PRIVACY AND TERMS OF USE
General Information about the Personal Data Protection Law
The Personal Data Protection Law, known as Law No. 6698 (hereinafter referred to as KVKK), was accepted on March 24, 2016 and published in the Official Gazette numbered 29677 on April 7, 2016. Some provisions of the KVKK came into effect on the date of publication, while others came into effect on October 7, 2016.
Information as Data Controller
In accordance with Law No. 6698 on the Protection of Personal Data (KVKK), as the Data Controller, your personal data may be recorded, stored, updated, disclosed/transferred to third parties in cases permitted by legislation, classified, and processed in the ways specified in the KVKK, within the framework explained on this page.
How your personal data may be processed
In accordance with Law No. 6698 KVKK, the personal data you share with our company may be processed by us, either wholly or partially, automatically or non-automatically, obtained through any data recording system, recorded, stored, modified, reorganized, and subject to any kind of processing. Any processing of data within the scope of the KVKK is considered as "processing of personal data".
Purposes of processing your personal data and legal reasons
The personal data you share, in order to fulfill the requirements of the services we provide to our customers, in accordance with the requirements of the contract and technology, and to improve our products and services; The Law on the Regulation of Electronic Commerce No. 6563, the Law No. 6502 on the Protection of Consumers, and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce, published in the Official Gazette dated 26.08.2015 and numbered 29457, which was prepared on the basis of these regulations, RG No. 29188, dated 27.11.2014. To record the identity, address and other necessary information in order to identify the information of the transaction owner within the scope of the Distance Contracts Regulation and other relevant legislation published in; To prepare all records and documents that will be the basis of payment systems, electronic contracts or paperwork, which are obligatory in the field of Banking and Electronic Payment; To comply with the information retention, reporting and disclosure obligations stipulated by the legislation and other authorities; In order to provide information to prosecutors' offices, courts and relevant public officials, upon request and in accordance with the legislation, on matters related to public security and legal disputes; It will be processed in accordance with KVKK numbered 6698 and related secondary regulations. Information about third parties or organizations to which your personal data can be transferred
The individuals/organizations to whom your personal data may be transferred, in accordance with the purposes stated above and in cooperation with our company, are as follows:
Primarily, İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş., which provides the payment infrastructure for our company, as well as suppliers, shipping companies, and other individuals and organizations related to the services provided. Additionally, program partner organizations with whom we collaborate as Data Processors, domestic/international institutions, and other third parties may also be recipients of your personal data.
Method of Personal Data Collection
Your personal data is collected through the forms on our company's website and mobile applications, including information such as name, surname, national identification number, address, phone number, work or personal email address. It is also collected through user preferences on pages accessed with a username and password, IP records of performed transactions, cookie data collected by the browser, browsing duration, and details, as well as location data.
Personal data is obtained verbally, in writing, or electronically through various channels such as our Sales and Marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call centers. This includes data shared by individuals who establish a commercial relationship with our company, make job applications, or submit offers through means such as business cards, resumes (CVs), and other methods, either in a physical or virtual environment, face-to-face or remote, orally or in writing, or through electronic means.
Furthermore, personal data may be collected from indirect sources, such as micro-websites used for purposes such as websites, blogs, contests, surveys, games, campaigns, and similar activities, as well as from social media. This includes processing and collection of data related to e-newsletter reading or click activities, data provided by publicly available databases, and publicly shared profiles and data from social media platforms.
Personal Data Obtained Before the Enforcement of KVKK
Personal data obtained in a lawful manner before the effective date of KVKK, which is April 7, 2016, including membership, electronic communication permissions, product/service purchases, and other forms, are processed and stored in compliance with the terms and conditions set forth in this document.
Transfer of Personal Data Abroad
Your personal data, collected through any of the methods mentioned above, may be transferred to service providers located abroad (countries accredited by the Personal Data Protection Board and providing sufficient protection for the personal data) in accordance with the KVKK, either processed in Turkey or processed and stored outside of Turkey, as long as it remains within the scope of the KVKK and in line with the purposes of the contract.
Storage and Protection of Personal Data
Your personal data will be stored confidentially in the databases and systems of our company, in accordance with Article 12 of the KVKK, and will not be shared with any third parties except for legal obligations and the regulations specified in this document. Our company is responsible for taking software measures and physical security precautions, such as preventing the unlawful processing of personal data, blocking unauthorized access, and implementing access management, to protect the systems and databases where your personal data is stored, as required by Article 12 of the KVKK. In the event that the illegal acquisition of personal data by others is discovered, the situation will be immediately reported to the Personal Data Protection Board in accordance with legal regulations and in writing.
Maintenance of Accurate and Up-to-Date Personal Data
In accordance with Article 4 of the KVKK, our company has an obligation to keep your personal data accurate and up-to-date. In this context, it is necessary for our customers to share accurate and up-to-date information or update their data through the website/mobile application to enable our company to fulfill its obligations under the current legislation.
According to Article 11 of Law No. 6698 on the Protection of Personal Data (KVKK), which entered into force on October 7, 2016, the rights of the data subject are as follows:
• The data subject has the right to know whether their personal data is being processed or not.
• If personal data is being processed, the data subject has the right to request information about the processing.
• The data subject has the right to know the purpose of the processing of their personal data and whether they are being used for that purpose.
• The data subject has the right to know the third parties, both domestic and international, to whom their personal data is transferred.
• If personal data is incomplete or inaccurate, the data subject has the right to request its correction.
• In accordance with the conditions stipulated in Article 7 of the KVKK, the data subject has the right to request the deletion or destruction of their personal data.
• If personal data is corrected, deleted, or destroyed, the data subject has the right to request that these actions be notified to the third parties to whom the personal data has been transferred.
• The data subject has the right to object to any decision based solely on the automated processing of their personal data, including profiling, if it has legal effects on them.
