PERSONAL DATA PROTECTION DISCLOSURE NOTICE
1. Data Controller
Pursuant to the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data may be processed by ANATOLİ TASARIM DEKORASYON HEDİYELİK EŞYA SAN. TİC. A.Ş. in its capacity as data controller, within the scope described below.
Company Title: ANATOLİ TASARIM DEKORASYON HEDİYELİK EŞYA SAN. TİC. A.Ş.
Address: Levazım Mah. Vadi Cad. Zorlu Center No:2/154 Beşiktaş / İstanbul / Türkiye
E-mail: info@anatolihome.com
Phone: +90 (212) 320 82 04 / 05
Pursuant to Article 10 of the KVKK, the data controller is obliged to inform data subjects about the purposes for which personal data is processed, to whom it may be transferred, the method and legal grounds of its collection, and the rights of the data subject.
2. Personal Data Processed
If you visit our website, create a membership, place an order, contact us or share your campaign/communication preferences, the following personal data of yours may be processed:
* Identity information: name, surname
* Contact information: phone number, e-mail address, delivery and billing address
* Customer transaction information: order details, cart details, payment/refund/exchange records, request and complaint records
* Transaction security information: IP address, log records, device and browser information, session information
* Financial transaction information: payment method information, collection/refund transaction records
* Marketing information: commercial electronic message consent/rejection records, campaign preferences
* Legal transaction information: records relating to disputes, applications and evidentiary processes
Personal data is processed in accordance with the general principles set out in the KVKK: lawfully and in good faith; accurately and, where necessary, kept up to date; for specific and legitimate purposes; and in a manner that is relevant, limited and proportionate to the purposes for which it is processed.
3. Purposes of Processing Personal Data
Your personal data may be processed for the following purposes:
* carrying out membership and account management processes
* receiving, preparing and delivering orders and carrying out after-sales operations
* carrying out payment, collection, refund and exchange transactions
* carrying out customer relations, request, suggestion and complaint processes
* ensuring information security, transaction security and audit processes
* fulfilling legal obligations
* providing information to authorized public institutions and organizations
* resolving disputes and establishing, exercising or protecting rights
* where explicit consent is required, carrying out campaign, marketing and commercial electronic message processes
Under the KVKK, data processing activities must be based not on a single general "explicit consent" but on a legal ground appropriate to the specific processing activity. Explicit consent should be used only where required by the legislation or where no other legal grounds exist.
4. Legal Grounds for Processing Personal Data
Your personal data may be processed on the basis of the following legal grounds set out in Article 5 of the KVKK:
* it being directly related to the conclusion or performance of a contract
* it being mandatory for the data controller to fulfill its legal obligations
* data processing being mandatory for the establishment, exercise or protection of a right
* data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
* where necessary, the explicit consent of the data subject
For example, order, delivery, invoicing and refund processes are mostly carried out on the grounds of performance of a contract and legal obligation; information security and fraud prevention processes on the grounds of legitimate interest or legal obligation; and commercial electronic messages and non-essential cookies within the scope of cases requiring explicit consent/approval.
5. Method of Collecting Personal Data
Your personal data may be collected in electronic or physical form through:
* website membership and order forms,
* payment screens,
* contact forms,
* e-mail, phone and customer service channels,
* cookies and similar technologies,
* shipping companies, payment institutions, infrastructure and software service providers,
* authorized public institutions and organizations.
The disclosure under Article 10 of the KVKK must be made at the time the personal data is obtained.
6. Transfer of Personal Data
Your personal data may be transferred, to the extent required by the processing purposes and in accordance with Articles 8 and 9 of the KVKK, to the following parties:
* payment institutions and banks
* shipping and logistics companies
* e-invoice / e-archive, accounting and finance service providers
* hosting, software, infrastructure, security, maintenance and technical support providers
* parties from whom legal, audit and consultancy services are obtained
* authorized public institutions and organizations
* courts and enforcement authorities
Where personal data is transferred abroad, such transfer is carried out only if the conditions set out in Article 9 of the KVKK are met. In this context, the transfer may be carried out on the basis of explicit consent, an adequacy decision, appropriate safeguards or the incidental cases specified in the law. If services such as Shopify, cloud infrastructure, e-mail services, analytics tools or advertising technologies use servers located abroad, this matter must also be specifically addressed.
7. Retention Period of Personal Data
Your personal data is retained for the period stipulated in the relevant legislation or for as long as necessary for the purposes for which it is processed. When the retention period expires, the data is deleted, destroyed or anonymized in accordance with the legislation.
When determining the retention period, the following are taken into account:
* commercial and tax legislation,
* consumer legislation,
* e-commerce and commercial communication legislation,
* log and transaction security obligations,
* dispute and limitation periods.
Personal data should not be retained unnecessarily once the purpose has ceased to exist.
8. Rights of the Data Subject
Pursuant to Article 11 of the KVKK, as a data subject you have the following rights:
* to learn whether your personal data is being processed
* to request information if it has been processed
* to learn the purpose of the processing and whether the data is used in accordance with that purpose
* to know the third parties to whom the data is transferred, whether domestically or abroad
* to request correction if the data has been processed incompletely or inaccurately
* to request deletion or destruction of the data within the conditions stipulated in the KVKK
* to request that the correction/deletion/destruction operations carried out be notified to the third parties to whom the data has been transferred
* to object to the emergence of a result to your detriment through the analysis of the data exclusively by automated systems
* to claim compensation for damages in case of damage arising from unlawful processing of the data
These rights are expressly regulated in Article 11 of the KVKK. Applications must be duly submitted to the data controller.
9. Application Procedure
You may submit your requests under the KVKK to our Company, together with information and documents verifying your identity, using one of the application methods provided for in the applicable legislation.
Contact:
E-mail: info@anatolihome.com
Address: Levazım Mah. Vadi Cad. Zorlu Center No:2/154 Beşiktaş - İstanbul / Türkiye
Your applications will be concluded as soon as possible and within 30 days at the latest, depending on the nature of the request.
10. Data Security
Pursuant to Article 12 of the KVKK, our Company endeavors to take appropriate technical and administrative measures to prevent the unlawful processing of and access to personal data and to ensure the safekeeping of personal data. Access control, logging, firewalls, updates, authorization management and contractual obligations may be among these measures. In the event of a possible data breach, the necessary assessment and notification processes are carried out within the framework of the obligations under the legislation.
11. Updates
This Disclosure Notice may be updated in line with legislative changes and operational needs. The current version becomes effective as of the date it is published on our website.