General Information on the Personal Data Protection Law

The Law on the Protection of Personal Data No. 6698 (hereinafter referred to as the "KVKK") was adopted on March 24, 2016, and published in the Official Gazette dated April 7, 2016, and numbered 29677. Some parts of the KVKK came into effect on the date of publication, while others came into effect on October 7, 2016.

Information as the Data Controller

In accordance with the KVKK No. 6698 and in the capacity of Data Controller, your personal data may be recorded, stored, updated, disclosed/transferred to third parties in cases permitted by legislation, classified, and processed in ways outlined under the KVKK, within the scope explained on this page.

How Your Personal Data May Be Processed

In accordance with the KVKK, the personal data you share with our company may be processed either fully or partially, automatically or non-automatically as part of any data recording system, by obtaining, recording, storing, altering, reorganizing—in short, through any action performed on the data. Any such action on the data is considered “processing of personal data” under the scope of the KVKK.

Purposes and Legal Grounds for Processing Your Personal Data

The personal data you share may be processed for the purposes of fulfilling the requirements of the services we provide to our customers in accordance with contracts and technology, and for improving our products and services. This includes:

• Recording identity, address, and other necessary information to identify the transaction owner, as required under the Law No. 6563 on Regulation of Electronic Commerce, the Law No. 6502 on Consumer Protection, and the relevant regulations such as the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce (published in Official Gazette No. 29457, dated 26.08.2015), and the Regulation on Distance Contracts (published in Official Gazette No. 29188, dated 27.11.2014),

• Preparing all records and documents (in electronic or paper format) for mandatory payment systems, electronic or paper contracts, and legal obligations in banking and e-payment areas,

• Complying with information storage, reporting, and disclosure obligations as required by regulations and relevant authorities,

• Providing information to public prosecutors, courts, and relevant public officials upon request and in legal disputes related to public security.

Information on Third Parties or Organizations to Whom Your Data May Be Transferred

Your personal data may be shared, for the purposes mentioned above, with:

• Our payment infrastructure provider, İyzi Payment and Electronic Money Services Inc.,

• Suppliers, shipping companies, and other service-related individuals or institutions,

• Partner organizations we cooperate with or receive services from as data processors,

• Domestic and international organizations and other third parties.

How Your Personal Data is Collected

Your personal data may be collected through:

• Forms on our website and mobile applications (e.g., name, surname, ID number, address, phone number, email),

• Pages accessed using usernames and passwords, IP logs, cookie data collected by browsers, browsing times and details, location data,

• Verbal, written, or electronic means via our sales and marketing staff, branches, suppliers, sales channels, forms, business cards, digital marketing platforms, call centers,

• From individuals sharing their data for commercial relations, job applications, proposals, etc., in person or remotely, in physical or digital environments,

• Indirectly through various channels, such as websites, blogs, contests, surveys, games, campaigns, micro-sites, social media platforms, newsletter interactions, publicly available databases, and open social media profiles.

Personal Data Obtained Before KVKK Came into Effect

Personal data obtained lawfully before April 7, 2016 (the effective date of KVKK), such as membership records, electronic communication consents, product/service purchases, etc., are processed and stored in accordance with the conditions outlined in this document.

Transfer of Personal Data Abroad

Personal data collected by any of the above-mentioned methods may be transferred abroad to service providers located in countries accredited by the Personal Data Protection Board and offering adequate data protection, for processing and storage in compliance with KVKK and in line with contractual purposes.

Storage and Protection of Personal Data

Your personal data will be kept confidential in our company's databases and systems in accordance with Article 12 of the KVKK. Except for legal obligations and provisions outlined in this document, your personal data will not be shared with third parties. Our company is responsible for preventing unlawful processing and unauthorized access by taking necessary technical and physical security measures as required by Article 12 of the KVKK. In case your data is obtained unlawfully by others, the situation will be reported to the Personal Data Protection Board promptly and in writing in accordance with legal regulations.

Keeping Personal Data Accurate and Up-to-Date

In accordance with Article 4 of the KVKK, our company is obliged to keep your personal data accurate and up to date. To fulfill our obligations under the applicable legislation, our customers must provide accurate and up-to-date information or update their data via our website or mobile application.

Rights of the Personal Data Owner under Article 11 of the KVKK

Article 11 of the KVKK, which came into force on October 7, 2016, grants the following rights to personal data owners:

By applying to our company (the data controller), the Personal Data Owner may request to:

• Learn whether personal data is being processed,

• Request information regarding the processing of their personal data,

• Learn the purpose of processing and whether data is used in line with its purpose,

• Know the third parties to whom data is transferred domestically or abroad,

• Request correction of incomplete or incorrect personal data,

• Request deletion or destruction of personal data under the conditions set forth in Article 7 of the KVKK,

• Request notification of corrections or deletions to third parties to whom personal data has been transferred,

• Object to results arising against them through automated analysis of the processed data.