This policy sets out the principles for processing, storing and protecting the personal data of individuals (“Data Subject”) using our website, in accordance with the Turkish Personal Data Protection Act No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR).

1. Controller
We are the data controller for the processing of personal data collected through this website, as defined by applicable law. You can contact us using the contact channels listed on the website.

2. Collected Personal Data
The following data may be collected directly from the user or automatically:

• Identity data: Name, surname, username, date of birth

• Contact details: Phone number, email address, postal address

• Technical data: IP address, browser type, operating system, device data

• Usage data: Site navigation, transaction history, click data

• Financial data: Payment and billing information (if a transaction is made)

• Cookie data: Information collected through cookies and similar technologies

3. Purposes of the Processing of Personal Data
The collected data may be processed for the following purposes:

• Providing, improving and personalizing services

• Executing membership and transaction structures

• Responding to requests and complaints

• Compliance with legal obligations

• Improving the user experience

• Carrying out marketing, campaign and informational activities (with your express consent)

4. Legal bases
Your personal data is processed on the basis of the following legal grounds:

• Explicit consent

• Necessary for the performance of an agreement

• Necessary to comply with a legal obligation

• Legitimate interest

5. Data Retention Period
Personal data will be retained for the periods specified in the relevant laws and regulations or as long as necessary for the purpose of the processing. Once this period has expired or the processing purpose no longer applies, the data will be securely erased, destroyed, or anonymized.

6. Sharing of Personal Data
Your personal data will only be shared in the following cases:

• Legal obligations

• Requests from competent government agencies and authorities

• Our service providers (e.g. hosting, shipping, payments, etc.)

Data will not be sold or shared with third parties for commercial purposes outside the situations mentioned above.

7. Transfer of Data Abroad
Where necessary for the provision of the service, your data may be transferred to countries that offer an adequate level of protection according to the KVKK and the GDPR, or – if required – transferred abroad with your express consent.

8. Data security
The following measures are taken to protect your personal data:

• Technical measures to prevent unauthorized access (encryption, firewalls, SSL, etc.)

• Authorization and access controls

• Confidentiality obligations for personnel

9. Rights of the Data Subject
Under Article 11 of the KVKK and Articles 15–22 of the GDPR, data subjects have the following rights:

• Right to access personal data

• Right to rectification (correction) of data

• Right to erasure (deletion) of data

• Right to request restriction of processing

• Right to data portability

• Right to object to processing

• Right to withdraw consent

To exercise these rights, you can contact us using the contact details provided on our website.

10. Changes to this Policy
This policy may be updated from time to time. The updated version will become effective upon publication on our website.