Legal
Personal Data Notice
Last updated: June 17, 2026
Data Controller
[COMPANY NAME] ("Company" or "TAMARTAV") acts as data controller under Turkey's Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).
Company: [COMPANY NAME]
Address: [ADDRESS]
Email: [EMAIL]
Data We Collect
| Category | Data |
|---|---|
| Identity | First name, last name |
| Contact | Email, phone number, delivery address |
| Financial | Payment details — card data processed by PCI-DSS compliant provider, not stored by us |
| Transaction | Order history, cart, wishlist |
| Technical | IP address, browser type, cookie data, session info |
Purposes and Legal Bases
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Order processing and delivery | Performance of contract (Art. 6(1)(b)) |
| Invoicing and legal compliance | Legal obligation (Art. 6(1)(c)) |
| Customer support | Performance of contract (Art. 6(1)(b)) |
| Security and site operation | Legitimate interests (Art. 6(1)(f)) |
| Analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) — opt-in only |
Data Sharing
- Logistics providers — for order delivery
- Payment processors — for payment handling
- Infrastructure providers — hosting, email, cloud services
- Public authorities — when required by applicable law
International transfers to the EEA are made under Standard Contractual Clauses. Transfers outside the EEA are made with your explicit consent or under adequacy decisions.
Retention
| Category | Period | Basis |
|---|---|---|
| Orders and invoices | 10 years | Turkish Tax Procedure Law |
| Account data | Until deletion + 3 years | Statute of limitations |
| Marketing consent records | 3 years after withdrawal | Turkish E-Commerce Law 6563 |
| Access logs | 2 years | Turkish Internet Law 5651 |
Your Rights (GDPR Arts. 15–22)
- Access your personal data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure ("right to be forgotten") (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time without affecting lawfulness of prior processing (Art. 7(3))
- Lodge a complaint with your local supervisory authority
Contact us at [EMAIL] to exercise your rights. We respond within 30 days. EU residents may also contact their national data protection authority.