ZeccaShop.Com Personal Data Policy

General Information on the Personal Data Protection Law

The Law No. 6698 on the Protection of Personal Data (hereinafter referred to as PDPL) was adopted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. Part of the PDPL entered into force on the date of publication, while the remaining part entered into force on October 7, 2016.

Information as Data Controller

In accordance with PDPL No. 6698 and as the Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties in cases permitted by legislation, classified, and processed in the manners enumerated in the PDPL within the framework explained on this page.

How Your Personal Data May Be Processed

Pursuant to PDPL No. 6698, your personal data that you share with our Company may be processed by us, in whole or in part, automatically, or non-automatically provided that it is part of any data recording system, by being obtained, recorded, stored, altered, rearranged; in short, as the subject of any kind of processing performed on the data. Any operation performed on data within the scope of PDPL is accepted as the "processing of personal data".

Purposes and Legal Grounds for Processing Your Personal Data

The personal data you share will be processed in accordance with PDPL No. 6698 and related secondary regulations for the following purposes:

• To fulfill the requirements of the services we provide to our customers in accordance with the contract and technology, and to improve our offered products and services;

• To record identity, address, and other necessary information to identify the information of the transaction owner within the scope of the Law No. 6563 on the Regulation of Electronic Commerce, the Consumer Protection Law No. 6502, the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette No. 29457 dated 26.08.2015, the Distance Contracts Regulation published in the Official Gazette No. 29188 dated 27.11.2014, and other relevant legislation;

• To arrange all records and documents that will be the basis of processing in electronic or paper environments, and payment systems which are mandatory in the field of Banking and Electronic Payments; to comply with information retention, reporting, and disclosure obligations stipulated by legislation and other authorities;

• To be able to provide information to prosecutors' offices, courts, and relevant public officials upon request and as required by legislation in matters regarding public safety and legal disputes.

Information About Third Parties or Organizations to Whom Your Personal Data May Be Transferred

For the purposes stated above, the persons / organizations to whom your personal data shared with our Company may be transferred are: our suppliers, cargo companies, and related persons and organizations regarding the services provided, especially IdeaSoft Yazılım San. ve Tic. A.Ş., which provides our Company's e-commerce infrastructure; program partner organizations we collaborate with to carry out our activities and/or receive services as Data Processors, domestic / foreign organizations, and other 3rd parties.

Method of Collecting Your Personal Data

Your personal data may be processed and collected:

• Through forms on our Company's website and mobile applications, with information such as name, surname, TR identity number, address, telephone, business or private e-mail address; in the form of preferences on pages logged in using a username and password, IP records of transactions performed, cookie data collected by the browser, and data containing browsing duration and details, as well as location data;

• Verbally, in writing, or electronically through our channels such as our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call center;

• Received from people who share their personal data for purposes such as establishing a commercial relationship with our Company, applying for a job, submitting an offer, via business cards, resumes (CV), bidding, and other means, in a physical or virtual environment, face-to-face or at a distance, verbally, in writing, or electronically;

• In addition, data obtained indirectly from different channels, from (micro) websites and social media used for website, blog, contest, survey, game, campaign, and similar purposes, e-newsletter reading or clicking movements, data provided by public databases, profiles and data open to sharing from social media platforms.

Your Personal Data Obtained Before the PDPL Entered into Force

Your personal data that was lawfully obtained before April 7, 2016, the effective date of the PDPL, through membership, electronic communication permission, product / service purchase, and other means, are also processed and preserved in accordance with the terms and conditions set forth in this document.

Transfer of Your Personal Data Abroad

To be processed in Turkey or processed and stored outside Turkey, your personal data collected by any of the methods listed above may also be transferred to service intermediaries located abroad (to countries accredited by the Personal Data Protection Board and where there is adequate protection for personal data), provided that they remain within the scope of PDPL and in accordance with the contract purposes.

Storage and Protection of Personal Data

Your personal data will be kept confidential in the database and systems belonging to our Company in accordance with Article 12 of the PDPL; they will not be shared with third parties in any way other than legal obligations and the regulations stated in this document. Our Company is obliged to prevent the unlawful processing of personal data, prevent unauthorized persons from accessing, and take software measures such as access management and physical security measures for the systems and databases where your personal data are hosted, in accordance with Article 12 of the PDPL. If it is learned that personal data has been obtained by others through illegal means, the situation will be immediately notified to the Personal Data Protection Board in writing and in accordance with legal regulations.

Keeping Personal Data Up-to-Date and Accurate

Pursuant to Article 4 of the PDPL, our Company has an obligation to keep your personal data accurate and up-to-date. In this context, in order for our Company to fulfill its obligations arising from applicable legislation, our Customers must share their accurate and up-to-date data or update it via the website / mobile application.

Rights of the Personal Data Owner Pursuant to PDPL No. 6698

Article 11 of PDPL No. 6698 entered into force on October 07, 2016, and in accordance with the relevant article, the rights of the Personal Data Owner after this date are as follows: By applying to our Company (data controller), the Personal Data Owner has the right to:

1. Learn whether personal data is processed or not,

2. Request information if personal data has been processed,

3. Learn the purpose of processing personal data and whether they are used in accordance with their purpose,

4. Know the third parties to whom personal data is transferred at home or abroad,

5. Request correction of personal data in case of incomplete or incorrect processing,

6. Request the deletion or destruction of personal data within the framework of the conditions set forth in Article 7 of the PDPL,

7. Request notification of the operations made regarding correction, deletion, or destruction of personal data to third parties to whom personal data has been transferred,

8. Object to the occurrence of a result against the person themselves by analyzing the processed data exclusively through automated systems,

9. Request compensation for damages in case of suffering damage due to unlawful processing of personal data.

[Company Full Title], registered with the Istanbul Chamber of Commerce under registration number 962517-0, holding MERSIS number 0997-0705-3070-0018, and located at Hrant Dink Sokak No:35 Osmanbey Istanbul, is the Data Controller within the scope of PDPL. The Data Controller Representative to be appointed by our Company will be announced in the Data Controllers Registry and on the internet address where this document is located once the legal infrastructure is provided.

Personal Data Owners can direct their questions, opinions, or requests to any of the following communication channels: