KVKK Policy

General Information About the Personal Data Protection Law

The Law on the Protection of Personal Data No. 6698 (hereinafter referred to as “KVKK”) was adopted on March 24, 2016 and published in the Official Gazette dated April 7, 2016, issue number 29677. Part of the KVKK entered into force on the date of publication, and the remaining provisions entered into force on October 7, 2016.

Information as Data Controller

Pursuant to the KVKK No. 6698 and in the capacity of Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties where permitted by legislation, classified, and processed in the ways listed under the KVKK, within the scope explained on this page.

How Your Personal Data May Be Processed

In accordance with the KVKK No. 6698, any personal data you share with our Company may be processed by being obtained fully or partially through automatic or non-automatic means, provided that it is part of any data recording system; recorded, stored, modified, reorganized, and subjected to any processing performed on data. Under the KVKK, any action taken on personal data is considered “processing of personal data.”

Purposes and Legal Grounds for Processing Your Personal Data

The personal data you share may be processed:

  • To fulfill the requirements of the services we provide to our customers in accordance with the necessities of the contract and technology, and to improve our products and services;

  • To record identity, address, and other necessary information to identify the transaction owner as required by the Law on the Regulation of Electronic Commerce No. 6563, the Consumer Protection Law No. 6502, the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette dated 26.08.2015 No. 29457, the Distance Contracts Regulation published on 27.11.2014 No. 29188, and other related legislation;

  • To prepare all required records and documents for mandatory payment systems in banking and electronic payment activities, for electronic or paper-based contracts, and to comply with data retention, reporting, and information obligations imposed by legislation and other authorities;

  • To provide information to public prosecutors, courts, and relevant public officials on matters relating to public security or legal disputes, where required or upon request;

Your personal data will be processed in accordance with the KVKK and relevant secondary regulations.

Third Parties to Whom Your Personal Data May Be Transferred

For the purposes listed above, your personal data shared with our Company may be transferred—primarily to Agesoft Yazılım San. ve Tic. A.Ş., which provides our e-commerce infrastructure—along with suppliers, cargo companies, service providers, program partners with whom we collaborate, domestic/foreign organizations, and other third parties acting as Data Processors or providing services related to our activities.

Methods of Collecting Your Personal Data

Your personal data may be collected through:

  • Forms on our website and mobile applications including information such as name, surname, Turkish ID number, address, phone number, business or personal email address; as well as IP logs, cookie data collected by browsers, page visit durations and details, location data, and user preferences on logged-in pages;

  • Our sales and marketing department, branches, suppliers, other sales channels, printed forms, business cards, digital marketing and call center channels—verbally, in writing, or electronically;

  • Persons who establish a commercial relationship with our Company, apply for a job, submit a proposal, or share personal data through business cards, CVs, proposals, and similar means—physically or virtually, face-to-face or remotely, verbally or in writing, or electronically;

  • Indirectly through different channels, including websites, blogs, contests, surveys, games, campaigns, microsites, and social media; via e-newsletter reading or click behaviors; public databases; and publicly shared social media profiles.

Personal Data Obtained Before the KVKK Came into Effect

Personal data legally obtained prior to the KVKK’s effective date of April 7, 2016—for membership, electronic communication permission, product/service purchases, and other purposes—continue to be processed and stored under the terms and conditions set out in this document.

Transfer of Personal Data Abroad

Your personal data, collected through the methods described above and processed in or outside Turkey, may be transferred abroad to service providers located in countries accredited by the Personal Data Protection Authority (countries deemed to have adequate data protection), provided that such transfer complies with the KVKK and the purposes of the contract.

Storage and Protection of Personal Data

Your personal data will be stored confidentially in our Company’s databases and systems, in accordance with Article 12 of the KVKK, and will not be shared with third parties except for legal obligations or regulations stated in this document. Our Company is responsible for preventing unlawful processing of personal data, blocking unauthorized access, and implementing software-based and physical security measures. If personal data is obtained unlawfully by others, the situation will be reported to the Personal Data Protection Authority in accordance with legal requirements.

Keeping Personal Data Accurate and Up-to-Date

Under Article 4 of the KVKK, our Company is required to keep your personal data accurate and up-to-date. To fulfill our legal obligations, our customers must ensure that they provide correct and current information, or update their information through our website/mobile application.

Rights of the Personal Data Owner Under Article 11 of KVKK

As of October 7, 2016, personal data owners have the following rights under Article 11 of the KVKK. The Personal Data Owner may apply to our Company (Data Controller) and request:

  • To learn whether personal data is being processed,

  • If personal data has been processed, to request information regarding such processing,

  • To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

  • To know the third parties to whom personal data is transferred, domestically or abroad,

  • To request the correction of personal data in case of incomplete or incorrect processing,

  • To request the deletion or destruction of personal data within the framework of the conditions set forth in Article 7 of the KVKK,

  • To request that the correction, deletion, or destruction of personal data be notified to third parties to whom the data has been transferred,

  • To object to results that may arise to their detriment due to the analysis of data exclusively through automated systems,

  • To request compensation if they suffer damages due to the unlawful processing of personal data.