Personal Data Notice (KVKK)

Data controller

Our company details are available on the seller information page.

What data we process

Account information

Full name, email address, phone number and your password.

Your password is never stored in plain text. It is hashed with an irreversible method (bcrypt); no one, including us, can see your password.

Order and delivery information

Delivery address, billing information, order contents and amounts, shipment tracking number.

Payment information

Your card details are not stored in our system. Payments are taken through the iyzico infrastructure with 3D Secure. We only keep the card brand and the last four digits — these help you recognise your order and are not enough to make a payment.

Technical and security data

IP address, browser and device information, session records, failed login attempts.

This data is kept to protect your account: to detect account takeover attempts, to block brute-force attacks and to show you your active sessions.

Purposes and legal grounds

• Establishing and performing the contract: Receiving, preparing, shipping and delivering your order. Processing payments and handling return and cancellation requests.
• Legal obligation: Issuing invoices, keeping documents as required by tax and commercial law, responding to requests from competent authorities.
• Legitimate interest: Keeping accounts secure, preventing fraud, protecting system security.
• Explicit consent: Sending campaign and promotional messages. This consent is optional and can be withdrawn at any time.

Who we share it with

• Payment institution (iyzico): To carry out the payment.
• Shipping company: Name, address and phone number for delivery.
• Email and SMS providers: To deliver order notifications.
• Competent public authorities: When required by law.

Apart from these, your data is not shared with third parties, not sold and not transferred for marketing purposes.

Retention period

• Account information: As long as your account is active.
• Order and invoice records: For the statutory retention period required by tax law.
• Security records: For a reasonable period for incident investigation.
• Marketing consent records: Until the consent is withdrawn, then for the period required to prove it.

Your rights

Under Article 11 of the Turkish Personal Data Protection Law (KVKK) you have the right to:

• Learn whether your personal data is processed
• Request information if it has been processed
• Learn the purpose of processing and whether it is used accordingly
• Know the third parties in Türkiye or abroad to whom it is transferred
• Request correction if it is incomplete or inaccurate
• Request its deletion or destruction
• Object to the processing
• Claim compensation if you suffer damage

How to exercise your rights

You can exercise two rights directly from your account: on the privacy page you can download your data or delete your account.

About account deletion: When your account is deleted, your name, email address, phone number, addresses and favourites are removed. However, tax law requires order and invoice records to be kept — these records are retained but can no longer be linked to your identity.

For other requests you can write to us via our contact page. Applications are concluded within thirty days at the latest.

Data security

The main measures we take to protect your data:

• All connections are encrypted (HTTPS).
• Passwords are hashed irreversibly.
• Two-step verification is offered; it is mandatory for administrator accounts.
• You can see your active sessions and close any of them.
• Your password is asked again for critical operations.
• Administrator actions are kept in immutable records.