Clarification Text
PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA RELATED TO MEMBERSHIP AND CUSTOMER PROCESSES
1. Data Controller
Your personal data is processed by Aksen İpek Sanayi ve Dış Ticaret Ltd Şti (“Company” or “ipekshop”) as the data controller within the scope of the Personal Data Protection Law No. 6698 (“PDPL”).
Website: https://www.ipekshop.com
Company address: Sultançiftliği Mahallesi Parkverde Residence B1/8 Çekmeköy /İstanbul
Telephone: 0850 885 01 66
Email: info@ipekshop.com
This text has been prepared to explain how your personal data is processed during membership and shopping transactions carried out through our website, payment, delivery, returns, customer service, and marketing processes subject to your permissions.
2. Methods of Collecting Personal Data
Your personal data is collected through membership, order, and contact forms on our website, your customer account, email and telephone conversations, messages you send us via social media, payment and delivery notifications, and return and complaint applications.
Data may be processed electronically, fully or partially automatically, through information systems used in the Shopify e-commerce infrastructure, PayTR payment infrastructure, cargo services, and order processes. In processes such as written applications, non-automatic methods may also be used, provided they are part of a data recording system.
Information about data collection activities carried out with cookies and similar technologies is separately provided in the Cookie Policy and through the cookie preference panel.
3. Categories of Processed Personal Data
Depending on the transaction you carry out and the service you use, the following data may be processed:
| Data category | Information that may be processed |
|---|---|
| Identity | First and last name; Turkish Republic ID number, tax identification number, tax office, and commercial title when legally required for invoicing |
| Contact | Telephone number, email address, invoice and delivery address |
| Customer transactions | Membership and customer records, order and product information, purchase amount, delivery and cargo tracking, returns, exchanges, requests, complaints, and correspondence records |
| Finance | Payment method, transaction amount, payment result, and reference information; account holder and IBAN information when required for refunds |
| Legal transaction and permission records | Contract and preliminary information confirmations, explicit consent and commercial message permission/rejection records, application and dispute documents |
| Transaction security | Transaction and session records, IP address, device and browser information; verification and security records created by the system used |
| Marketing | Depending on the scope of permission, product interests, campaign interactions, shopping preferences, and advertising measurement information |
Not all of this data is collected from every user. Data is limited to the scope necessary for the relevant transaction.
Regarding card and payment information directly collected by the payment institution, the privacy notices of the relevant institution also apply.
4. Purposes of Processing and Legal Grounds
4.1. Membership, orders, and post-sales transactions
Necessary identity, contact, customer transaction, and financial data are processed for the purpose of creating and managing the membership account, receiving the order, tracking the payment, delivering the product, providing order information, and carrying out return and exchange transactions.
Legal ground: The necessity of processing the personal data of the parties within the scope of Article 5/2-c of the PDPL, provided that it is directly related to the establishment or performance of the contract.
4.2. Legal obligations
Relevant transaction records are processed for the purpose of issuing invoices, maintaining accounting records, fulfilling obligations arising from tax and consumer legislation, managing commercial message permissions in accordance with the legislation, and providing necessary information to authorized authorities.
Legal grounds: Necessity under Article 5/2-a of the PDPL as expressly provided by laws according to the specific obligation, or under Article 5/2-ç as mandatory for the data controller to fulfill its legal obligation.
4.3. Requests, complaints, and protection of rights
Necessary data is processed for the purpose of evaluating your applications, resolving disputes related to purchases, retaining contract and transaction records as evidence, and conducting legal processes.
Legal ground: The necessity of processing data under Article 5/2-e of the PDPL for the establishment, exercise, or protection of a right. For requests falling within the scope of contract performance or legal obligation, other relevant processing conditions apply.
4.4. Security and continuity of service
Necessary transaction and security records are processed for the purpose of detecting unauthorized access and suspicious transactions, resolving system errors, ensuring information security, and evaluating service quality.
Legal ground: The necessity of processing data for the legitimate interests of the Company under Article 5/2-f of the PDPL, provided that the fundamental rights and freedoms of the data subject are not harmed. In cases where there is a specific legal obligation or a need to protect a right, the relevant processing condition is taken as the basis.
Necessity, proportionality, and the rights of individuals are considered in the assessment of legitimate interests.
4.5. Permission-based marketing activities
Personalization, customer segmentation, behavioral analysis, remarketing, and advertising measurement activities requiring explicit consent are carried out within the scope of your relevant explicit consent.
Legal ground: Explicit consent under Article 5/1 of the PDPL.
The scope of these activities is separately explained in the relevant permission text and, if necessary, in the cookie preference panel. Not granting permission does not prevent you from benefiting from membership and shopping services.
The necessary consent for sending commercial electronic messages required by the relevant legislation is obtained separately. Service notifications such as orders, payments, and deliveries are evaluated separately from advertising permissions.
5. Recipients to Whom Personal Data Is Transferred and Purposes of Transfer
Your personal data may be transferred to the following recipient groups, limited to the scope necessary and related to the relevant purpose:
| Recipient / recipient group | Purpose and scope of transfer |
|---|---|
| Technical service providers used by Shopify and the store | Operating the e-commerce infrastructure, managing membership and orders, hosting, and technical support; account, order, and technical records necessary for the relevant service |
| PayTR, relevant banks, and payment institutions | Payment, refunds, transaction verification, and payment disputes; necessary transaction, identity, contact, and financial information |
| Hepsijet and logistics service providers used for delivery | Management of product delivery and return shipments; recipient name, telephone, address, and necessary shipment information |
| Accounting, financial consultancy, and e-document service providers | Information necessary for invoicing, accounting, tax, and e-document transactions |
| Electronic message service providers and the Message Management System as required by legislation | Sending service messages, sending commercial messages with permission, and managing approval/rejection records |
| Persons providing legal and consultancy services | Legal support, dispute resolution, and protection of rights as necessary |
| Authorized public institutions and judicial authorities | Fulfilling information requests and legal obligations in accordance with legislation |
| Advertising and analysis service providers within the scope of permission | Advertising measurement, personalization, and marketing activities according to the scope of your explicit consent |
Article 8 of the PDPL and the relevant data processing conditions specified above are taken as the basis for transfers. Transfers are not carried out without obtaining the necessary permission for activities subject to explicit consent.
[Before publication, the applications used in the store, email/SMS, e-invoice, and advertising/analysis providers should be checked; this section should be completed according to the actual data flow.]
6. Personal Data Transfer Abroad
The use of the Shopify infrastructure and services connected to the store may require the transfer of personal data to service providers abroad or make it accessible from abroad.
In the event of such a transfer, one of the transfer conditions regulated in Article 9 of the PDPL must be met in addition to the relevant data processing condition.
International transfer is carried out within the scope of an applicable adequacy decision or appropriate safeguard mechanism. If a safeguard such as a standard contract is used, the necessary procedures related to it are completed separately.
The mere existence of a legitimate interest or obtaining general explicit consent is not considered sufficient on its own for regular international transfer processes.
International transfer description — to be completed before publication:
-
Name of the data recipient and the country where it is located: Turkey
-
Service used and purpose of transfer: [Information]
-
Categories of personal data transferred: [Information]
-
Data processing condition relied upon: [Information]
-
PDPL Article 9 transfer mechanism applied: [Mechanism actually provided]
This information is evaluated separately for each service provider. The publication of this text does not, on its own, constitute a transfer mechanism.
7. Retention and Destruction
Your personal data is retained for the period prescribed in the relevant legislation or necessary for the purpose of processing.
Membership records are evaluated based on the need for account management; order, invoice, and payment records based on relevant legal retention obligations; dispute records based on the need to protect rights; and permission records based on relevant evidentiary and retention obligations.
The termination of membership does not require the simultaneous deletion of purchase and invoice records that must be legally retained.
When the processing conditions cease to exist, personal data is deleted, destroyed, or anonymized in accordance with the relevant legislation.
8. Explicit Consent and Communication Preferences
This privacy notice is intended to inform about the processing of personal data; it does not substitute explicit consent or approval for commercial electronic messages.
You may withdraw your consent for activities based on explicit consent. Withdrawal does not affect the legality of previous processing.
You can change your commercial message preferences through the rejection channel offered in the messages, the Message Management System where applicable, or the Company's communication channels.
The withdrawal of consent or marketing permission does not automatically terminate invoicing, order, and legal record processes carried out based on a different legal ground.
9. Your Rights Under the PDPL
Under Article 11 of the PDPL:
-
Learn whether your personal data is being processed,
-
Request information about the processing if it has been processed,
-
Learn the purpose of processing and whether it is used in accordance with the purpose,
-
Learn the third parties to whom it is transferred domestically or abroad,
-
Request the correction of incompletely or incorrectly processed data,
-
Request deletion or destruction within the framework of the conditions in Article 7 of the PDPL,
-
Request that the correction, deletion, and destruction processes be notified to the third parties to whom the data was transferred,
-
Object to a result that has become unfavorable to you as a result of analysis exclusively by automatic systems,
-
Request compensation if you have suffered damage due to unlawful processing
you have the right.
10. Application Methods
You can submit your requests through the following channels in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
| Application method | Application address |
|---|---|
| Written application; in person or through a notary | Aksen İpek Sanayi ve Dış Ticaret Ltd Şti — Sultançiftliği Mahallesi Parkverde Residence B1/8 Çekmeköy /İstanbul |
| Application from the email address you previously provided to the Company and is registered in the system | info@ipekshop.com |
The application must state the first and last name, signature for written applications, necessary identity information according to citizenship status, notification address, contact information if any, and the subject of the request. If there are documents explaining the request, they can be attached to the application.
The use of a special form for the application is not mandatory.
Your requests will be finalized as soon as possible and at the latest within 30 days, depending on their nature. Applications are generally free of charge; if the process requires additional costs, the fee determined in the tariff set by the Board may be applied.
11. Updates
This text may be updated in the event of changes in personal data processing procedures or legislation. The information required for new processing purposes is provided before the relevant activity begins; in cases requiring explicit consent, separate consent is obtained.
Last update: October 27, 2026