KVKK Privacy Notice

The protection of your personal data is a fundamental priority for us.

Last updated: 16.07.2026

As the Data Controller, in accordance with Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, we hereby inform you about the processing of your personal data. This notice aims to provide clear and comprehensive information regarding the categories of personal data processed, the purposes of processing, the legal grounds for such processing, the recipients to whom data may be transferred, the methods of data collection, your rights as a data subject, and the procedures for exercising these rights.

Identity of the Data Controller and its Representative (if any)

In our capacity as Data Controller, the identity and contact details of our company are as follows:

Trade Name: [TO BE FILLED: Company's Full Trade Name]

MERSIS Number: [TO BE FILLED: MERSIS Number]

Tax Office and Number: [TO BE FILLED: Tax Office and Tax Number]

Central Address: [TO BE FILLED: Full Central Address]

Registered Electronic Mail (KEP) Address: [TO BE FILLED: KEP Address]

E-mail Address: [TO BE FILLED: General Contact E-mail Address]

Telephone Number: [TO BE FILLED: General Contact Telephone Number]

Data Controller Representative: [TO BE FILLED: Name/Title of Data Controller Representative, if applicable]

Categories of Personal Data Processed

We process various categories of your personal data in accordance with the KVKK. These categories include, but are not limited to, the following:

**Identity Data:** Name, surname, Turkish ID number (if required for specific services like invoicing), date of birth.
**Contact Data:** Phone number, e-mail address, residential address, delivery address.
**Customer Transaction Data:** Order information, delivery information, invoice information, customer requests and complaints, product/service usage records.
**Transaction Security Data:** IP address, website login/logout records, password information, cookie records, device information, access logs.
**Financial Data:** Bank account number, credit card information (processed by payment service providers, not directly stored by us), billing information, payment records.
**Marketing Data:** Shopping history, survey responses, cookie records used for personalized offers, preferences regarding commercial communications.
**Visual and Audio Records Data:** Call center voice recordings (if you contact our call center), photographs (if voluntarily provided for specific purposes like customer reviews).

Purposes of Processing Personal Data

Your personal data is processed for specific, explicit, and legitimate purposes, which are detailed below:

To establish and perform the sales contract for products/services.
To process product/service orders, manage delivery processes, and handle returns/exchanges.
To provide customer support services, respond to your inquiries, complaints, and requests.
To carry out financial and accounting operations, including invoicing, payment collection, and refund processes.
To fulfill legal obligations arising from relevant legislation, such as tax laws, consumer protection laws, and e-commerce regulations.
To manage membership accounts, provide personalized services, and enhance user experience.
To improve our products and services, conduct market research, and analyze customer preferences.
To ensure the security of our website, mobile applications, and other digital platforms, and to prevent fraudulent activities.
To send commercial electronic messages, promotions, and campaigns (only with your explicit consent where required by law).
To manage legal processes, respond to official requests from public authorities, and exercise our right of defense.

Recipients to Whom Personal Data May Be Transferred and the Purposes of Transfer

Your personal data may be transferred to the following categories of recipients for the purposes outlined below, in compliance with KVKK Articles 8 and 9:

**Cargo and Logistics Companies:** For the purpose of delivering your orders.
**Payment and Banking Institutions:** For processing payment transactions, managing refunds, and fulfilling financial obligations.
**E-Invoice Integrators:** For issuing and transmitting electronic invoices in accordance with legal requirements.
**Hosting and Cloud Service Providers:** For storing and managing our IT infrastructure, website, and data securely.
**Information Technology Service Providers:** For technical support, software development, system maintenance, and data backup services.
**Legally Authorized Public Institutions and Organizations:** Such as courts, prosecutors' offices, law enforcement agencies, and regulatory bodies, when legally required or to fulfill legal obligations.
**Auditors and Legal Advisors:** For conducting audits, providing legal consultancy services, and managing legal processes.
**Marketing and Analytics Service Providers:** For analyzing website usage, improving marketing strategies, and sending personalized communications (only with your explicit consent where required).

Method of Personal Data Collection

Your personal data is collected through various automated and non-automated methods, depending on the nature of our interaction with you. These methods include:

**Internet Website/Mobile Application:** Through membership registration forms, order forms, contact forms, and online surveys.
**Cookies and Similar Technologies:** Through cookies, web beacons, and other tracking technologies used on our website and mobile applications to collect usage data, preferences, and device information.
**Call Center/Customer Service:** Through telephone calls, e-mail correspondence, and live chat interactions.
**E-mail and SMS:** Through electronic communication channels when you interact with our marketing or support messages.
**Social Media Platforms:** Through your interactions on our official social media pages (e.g., comments, messages).
**Physical Forms/Documents:** Through any physical forms you may fill out (e.g., return forms, warranty registration forms).
**Third-Party Analytics Tools:** Through services like Google Analytics that provide insights into website traffic and user behavior.

Legal Grounds for Processing Personal Data

Your personal data is processed based on the legal grounds specified in Article 5 and Article 6 of the KVKK. The legal grounds for each processing activity are as follows:

**Processing for Contract Performance (KVKK Article 5/2-c):** Your identity, contact, customer transaction, and financial data are processed for the establishment and performance of a contract (e.g., sales contract for goods/services), including order processing, delivery, payment, and customer support.
**Processing for Fulfillment of Legal Obligation (KVKK Article 5/2-ç):** Your identity, contact, customer transaction, and financial data are processed to fulfill our legal obligations arising from tax laws, consumer protection laws, e-commerce regulations, and other applicable legislation (e.g., invoicing, record-keeping, responding to official requests).
**Processing for Legitimate Interests (KVKK Article 5/2-f):** Your customer transaction, transaction security, and certain marketing data may be processed based on our legitimate interests, provided that such processing does not harm your fundamental rights and freedoms. This includes purposes such as improving our services, ensuring website security, preventing fraud, managing internal operations, and analyzing customer behavior for business development.
**Processing for Establishment, Exercise, or Protection of a Right (KVKK Article 5/2-e):** Your personal data may be processed to establish, exercise, or protect our legal rights or to defend against legal claims (e.g., in case of disputes, legal proceedings).
**Explicit Consent (KVKK Article 5/1 or Article 6/2 for Special Categories):** For processing activities that do not fall under any of the legal grounds specified in KVKK Article 5/2 or Article 6/3 (e.g., sending commercial electronic messages for marketing purposes, processing special categories of personal data not covered by specific legal exceptions), your explicit consent is obtained separately. Please note that explicit consent is always obtained through a separate consent mechanism and is not embedded within this Privacy Notice.

Rights of the Data Subject under KVKK Article 11

As a data subject, you have the following rights concerning your personal data, as stipulated in Article 11 of the KVKK:

To learn whether your personal data is processed.
To request information if your personal data has been processed.
To learn the purpose of the processing of your personal data and whether it is used in accordance with its purpose.
To know the third parties to whom your personal data is transferred, both domestically and abroad.
To request the rectification of incomplete or inaccurate personal data.
To request the erasure or destruction of your personal data under the conditions laid down in Article 7 of the KVKK.
To request notification of the operations carried out under subparagraphs (e) and (f) to third parties to whom your personal data has been transferred.
To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems.
To demand compensation for the damage arising from the unlawful processing of your personal data.

Application Procedure and Channels

You may submit your requests regarding your rights under KVKK Article 11 to us, as the Data Controller, in writing or by other methods determined by the Personal Data Protection Board. We commit to concluding your application free of charge within thirty (30) days at the latest, depending on the nature of your request. However, if the processing of your request requires an additional cost, we may charge the fee determined by the Personal Data Protection Board.

Application channels are as follows:

**Written Application:** By sending a signed copy of your request to our central address: [TO BE FILLED: Full Central Address].
**Registered Electronic Mail (KEP):** By sending an e-mail to our KEP address: [TO BE FILLED: KEP Address].
**Secure Electronic Signature/Mobile Signature:** By sending an e-mail with a secure electronic signature or mobile signature to our e-mail address: [TO BE FILLED: General Contact E-mail Address].
**Registered E-mail Address:** By sending an e-mail from your e-mail address previously notified to us and registered in our system to: [TO BE FILLED: General Contact E-mail Address].

Retention Periods of Personal Data

Your personal data is retained for the period required by the purposes of processing and relevant legal obligations. Once the purpose of processing ceases or the legal retention period expires, your personal data will be erased, destroyed, or anonymized in accordance with our Personal Data Retention and Disposal Policy and the KVKK. For detailed information regarding personal data retention periods, please refer to our Personal Data Retention and Disposal Policy, which is available on our website.

International Transfer of Personal Data

In certain cases, your personal data may be transferred abroad, particularly to service providers utilizing cloud computing, analytics, or email/SMS delivery platforms. Such transfers are carried out in compliance with Article 9 of the KVKK, under one of the following conditions:

**Countries with Adequate Protection:** To countries declared by the Personal Data Protection Board to have adequate protection.

**Commitment for Adequate Protection:** To countries where the data controller in the foreign country undertakes adequate protection in writing and obtains the authorization of the Personal Data Protection Board.

**Explicit Consent:** In the absence of the above conditions, with your explicit consent, which is obtained separately.

Examples of international transfers may include:

**Cloud Hosting Providers:** For data storage and infrastructure services (e.g., servers located in [TO BE FILLED: Example Country/Region if known, otherwise keep general]).

**Analytics Service Providers:** For website usage analysis (e.g., Google Analytics, which may involve data transfer to the USA).

**Email/SMS Service Providers:** For sending transactional and marketing communications (e.g., providers located in [TO BE FILLED: Example Country/Region if known, otherwise keep general]).

**CDN (Content Delivery Network) Providers:** For faster delivery of website content globally.

Separate Explicit Consent for Specific Processing Activities

For processing activities that require your explicit consent under the KVKK (e.g., sending commercial electronic messages, processing special categories of personal data not covered by legal exceptions), your explicit consent will be obtained through a separate consent mechanism. This Privacy Notice serves solely as an information document and does not constitute explicit consent for any personal data processing activity.

Important Note on Translation

This Privacy Notice has been prepared in English for informational purposes only. In case of any discrepancy or conflict between the English and Turkish versions, the Turkish text shall prevail and be considered the legally binding document.

Frequently asked questions

What is KVKK and why is this notice important?+

KVKK refers to the Personal Data Protection Law No. 6698 in Turkey. This notice is important because it fulfills our legal obligation to inform you about how your personal data is collected, processed, stored, and your rights regarding this data, ensuring transparency and compliance with the law.

How can I exercise my rights regarding my personal data?+

You can exercise your rights by submitting a written application to our central address, sending an email to our KEP address, or sending an email with a secure electronic signature/mobile signature or from your registered email address to our general contact email. Please refer to the 'Application Procedure and Channels' section for detailed information.

Will my personal data be shared with third parties?+

Yes, your personal data may be shared with specific third-party service providers (e.g., cargo companies, payment institutions, IT service providers) and legally authorized public institutions, but only for the purposes explicitly stated in this notice and in compliance with KVKK. We ensure that these third parties also adhere to data protection standards.

Is my explicit consent always required for data processing?+

No, explicit consent is not always required. Your personal data can be processed without your explicit consent if there is another legal ground specified in KVKK Article 5/2 or Article 6/3, such as the necessity for contract performance, fulfillment of legal obligations, or our legitimate interests. Explicit consent is only sought when no other legal ground applies.

How long is my personal data retained?+

Your personal data is retained for the period necessary to fulfill the processing purposes and to comply with legal obligations. Once these periods expire, your data will be erased, destroyed, or anonymized in accordance with our Personal Data Retention and Disposal Policy. You can find more details in our dedicated policy.

Talk to an expert