1. Data controller
Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed by [Vitrinda operator company name, address, MERSIS no.] (“Vitrinda”) as data controller, as described below. For purchases from stores, the seller concerned is also a data controller for your order details.
2. Data processed
- Identity and contact: name, e-mail, phone.
- Delivery: address, city and country.
- Customer transactions: orders, favourites, questions, reviews, live support messages, accepted contracts.
- Transaction security: session data, an irreversible hash of your password, failed sign-in attempts.
- For sellers: legal name, tax details, IBAN and store contact details.
3. Purposes and legal grounds
Your data is processed to create and manage your account, pass orders to sellers and deliver them, conclude and keep the pre-contract information form and distance sales contract, provide customer service, keep the service secure and meet legal obligations; on the grounds in KVKK Art. 5/2 (c) formation and performance of a contract, (ç) legal obligation and (f) legitimate interest.
4. Transfers
When you order, your name, contact and delivery details are passed to the seller so they can fulfil the order. Data may also be processed by hosting (Cloudflare) and e-mail (Resend, if configured) providers to run the service; some of them are outside Türkiye and such transfers follow KVKK Art. 9. Data may be shared with competent authorities when the law requires it.
5. Retention
Accepted distance sales contracts and order records are kept for at least 3 years as required by law; other data is kept as long as the purpose requires and is then deleted, destroyed or anonymised.
6. Your rights
Under KVKK Art. 11 you may learn whether your data is processed, request information, ask for correction or deletion, learn the third parties it was transferred to, object, and claim compensation for damage. Send requests to [application e-mail address]; they are answered within 30 days at the latest. You can also delete your account and personal data yourself at any time under My Account → Account details; order records with a legal retention period are kept with your identity removed.
Cookies
Necessary cookies keep you signed in and remember your basket. The analytics cookie that measures store visits is used only with your consent; see the Cookie policy for details and to change your choice.