General Information on the Personal Data Act

Law No. 6698 on the Protection of Personal Data (hereinafter referred to as KVKK) was adopted on March 24, 2016, and published in the Official Gazette dated April 7, 2016, and numbered 29677. Some parts of the KVKK came into force on the date of publication, while others came into force on October 7, 2016.

Information as Data Controller

In accordance with KVKK No. 6698 and as the Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties in situations permitted by law, classified, and processed in the ways listed in the KVKK, as outlined on this page.

How your personal data may be processed

In accordance with KVKK No. 6698, the personal data you share with our Company may be processed by us, fully or partially, automatically, or non-automatically as part of any data recording system, by obtaining, recording, storing, modifying, reorganizing, in short, by subjecting it to any operation performed on the data. Any operation performed on data within the scope of KVKK is considered "processing of personal data."

Purposes and legal grounds for processing your personal data

Your shared personal data will be processed:

• To fulfill the requirements of the services we provide to our customers, in accordance with the contract and technological requirements, and to improve our products and services;
• To record identification, address, and other necessary information to identify the transaction owner within the scope of Law No. 6563 on the Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette dated 26.08.2015 and numbered 29457, the Regulation on Distance Contracts published in the Official Gazette dated 27.11.2014 and numbered 29188, and other relevant legislation;
• To arrange all records and documents that will form the basis of processing in payment systems, electronic contracts, or paper media that are mandatory in the field of banking and electronic payment; to comply with information storage, reporting, and disclosure obligations stipulated by legislation and other authorities;
• To provide information to prosecutor's offices, courts, and relevant public officials upon request and in accordance with legislation, in matters related to public safety and legal disputes;

in accordance with KVKK No. 6698 and related secondary regulations. Information about third parties or organizations to whom your personal data may be transferred For the purposes mentioned above, the persons/organizations to whom your personal data shared with our Company may be transferred are; primarily IdeaSoft Yazılım San. ve Tic. A.Ş., which provides our Company's e-commerce infrastructure, as well as persons and organizations related to the services provided, such as suppliers and cargo companies, program partner organizations with whom we cooperate and/or receive services as Data Processors to carry out our activities, domestic/foreign organizations, and other third parties.

Method of collecting your personal data

Your personal data may be processed and collected:

• Through forms on our Company's website and mobile applications, including information such as name, surname, Turkish ID number, address, phone number, business or private e-mail address; preferences on pages accessed using username and password, IP records of performed transactions, cookie data collected by the browser, and data containing navigation time and details, as well as location data;
• Through our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call center channels, verbally, in writing, or electronically;
• From individuals who share their personal data through business cards, resumes (CVs), bids, and other means for purposes such as establishing a commercial relationship with our Company, applying for a job, making an offer, in a physical or virtual environment, face-to-face or remotely, verbally or in writing, or electronically;
• Additionally, data obtained indirectly from different channels, from (micro) websites and social media used for purposes such as website, blog, contest, survey, game, campaign, and similar, e-newsletter reading or clicking actions, data provided by publicly available databases, and publicly shared profiles and data from social media platforms.

Your personal data obtained before KVKK came into force

Your personal data obtained legally before April 7, 2016, the effective date of KVKK, through membership, electronic communication consent, product/service purchase, and other forms, is also processed and stored in accordance with the terms and conditions set forth in this document.

Transfer of your personal data abroad

Your personal data collected by any of the methods listed above, whether processed in Turkey or processed and stored abroad, may be transferred to service intermediaries abroad (to countries accredited by the Personal Data Board and where sufficient protection of personal data is provided) within the scope of KVKK and in accordance with the contract purposes.

Storage and protection of personal data

Your personal data will be stored confidentially in the database and systems within our Company in accordance with Article 12 of the KVKK; it will not be shared with third parties under any circumstances, except for legal obligations and the regulations specified in this document. Our Company is obligated to prevent the unlawful processing of your personal data, prevent unauthorized access, and take software measures such as access management and physical security measures for the systems and databases where your personal data is hosted, in accordance with Article 12 of the KVKK. In the event that personal data is learned to have been obtained by others through unlawful means, the situation will be immediately reported to the Personal Data Protection Board in accordance with legal regulations and in writing.

Keeping personal data accurate and up-to-date

In accordance with Article 4 of the KVKK, our Company has an obligation to keep your personal data accurate and up-to-date. In this context, for our Company to fulfill its obligations arising from the current legislation, our Customers must share or update their accurate and up-to-date data through the website/mobile application.

Rights of the personal data owner pursuant to KVKK No. 6698

Article 11 of KVKK No. 6698 came into force on October 7, 2016, and in accordance with the relevant article, the rights of the Personal Data Owner after this date are as follows: The Personal Data Owner, by applying to our Company (data controller), regarding themselves, has the right to:

1. Learn whether personal data is processed,
2. Request information if personal data has been processed,
3. Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
4. Know the third parties to whom personal data is transferred domestically or abroad,
5. Request correction of personal data if it is incomplete or incorrectly processed,
6. Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK,
7. Request that these operations be notified to third parties to whom personal data has been transferred in case of correction, deletion, or destruction of personal data,
8. Object to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,
9. Request compensation for damages in case personal data is processed unlawfully,

[Full Company Name], registered with the [................] Chamber of Commerce under registration number [..........................], with MERSİS number [.............................], located at [.......................................................................], is the Data Controller within the scope of KVKK. The Data Controller Representative to be appointed by our Company will be announced in the Data Controllers Registry and on the website where this document is located when the legal infrastructure is provided. Personal Data Owners can direct their questions, opinions, or requests to any of the following communication channels:

Email: info@goodthingsatelier.com

Phone: 0549 807 43 74