PRIVACY POLICY (“POLICY”) AND CLARIFICATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA (“CLARIFICATION TEXT”)


Zeynep GÜLER YÖNT

12001 SOK NO:71 HACIMEMİŞ MAH ALAÇATI ÇEŞME İZMİR

[Tax No:] 4190833785

[Website] manahistanbul.com


Manahistanbul.com is the owner of the website and all related pages and mobile applications ("Website") under the domain name. The Company is a data controller in terms of personal data of its Website customers and users in accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK"). As a data controller, the Company attaches utmost importance to the privacy and protection of your personal data. The purpose of this Privacy Policy and Clarification Text is to inform Website visitors and users about personal data processing activities in accordance with the disclosure obligation set forth in Article 10 of the KVKK.


This Privacy Policy and Clarification Text may be updated as necessary for the purpose of offering new services or fulfilling current legal requirements. Website users should regularly check for updates.


"Company" and "we" refer to Zeynep GÜLER YÖNT with headquarters at [12001 sok no:71 Hacımemiş mah ALAÇATI ÇEŞME İZMİR.

"Data Subject" refers to the natural person whose personal data is processed.

"Products" refers to the products offered for sale on the Website.


  1. Principles We Observe When Processing Personal Data

The Company acts in accordance with the fundamental principles specified in the KVKK when processing personal data. These fundamental principles are listed below:

  1. To comply with the law and good faith,

  2. To be accurate and, where necessary, up-to-date,

  3. To be processed for specific, explicit, and legitimate purposes,

  4. To be relevant, limited, and proportionate to the purpose for which they are processed,

  5. To be stored for the period stipulated in the relevant legislation or required for the purpose for which they are processed.


  1. What is the Legal Basis for Processing Personal Data?

The Company processes personal data only lawfully and if at least one of the following conditions is met, as stated in Article 5 of the KVKK.


The data subject's (relevant person's) explicit consent is present: The explicit consent of the data subject must be related to a specific matter, based on information, and declared with free will. Personal data is processed within the scope of the data subject's explicit consent and for the purposes stated in the explicit consent. As a rule, if the other conditions below are met, there is no need to obtain the explicit consent of the data subject separately.


Explicitly stipulated in laws: In cases where data processing is permitted by law, the personal data of the data subject is processed limited to the reasons and data categories specified in the relevant law.


Inability to Obtain the Data Subject's Explicit Consent Due to Factual Impossibility: If it is mandatory to process personal data to protect the life or physical integrity of the person who is unable to express their consent due to factual impossibility or whose consent cannot be validated, or of another person, the personal data of the data owner may be processed.


Directly Related to the Establishment or Performance of a Contract: Personal data belonging to the parties of a contract may be processed if it is necessary to process such data, provided that it is directly related to the establishment or performance of the contract (on the condition that the person whose data will be processed based on the establishment or performance of the contract is one of the parties to the contract).


Fulfillment of the Company's Legal Obligation: If data processing is mandatory for the Company to fulfill its legal obligations, the personal data of the data subject may be processed.


Public Disclosure of Personal Data by the Data Subject: If the data owner has made their personal data public, the relevant personal data may be processed, limited to the purpose of disclosure.


Mandatory Data Processing for the Establishment or Protection of a Right: If data processing is mandatory for the establishment, exercise, or protection of a right, the personal data of the data owner may be processed.


Mandatory Data Processing Due to Legitimate Interests: If data processing is mandatory for the Company's legitimate interests, provided that it does not harm the fundamental rights and freedoms of the personal data owner, the personal data of the data owner may be processed.


  1. Which Personal Data is Processed?

The table below provides detailed information on which personal data we process and under what conditions.


Personal Data

Legal Basis

Scope

Customer's name, surname, title, Turkish ID number, tax ID number, address

(i) Performance of the sales contract,

(ii) Tax laws

When a customer purchases a Product on the Website, this information is recorded for invoicing the order.

Customer's name, surname, and address information

Performance of the Sales Contract

Recorded for the delivery of the purchased Product.

Customer's name, surname, title, email address

Performance of the Sales Contract

When a customer purchases a Product from the Website, this information is recorded to manage customer satisfaction processes within the scope of contract performance, such as possible complaints regarding the Product or delivery, informing about delivery delays, or product returns.

Customer invoices

(i) Tax laws

(ii) For the establishment or protection of a right

(i) Invoices are stored until the end of the relevant statute of limitations periods for the preparation of tax declarations and tax audits.

(ii) Stored until the end of the legal statute of limitations periods to resolve legal disputes with customers and to defend against legal proceedings.

Customer contracts

For the establishment or protection of a right

Stored until the end of the legal statute of limitations periods to resolve legal disputes with customers and to defend against legal proceedings.

IP address

Legitimate interest

Processed to identify IP addresses of those who violate the security of the Website and attempt to use it for illegal purposes, and to prevent them from accessing the Website again.

Email address

Explicit consent

We record your email address only with your explicit consent if you give commercial electronic consent to send campaign, promotion, discount news about our products and services, and to send monthly/weekly newsletters about our products and services.


  1. Transfer of Personal Data to Third Parties

Depending on the processing conditions specified above, we need to transfer some personal data to third-party companies and firms from whom we receive services.


  1. Payments for purchases made through the Website are made via the iyzico payment system (iyzi Payment and Electronic Money Services Inc.), which is a third-party payment system service. When you purchase a Product from the Website, your identity information, order details, and price are transferred to Iyzico. The Company does not see the information related to your credit card that you provide to iyzico (credit card number, expiry date, etc.). For more details on the protection of your personal data, you can read Iyzico's privacy policy here https://www.iyzico.com/gizlilik-politikasi#gizlilik-kiisel-veri-politikas.


  1. We need to receive server (hosting) services for the operation of the Website. The companies from which we receive server services process personal data specified in Paragraph III above as data processors. We sign a personal data processing agreement with these companies in accordance with the KVKK.


  1. We receive services from a third-party service provider company for Website design and maintenance. This company may have access to personal data within the scope of the services it provides. We sign a personal data processing agreement with this company in accordance with the KVKK.


  1. We share your personal data with law enforcement agencies and other authorized institutions when legally required or to prevent a crime.


  1. Transfer of Personal Data Abroad

It is specified below which of your personal data may be transferred abroad.

  1. Users' email addresses are shared with the electronic communication service provider to send campaign, promotion, discount news about our products and services, and monthly/weekly newsletters about our products and services if they consent to receive commercial electronic communication.


As an electronic communication service provider, we use the Mailchimp Platform established by The Rocket Science Group LCC, headquartered at 675, Ponce de Leon Ave. NE, Suite 5000, Atlanta, GA, 30308 USA. You can read Mailchimp's privacy policy here: https://mailchimp.com/legal/privacy/

  1. We use the Google Universal Analytics service provided by Google Inc. to analyze how users use the Website. Google Universal Analytics processes personal data such as IP addresses using cookies and other identifiers to provide this service.


Google Inc. 1600 Amphitheatre Parkway Mountain View CA 94043, U.S.A. You can read the security and privacy policy of Google Universal Analytics here: https://support.google.com/analytics/answer/2838718?hl=en&ref_topic=6010376


For more information on cookies and to understand how you can set your Cookie Settings, please read our Cookie Policy.


  1. Administrative and Technical Measures Regarding Personal Data Security

In accordance with KVKK Article 12, the Company takes appropriate necessary measures to prevent unlawful processing of personal data, to prevent unlawful access to this data, to ensure its storage, and to prevent unlawful processing of personal data by third parties.


  1. Personal Data Retention Period

In cases where the reasons requiring the processing of personal data cease to exist, personal data is deleted, destroyed, or anonymized.



  2. Rights of Data Subjects Regarding Their Personal Data

The rights of data subjects arising from Article 11 of the KVKK are listed below.

  • To learn whether personal data has been processed,

  • To request information if personal data has been processed,

  • To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

  • To know the third parties to whom personal data has been transferred domestically or abroad,

  • To request correction of personal data if it is incomplete or incorrectly processed and to request notification of the transaction made within this scope to third parties to whom personal data has been transferred,

  • To request the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist, despite being processed in accordance with the KVKK and other relevant laws, and to request notification of the transaction made within this scope to third parties to whom personal data has been transferred,

  • To object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,

  • To request compensation for damages if personal data is processed unlawfully.


Data subjects can submit their requests regarding the rights specified above in writing to the contact information provided below, via registered electronic mail (KEP) address, secure electronic signature, mobile signature, or using the e-mail address previously notified to the Company and registered in the system.


Requests will be concluded free of charge as soon as possible and in any case within thirty days. If the transaction requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board will be applied.


  1. Contact Information

You can reach the Company at the following contact information for any questions regarding your personal data.

Company title: Zeynep GÜLER YÖNT

Mersis No: [∙]

Address: 12001 SOK NO:71 Hacımemiş mah Alaçatı Çeşme İZMİR
Email: info@rexyhandmade.com
Phone: +905320560434