KVKK Clarification Text (Draft)

1) Identity of the Data Controller

Data Controller: [SATICI_UNVAN] (the "Company")
Address: [SATICI_ADRES]
Phone: [SATICI_TELEFON] | E-mail: [SATICI_EPOSTA] | KEP: [KEP_ADRESI]
MERSIS: [MERSIS_NO] | Tax Office/No: [VERGI_DAIRESI] / [VERGI_NO]
VERBIS Registration No: [VERBIS_NO]

This notice is issued to fulfil the disclosure obligation under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK").

2) Categories of Personal Data Processed

• Identity: full name, Turkish ID number (where the invoice is issued to an individual), authorised person's name for corporate invoices
• Contact: e-mail, telephone, delivery and billing address
• Customer transaction: order number, order contents, return/request records, transaction history
• Financial: payment amount, instalment information, transaction results returned by the payment institution
• Online identifiers and transaction security: IP address, device/browser information, session and log records
• Marketing: communication consents, source and date of consent (where given)

Your card details are never seen or stored by the Company; they are processed by the payment institution (iyzico) on its own infrastructure.

3) Method of Collection

Your personal data is collected electronically, by automated and partly automated means, through the membership and order forms you complete on the Site, your contact with our customer support channels (e-mail, telephone), information returned by the payment institution and carriers, and cookies and similar technologies.

4) Purposes and Legal Grounds

• Conclusion and performance of a contract (Art. 5/2-c): taking the order, collecting payment, delivery, returns and withdrawal processes.
• Legal obligation (Art. 5/2-ç): invoicing, accounting, tax and consumer-law retention and reporting duties.
• Establishment and protection of rights (Art. 5/2-e): dispute management, debt collection, evidence.
• Legitimate interests (Art. 5/2-f): fraud prevention, system and transaction security, measuring and improving service quality.
• Explicit consent (Art. 5/1): commercial electronic messages and non-essential cookies.

5) Recipients

• Payment institution and financial institutions: iyzico and the relevant banks
• Logistics/courier service providers: [ANLASMALI_KARGO_FIRMALARI]
• Hosting, database, e-mail/SMS and technical infrastructure providers
• Accounting, legal, audit and consultancy service providers
• Competent public authorities upon lawful request

6) International Transfers

Some of our hosting and technical infrastructure providers may operate servers abroad. Such transfers are carried out under Article 9 of the KVKK: to countries subject to an adequacy decision of the Board, or otherwise on the basis of appropriate safeguards (an undertaking approved by the Board, standard contractual clauses, or binding corporate rules), or where one of the incidental cases set out in the law applies.

7) Retention Periods

• Order and invoicing records: 10 years
• Customer support correspondence: 3 years
• Marketing consents and records: 2 years
• Log and security records: 2 years

At the end of the retention period, personal data is deleted, destroyed or anonymised.

8) Commercial Electronic Messages and IYS

Commercial electronic messages containing campaigns, promotions or announcements are sent only with your consent. Consents are recorded in the Message Management System (IYS) pursuant to Law No. 6563 (Brand Code: [IYS_MARKA_KODU]). You may withdraw your consent at any time, free of charge and without giving reasons, using the opt-out link in the messages, through IYS, or by writing to [SATICI_EPOSTA]. Transactional notifications such as order confirmations and shipment tracking are not commercial messages and are unaffected by such opt-out.

9) Your Rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in accordance with that purpose; to know the third parties to whom the data is transferred in Turkey or abroad; to request rectification if the data is incomplete or inaccurate; to request erasure or destruction where the conditions are met; to request that such rectification, erasure or destruction be notified to third parties to whom the data was transferred; to object to an outcome adverse to you arising from analysis solely by automated systems; and to claim compensation for damage suffered as a result of unlawful processing.

10) How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests, together with information verifying your identity, to [KVKK_BASVURU_EPOSTA] (from the e-mail address registered in our systems), to our KEP address [KEP_ADRESI], or in writing with a wet signature to [SATICI_ADRES].

Applications are concluded free of charge as soon as possible and within 30 days at the latest; where the process entails an additional cost, the fee set out in the Board's tariff may be charged. If your application is rejected or left unanswered, you may lodge a complaint with the Personal Data Protection Board.

11) Data Security

The Company applies appropriate technical and administrative measures to prevent unlawful processing of and access to personal data and to ensure its safekeeping, including role-based access control and authorisation, row-level data isolation, encryption in transit and at rest, access logging and supplier audits.

12) Cookies

For detailed information on cookies and similar technologies, please see our Cookie Policy.

13) Effective Date

This notice was last updated on 2026-08-15. The current version is always published on this page.

This English text is provided for information purposes. In the event of any discrepancy, the Turkish version prevails.