General information about the Personal Data Protection Law

Personal Data Protection Law No. 6698 (hereinafter referred to as the PDPA)

Information as the data controller

In accordance with KVKK No. 6698 and as the Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties in cases permitted by legislation, classified, and processed in the ways listed in the KVKK, within the framework explained on this page.

How your personal data may be processed

In accordance with the Personal Data Protection Law No. 6698, your personal data shared with our Company may be processed by us through any operation performed on the data, such as being obtained, recorded, stored, modified, reorganised, either fully or partially, automatically, or by non-automatic means as part of any data recording system. Any processing carried out on data within the scope of the KVKK is considered ‘processing of personal data’.

The purposes and legal grounds for processing your personal data

The personal data you share,

· To enable us to provide our customers with services in accordance with the requirements of the contract and technology, and to improve our products and services;
 

· The Law No. 6563 on the Regulation of Electronic Commerce, the Law No. 6502 on the Protection of Consumers, and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette No. 29457 dated 26.08.2015, which was prepared based on these regulations, The Regulation on Distance Contracts published in the Official Gazette dated 27 November 2014 and numbered 29188, and other relevant legislation, to record the identity, address and other necessary information to identify the transaction owner;
 

· To organise all records and documents that will serve as the basis for payment systems, electronic contracts or paper-based transactions, which are mandatory in the field of banking and electronic payments; to comply with the information storage, reporting and notification obligations required by legislation and other authorities;
 

· To be able to provide information to prosecutors, courts and relevant public officials upon request and as required by legislation in matters relating to public security and legal disputes;

Your personal data will be processed in accordance with the Personal Data Protection Law No. 6698 and related secondary regulations. Information about third parties or organisations to whom your personal data may be transferred For the purposes stated above, the individuals/organisations to whom your personal data shared with our Company may be transferred are as follows: primarily Shopify, which provides our Company's e-commerce infrastructure, as well as persons and organisations related to the services provided, such as suppliers and shipping companies, programme partner organisations with which we collaborate and from which we receive services in order to carry out our activities and/or in the capacity of Data Processors, domestic/foreign organisations and other third parties.

Method of collection of your personal data

Your personal data

Our company collects information such as name, surname, Turkish ID number, address, telephone number, work or personal email address through forms on our website and mobile applications; preferences on pages accessed using a username and password, IP records of transactions performed, data collected by the browser such as cookies, browsing duration and details, and location data.

Our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call centres collect data verbally, in writing, or electronically.

From individuals who share their personal data in a physical or virtual environment, face-to-face or remotely, verbally or in writing or electronically, for purposes such as establishing a commercial relationship with our company, applying for a job, or submitting a bid, by means of business cards, CVs, bids, and other means;

Furthermore, data obtained indirectly through various channels, such as data obtained from (micro) websites and social media used for purposes such as websites, blogs, competitions, surveys, games, campaigns, and similar activities; e-newsletter reading or clicking activities; data provided by publicly available databases; and publicly shared profiles and data from social media platforms; may be processed and collected.

Your personal data obtained before the KVKK came into force

Your personal data obtained through the purchase of services and other lawful means is also processed and stored in accordance with the terms and conditions set out in this document.

Transfer of your personal data abroad

Personal data collected using any of the methods listed above, whether processed in Turkey or processed and stored outside Turkey, may be transferred to service providers located abroad (in countries accredited by the Personal Data Protection Board and deemed to provide adequate protection for personal data), provided that such data remains within the scope of the Personal Data Protection Law and is transferred in accordance with the purposes of the contract.

Storage and protection of personal data

Your personal data will be stored confidentially in the databases and systems held by our Company in accordance with Article 12 of the KVKK; it will not be shared with third parties in any way except where required by law and as specified in this document. Our company is obliged to take software measures such as access management and physical security measures to prevent the unlawful processing of personal data and to prevent unauthorised persons from accessing the systems and databases where your personal data is stored, in accordance with Article 12 of the KVKK. If it is learned that personal data has been obtained by others through unlawful means, the situation will be reported immediately, in writing and in accordance with legal regulations, to the Personal Data Protection Board.

Keeping personal data up to date and accurate

Pursuant to Article 4 of the KVKK, our Company is obliged to keep your personal data accurate and up to date. In this context, in order for our Company to fulfil its obligations arising from the applicable legislation, our Customers are required to share their accurate and up-to-date data or update it via the website/mobile application.

The rights of the data subject under the Personal Data Protection Law No. 6698

Article 11 of Law No. 6698 on the Protection of Personal Data entered into force on 7 October 2016. Pursuant to the relevant article, the rights of the Data Subject after this date are as follows: The Data Subject may apply to our Company (the data controller) to:

1. To learn whether personal data has been processed,

2. To request information regarding the processing of personal data,

3. To learn the purpose of processing personal data and whether it is being used for its intended purpose,

4. To know the third parties to whom personal data has been transferred within or outside the country,

5. Request the correction of personal data if it has been processed incompletely or incorrectly,

6. Request the deletion or destruction of personal data within the framework of the conditions set out in Article 7 of the KVKK,

7. Request that the third parties to whom the personal data has been transferred be notified of the correction, deletion or destruction of the personal data,

8. To object to the analysis of processed data exclusively by automated systems resulting in a decision against the individual,

9. To request compensation for damages incurred due to the unlawful processing of personal data.