This notice is provided by Mert Pektaş as data controller under Article 10 of Personal Data Protection Law No. 6698 ("KVKK").
1.Data controller
- Trade name: Mert Pektaş
- Address: Bahçesaray, Konya
- Phone: 0 507 307 61 91
- Email: mertpeko60@gmail.com
- Website: mertpektas.com
2.Personal data processed, purposes and legal grounds
| Data category | Examples | Purpose | Legal ground (KVKK Art. 5/2) |
|---|---|---|---|
| Identity | Name, Turkish ID no. (optional, for invoices) | Membership, orders, invoicing | (c) contract performance, (ç) legal obligation |
| Contact | Phone, email, delivery and billing address | Delivery, order and support communication | (c) contract performance |
| Customer transaction | Orders, cart (for members, with the copy saved to the account), favourites, saved addresses and billing details, messages, return/cancellation requests and the photos attached to them, coupon use, stock-alert requests | Sales, after-sales support, legal records | (c) contract performance, (ç) legal obligation |
| Product review | The review and rating you write for an order you received; published on the product page with your name and city | Publishing verified-buyer reviews | Explicit consent (Art. 5/1); you give separate consent when writing the review |
| Marketing (permission only) | Your commercial message permissions; your email address if you subscribed to the newsletter | Campaign and news emails and SMS | Explicit consent / commercial electronic message approval (Law no. 6563) |
| Financial | Payment status, last 4 card digits, transaction ID | Payment verification, refunds, accounting | (c), (ç); card details are processed only by iyzico |
| Transaction security | IP address, signed-in devices (browser type and partially masked IP), session and log records, failed logins, bot-protection result | Account security, fraud prevention, legal requests | (ç) legal obligation, (f) legitimate interest |
| Legal transaction | Agreement approval time, withdrawal notices | Evidence of consent to distance contracts | (e) establishing or protecting a right |
| Analytics (only with consent) | Anonymised usage statistics (Google Analytics) | Improving the site | Explicit consent (Art. 5/1) |
3.Method of collection
Data is collected electronically through the membership, checkout and contact forms, the account area, cookies and similar technologies, and by phone/WhatsApp when you contact us.
4.Transfers
- iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) — payment processing and fraud checks
- Cargo companies — delivery of orders (name, address, phone)
- Financial advisor / accountant and e-invoice service providers — legal accounting obligations
- SMS service provider — sending order and shipping notification texts (phone number and message content)
- İleti Yönetim Sistemi A.Ş. (İYS) — recording your commercial message permissions and opt-outs as required by law
- netcup GmbH (Germany) — hosting and database; transfers abroad are made in accordance with Article 9 KVKK (standard contract notified to the Authority)
- Resend, Inc. (USA) — sending order confirmation and reply emails (name, email address and order content); transfer abroad in accordance with Article 9 KVKK (standard contract notified to the Authority)
- Google LLC (Google Analytics) — only if you consent to analytics cookies; involves transfer abroad based on your explicit consent
- Google LLC (Sign in with Google) — only if you choose this option: Google confirms your name and email address to us; your password is never shared with us
- Cloudflare, Inc. (USA) — all site traffic passes through its network (secure connection, attack protection, caching), so your IP address and request details are processed; our encrypted database backups are stored with it; when enabled on the registration and password-reset forms, Turnstile bot protection checks your IP address and browser signals to tell people from automated software; no advertising profile is built; transfer abroad in accordance with Article 9 KVKK (standard contract notified to the Authority)
- Authorised public institutions and courts — on legal request
Your data is not sold or shared with third parties for marketing purposes.
5.Retention periods
- Order, invoice and accounting records: 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law)
- Distance contract and pre-information records: 3 years (Distance Contracts Regulation Art. 18)
- Membership data: until the account is deleted; data required for legal obligations is then kept for the periods above
- Contact messages: 2 years from the last correspondence
- Order attempts whose payment was never completed: 30 days
- Sign-in session (device) records: 30 days after the session ends; email confirmation and password-reset links: until used or expired, then at most 7 days
- Stock-alert requests: until the notice is sent, then 30 days; unanswered requests at most 1 year
- Return/cancellation requests and their photos: together with the related order record
- Product reviews: until you ask for deletion or withdraw your consent; if you delete your account your name is removed from the review
- Cart saved to your account: until you order or empty the cart
- Cookie choice and marketing permission records: 3 years (kept as proof even after withdrawal)
- Newsletter subscription: until you unsubscribe; the record is then kept for 3 years as proof
- Security logs: up to 2 years
At the end of these periods data is deleted, destroyed or anonymised.
6.Your rights (KVKK Art. 11)
- learn whether your personal data is processed and request information about it
- learn the purpose of processing and whether data is used accordingly
- know the third parties in Türkiye or abroad to whom data is transferred
- request correction of incomplete or inaccurate data
- request deletion or destruction under Article 7
- request notification of correction/deletion to third parties
- object to an outcome against you arising from automated analysis
- claim compensation for damages arising from unlawful processing
7.How to apply
You can submit requests in writing to Bahçesaray, Konya, by email to mertpeko60@gmail.com from the address registered with us, in accordance with the Communiqué on Application Procedures. Requests are answered free of charge within 30 days at the latest. You can also send your request through the Contact form on this site by choosing the subject “Data request (KVKK)”, and delete your account yourself under My account > Notification & contact preferences.
