Personal Data Protection and Privacy Policy

Data Controller and Contact Information

Your personal data is processed by Kiğılı Giyim Ticaret A.Ş. as the data controller. (Please clarify your information here, such as title, address, MERSİS number, tax number, etc.)

• Company Name: Kiğılı Giyim Ticaret A.Ş.
• Address: [Company address will go here]
• Email: [KVKK contact email address]
• KEP Address: [KEP address if available]
• Phone: [headquarters phone number]

Categories of Personal Data Processed

Within the scope of your relationship with Kiğılı, the following categories of personal data may be processed:

• Identity Information: Name, surname, Turkish Republic identity number (if required), date of birth, etc.
• Contact Information: Phone number, email address, postal address, etc.
• Customer Transaction Information: Order, shopping cart, return/exchange records, call center records.
• Payment/Financial Information: Payment method, partial card information (masking), billing information.
• Marketing Insights: Campaign permissions, preferences, and segmentation data based on shopping history.
• Online Visitor Data: IP address, cookie data, log records, device and browser information.

Purposes of Processing Personal Data

Your personal data is processed for the following purposes, depending on the nature of your relationship with Kiğılı:

• Managing order, sales, and after-sales support processes.
• Managing product delivery and logistics operations.
• Managing membership and customer account transactions.
• Managing customer service, request, and complaint processes.
• Billing, accounting, and financial record keeping.
• Management of campaigns, promotions, personalized offers, and marketing communications (within the scope of relevant permissions and explicit consent).
• Fulfilling legal obligations and complying with requests from official institutions.
• Conducting security audits to prevent fraud and abuse.

Parties to Whom Personal Data is Transferred

In accordance with Articles 8 and 9 of the KVKK (Law on Protection of Personal Data) and relevant legislation, your personal data may be transferred to the following parties:

• Logistics and cargo companies for product delivery.
• Banks and payment institutions for payment processing.
• Service providers that support information technology infrastructure.
• Business partners offering call center, marketing, and customer satisfaction services.
• Lawyers, consultants, and auditors to handle legal processes.
• Authorized public institutions and organizations as required by relevant legislation.

If data transfer abroad is involved, further information will be provided depending on the scope and systems used, and your explicit consent will be obtained where necessary.

Method of Collection of Personal Data and Legal Basis

Your personal data is collected electronically or physically through Kiğılı stores, website, mobile application, call center, social media channels and similar channels.

Your data is processed primarily based on the following legal grounds:

• It must be necessary for the formation or performance of a contract.
• It is necessary for the data controller to fulfill its legal obligations.
• Data processing is necessary for the establishment, exercise, or protection of rights.
• Data processing is necessary for Kiğılı's legitimate interests, provided that it does not prejudice your fundamental rights and freedoms.
• Your explicit consent is required (especially for marketing and commercial communication activities).

Personal Data Retention Periods

Your personal data is stored for the period necessary for the processing purposes, subject to the periods stipulated in the relevant legislation; after this period , it is deleted, destroyed, or anonymized in accordance with periodic destruction policies.

• Storage periods specifically stated in the legislation.
• Limitations periods vary depending on the contractual relationship.
• Mandatory retention periods for financial and accounting records.

Your Rights Under the Personal Data Protection Law (KVKK)

In accordance with Article 11 of the KVKK (Turkish Personal Data Protection Law), you can exercise the following rights by applying to Kiğılı:

• Find out if your personal data is being processed.
• If it has been processed, request information about it.
• To understand the purpose of the processing and whether it is being used for its intended purpose.
• Knowing the third parties to whom it is transferred, whether domestically or internationally.
• Requesting corrections if they are incomplete or incorrectly processed.
• Even if personal data is processed in accordance with the KVKK (Personal Data Protection Law) and other relevant laws, the right to request the deletion or destruction of personal data if the reasons requiring its processing cease to exist.
• Requesting that third parties to whom the data has been transferred be notified of any corrections, deletions, or destructions.
• You have the right to object to an outcome that is unfavorable to you, resulting solely from the analysis of processed data by automated systems.
• You have the right to claim compensation for damages you have suffered as a result of the unlawful processing of your personal data.

Application and Communication Methods

To exercise your rights under the KVKK (Turkish Personal Data Protection Law), you can apply to Kiğılı in writing or through registered electronic communication channels.

• By mail: [Company address / GDPR application address]
• By email: [KVKK application email address]
• Via KEP address: [KEP address if available]
• GDPR application form on the website (provide a link if available).

Your applications will be processed as soon as possible, and no later than 30 days , depending on the nature of the request. In necessary cases, fees may be charged in accordance with the conditions specified in the Personal Data Protection Law (KVKK) and relevant legislation.