Privacy notice
This notice explains how DUAM processes personal data on this B2B website and when you contact us. Updated 18 October 2026.
Controller and contact
NATES NUTS TARIM VE GIDA ÜRÜNLERI SAN.TİC.LTD.ŞTİ., Tepecik Mahallesi 1545 Cadde No. 11/2, Samsun, Türkiye, represented by Cengiz Türk. German branch: Beethovenstraße 35, Hilden, Germany. Privacy requests: info@du-am.com.
Website delivery and security
Our website is hosted by Vercel Inc., USA. Requests disclose your IP address, request time, browser/network information and requested resource to the hosting infrastructure so it can deliver and secure the site. We do not maintain a separate application access log. Provider security logs follow the applicable service retention settings. Domain/DNS administration is provided by STRATO GmbH, Germany; DNS resolution may process technical network data. The purposes are site operation, availability and abuse prevention. Where the GDPR applies, our basis is Art. 6(1)(f), our legitimate interest in a secure business website; under KVKK Law No. 6698, Art. 5(2)(f) applies subject to your fundamental rights.
Local enquiry draft and clipboard
The enquiry form runs in your browser memory. It prepares a draft and does not submit its contents to DUAM, Vercel, the consent database or analytics. Closing or reloading the page discards the form. Copy draft writes the draft to your device clipboard only when selected; its further retention depends on your device. Open in email app passes the draft to your chosen email software. Sending happens there, under your control.
Email and business enquiries
When you send us an email or call, we process your contact details, business details and message to handle your request and prepare or perform business arrangements. Public mail routing for du-am.com points to Google; domain administration is with STRATO. Email and telecommunications providers process the data needed for delivery. Under the GDPR, the basis is Art. 6(1)(b) for enquiries from a prospective contracting person or Art. 6(1)(f) for business representatives. Under KVKK, Art. 5(2)(c) or (f) applies. We retain correspondence while required to handle the enquiry and any resulting business relationship; statutory retention duties and specific legal claims may require longer storage. You can request details for your case.
Necessary consent preferences and evidence
If optional measurement is available, we remember your decision for up to 180 days in a signed first-party cookie and a versioned browser preference. Our private consent store at Upstash Inc. holds an encrypted decision identifier, decision, timestamp, expiry, language and notice version/hash for 365 days. These periods are our operational choices. They let us respect and demonstrate your selection. The evidence contains no enquiry contents, raw IP address or browser fingerprint. For abuse protection, the server briefly processes the network address and stores a keyed pseudonymous rate-limit value for up to 10 minutes. Infrastructure providers still receive network metadata. Necessary storage relies on §25(2) TDDDG where applicable. GDPR bases are Art. 6(1)(c) with Art. 7(1) for consent evidence, and Art. 6(1)(f) for security; KVKK bases are Art. 5(2)(ç), (e) and (f) as applicable. On a storage failure, optional measurement stays off.
Optional Google Analytics 4
Only after your explicit acceptance, and only when the service is enabled, Google Analytics 4 measures visits and selected interactions: service selection, ingredient details, sample/document actions, enquiry start, draft creation/copy and email/telephone link clicks. Google Ireland Limited and Google LLC process pseudonymous cookie identifiers, technical device/network data, the page path, site language and fixed source categories. We exclude form contents, names, email addresses, company names, URL queries and full referring URLs from our event payloads. A prepared draft or click does not prove that an enquiry was sent. Enhanced Measurement, Google Signals, advertising personalization and advertising consent are disabled. Analytics cookies last up to 180 days without automatic renewal; granular event/user data retention in the property is two months. Aggregated standard reports are not governed by that setting. GDPR basis: Art. 6(1)(a), with §25(1) TDDDG where applicable; KVKK Art. 5(1). Refusal does not restrict the website. Withdraw at any time in Cookie settings; this stops new measurement and removes this site's GA cookies. Withdrawal does not affect earlier lawful processing. If measurement is not enabled, no Google tag is loaded and no analytics cookie is set.
Recipients and international processing
Only staff and service providers needed for the stated purposes receive relevant data. Our headquarters are in Türkiye; website infrastructure and the optional Upstash/Google services may involve processing in the USA and other service locations. A consent to analytics does not replace the separate legal requirements for international transfers. Applicable transfers require a valid GDPR Chapter V mechanism and, where KVKK applies, the conditions of Art. 9, including any required contractual safeguards and notifications. Contact us for information about the safeguards applicable to your data.
Your rights
Subject to the applicable law, you can request access, correction, deletion, restriction, portability and information about recipients, object to processing based on legitimate interests, and withdraw consent. KVKK Art. 11 also provides rights to learn whether processing occurs, its purposes and transfers, request notification of corrections/deletions to recipients, challenge adverse results produced solely by automated analysis, and seek compensation for unlawful processing. We do not make automated decisions with legal or similarly significant effects through this site. Send requests to the controller's postal address or info@du-am.com; we may need to verify your identity and the permitted request channel. You can complain to the competent data protection authority, including the Turkish Kişisel Verileri Koruma Kurumu or, for the German branch, the LDI Nordrhein-Westfalen. KVKK complaints are subject to its prior controller-application procedure and deadlines.