Privacy notice

Last updated: May 2026.

1. Who we are

Kacmazsa ("we") operates an export marketplace and operating system connecting Turkish manufacturers of surplus apparel and home-textile lots with European wholesale buyers. For the purposes of the GDPR, Kacmazsa is the data controller for the personal data described below.

2. What we collect

• Account data — email and password hash (PBKDF2-SHA256, 100k iterations + salt), verification status, session identifiers.
• Listing / RFQ submissions — name, company, contact email, phone, country, product details, target prices, delivery terms, certificates, and free-text notes you provide.
• Contact form messages — name, email, subject, message.
• Technical data — a coarse network identifier (IP truncated to /24 for IPv4, /48 for IPv6), browser-supplied request headers, and timestamps. We do not retain full IPs.

We do not run third-party analytics, advertising trackers, or social plugins.

3. Cookies

We use one cookie: kz_sess — an HttpOnly, Secure, SameSite=Lax session identifier set after you sign in. It contains no personal data; it expires after 30 days. We use a localStorage entry (kz_cookie_consent_v1) to remember your cookie-banner choice.

4. Why we process your data

• To run the export workflow you asked for — translating your RFQ, sending you a Lot Passport, drafting customs documents, booking inspection, releasing milestone escrow. Lawful basis: contract performance.
• Verification and fraud prevention — KYC checks for suppliers, abuse/rate-limit signals using coarse IPs. Lawful basis: legitimate interest.
• Compliance — keeping records that customs, tax, anti-money-laundering, or sanctions screening obligations require us to keep. Lawful basis: legal obligation.

5. Retention

• Session cookies: 30 days, or until you sign out.
• Email verification tokens: 24 hours.
• Submission records (listings, RFQs, contact messages): 24 months from the last interaction, then deleted or anonymised — unless we are legally required to keep them longer (e.g. tax, customs).
• Coarse IP identifiers: stored only with the originating submission and removed on the same retention schedule.

6. Sharing

We share the minimum data needed to execute your order with: inspection providers (e.g. SGS, QIMA) when you opt into pre-shipment inspection; payment and escrow processors when you fund a milestone; freight forwarders for shipments you book; and email-delivery providers (Resend) for transactional verification email. We do not sell your data.

7. Cross-border transfers

Our infrastructure runs on Cloudflare; data may be processed at the Cloudflare edge nearest you. Transfers from the EEA to non-EEA countries (including Türkiye) are made under Standard Contractual Clauses where required.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port, or object to processing of your data, and to lodge a complaint with your supervisory authority. Under the Turkish KVKK you have parallel rights. To exercise any of these, email privacy@kacmazsa.com; we will respond within 30 days.

9. Security

Passwords are stored only as PBKDF2-SHA256 hashes with per-user salts. Session tokens are random 256-bit values, transported over HTTPS, set HttpOnly + Secure + SameSite=Lax. We aim for a least-privilege architecture and do not retain raw IP addresses.

10. Changes to this notice

If we change this notice we will update the date at the top and, for material changes, notify registered users by email.

11. Contact

Questions about this notice or your data: privacy@kacmazsa.com.