on consent, you may withdraw your consent at any time.

Under Article 11 of the KVKK you also have the right to learn whether your data is processed and for what purpose, to know the third parties in Türkiye or abroad to which it is transferred, to request correction or erasure, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing.

Send requests to [email protected]. We reply within 30 days at the latest.

If you are in the European Union you may complain to the data protection supervisory authority in your country; in Türkiye, to the Personal Data Protection Board (KVK Kurulu).

9.Changes

If this policy changes, the current version is published on this page.