Privacy Notice (KVKK)

This English text is a translation of the Turkish original, provided for your convenience. In case of any discrepancy, the Turkish text prevails.

This notice explains, under article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles of the Obligation to Inform, how your personal data is processed on the hediyesahibi.com website and in the related sales processes. It is for information only; you are not asked for any approval or consent.

1. Data controller

Your personal data is processed by Mehmet Fatih Çetin ("Hediyesahibi") as data controller.

• Registered address: Merkez Mah. Şükran Sk. Murat Apt No: 3 İç Kapı No: 8 Güngören / İstanbul
• E-mail: [email protected]
• KEP address: [email protected]
• Phone: +90 553 647 99 07

2. Personal data processed and data subjects

• Customers (people who place orders): name; for company invoices the company name, tax office and tax number; for personal invoices, optionally, the Turkish ID number; e-mail address, phone number, billing and delivery address; order, payment method, invoice, return and withdrawal records; your requests and complaints; contract acceptance records (date and time of acceptance, document version); IP address and transaction security logs.
• Gift recipients (delivery recipients): the name, delivery address and phone number shared by the person placing the order; the gift note, if any.
• Members: account details (name, e-mail, encrypted password; your date of birth and gender if you choose to share them), saved addresses, order history and your favourites list (the products you add to your favourites); the products you untick in your cart to keep them out of this order; when you ask to reset your password, the single-use reset key (in encrypted form) and the time of the request.
• Members who create gift lists: the name of the list; whom the list is for (the relationship, for example my mother, a friend); the occasion and its date; whether it repeats every year; the reminder setting and the date of the last reminder; the note you write on the list; the products you add to it; if you turn sharing on, the share link and whether sharing is on or off. If you write information about another person in the list's name or note, it is kept with the list; please do not write special categories of personal data (for example health information) in the note.
• Members who write product reviews: the rating, the review text and its date, the product reviewed, the mark that you bought the product, the name shown on the review (your first name and the initial of your last name, for example "Deniz D."; with "Hide my name" only the initials, for example "D*** D***"), the e-mail address, the IP address and browser details; the photos and videos you add to the review. Your full name and e-mail address are not shown on the review. Photos are stored without the location (GPS) and device details inside the file, videos without the location. The photos and videos of a review waiting for approval or not published are open only to you and our authorised staff; once the review is published they are public on the product page. Please leave out faces and personal details you would not share.
• Notifications and e-mail preferences: the notifications kept in your account (status changes of your orders, price drops and products back in stock among your favourites, gift list reminders and campaign announcements; whether each was read and whether it was sent by e-mail) and your choice of which notifications you also receive by e-mail.
• Customers uploading photos for made-to-order products: the photos you upload on the product page and their file names. The photos are stored without the location (GPS) and device details inside the file. If a photo shows other people, their image is processed with it; please do not upload photos of other people without their knowledge.
• People who ask to be told when a sold-out product is back: your e-mail address, the product and option (for example the colour) you asked about and the date of the request; your account if you are signed in.
• People who ask about a product: your question, the product and the date; your name and surname and your e-mail address; your account if you are signed in; the store's answer. The product page shows your first name and the initial of your surname (for example "Deniz D."; initials only with "Hide my name"); your full name and e-mail address are not shown. Please do not write other people's details or special categories of personal data in a question.
• Website visitors: session and cart information (including the products you keep aside in your cart) through strictly necessary cookies; only if you consent, analytics cookie data and the order source and campaign data collected through marketing cookies (for example the referring website, campaign parameters and device type; details in the Cookie Policy). Products you add to your favourites without signing in are kept only in your own browser; they are not sent to or stored by us.
• People who opt in to commercial messages: the channel opted in to (e-mail, SMS), the e-mail address or phone number the consent was given for, the name, the date and time of the opt-in and the version of the consent text; if you withdraw your consent, the date and time of the withdrawal and how it was made (the opt-out link in an e-mail, the unsubscribe button of your mail program or the My notifications page in your account).

Credit and debit card details are processed by the payment institution PayTR; we never see or store them.

3. Purposes and legal grounds

• Taking your order, concluding and performing the distance sales agreement, collecting payment, delivering the goods, handling returns, withdrawals and exchanges; delivering gifts to the recipient (KVKK art. 5(2)(c): directly related to the conclusion or performance of a contract; for gift recipients also art. 5(2)(f): legitimate interest).
• Issuing invoices, keeping accounting and tax records; keeping pre-contract information, contract and acceptance records for the legally required periods; providing information to competent authorities on request (KVKK art. 5(2)(ç): legal obligation).
• Answering your requests and complaints and providing customer service (KVKK art. 5(2)(c) and (f)).
• Ensuring information security and preventing fraud and misuse (KVKK art. 5(2)(f): legitimate interest; art. 5(2)(ç)).
• Establishing, exercising or defending legal claims (KVKK art. 5(2)(e)).
• Creating and managing your account; sending a password reset link when you ask for one and a notice when your password changes (KVKK art. 5(2)(c)). To prevent misuse of password reset requests, an irreversible digest of your connection address (IP) and the number of requests per account are kept for a short time (KVKK art. 5(2)(f): legitimate interest).
• If you choose to sign in with your Google account (the "Sign in with Google" button, or the one-tap sign-in prompt shown on the home page and the sign-in page), signing you in or creating your account with the name, surname, e-mail address and Google account ID that Google shares with us (KVKK art. 5(2)(c): conclusion and performance of the membership agreement). The one-tap sign-in prompt is shown only if you give explicit consent to functional cookies in the cookie preferences (KVKK art. 5(1)); you can withdraw it at any time.
• Showing your account page for you with the gender and date of birth you choose to share (KVKK art. 5(2)(c): performance of the membership agreement). Sharing them is not required; you can change or remove them on your account page at any time.
• Keeping your favourites list in your account, showing it on your devices and merging it with the list in your browser when you sign in (KVKK art. 5(2)(c): performance of the membership agreement).
• Keeping the products you set aside in your cart and showing them there so that you can add them to an order later; for members, keeping them in your account and showing them on your devices (KVKK art. 5(2)(c): directly related to the conclusion or performance of a contract).
• Keeping your gift lists in your account and showing them; for lists with a reminder, sending a reminder e-mail the time you chose before the occasion; for lists you share, showing the list's name, whom it is for, the day and month of the occasion, your first name (without your last name), your note and the products to anyone with the share link (KVKK art. 5(2)(c): performance of the membership agreement). You can turn reminders and sharing off at any time; once sharing is off, the link no longer shows the list.
• Publishing your product reviews on the product page with the name you chose, after they are checked, and allowing the store to reply (KVKK art. 5(2)(c): performance of the membership agreement); checking reviews and preventing misuse (KVKK art. 5(2)(f): legitimate interest).
• Showing notifications about your orders, favourites, gift lists and campaigns in your account and, as you choose, also sending them by e-mail (KVKK art. 5(2)(c): performance of the membership agreement). E-mails with price drops, products back in stock and campaigns are commercial electronic messages and are sent only if you have given your consent to commercial electronic messages.
• Telling you once by e-mail, at your request, when a sold-out product is on sale again; for members also in the Notifications page of your account (KVKK art. 5(2)(c): performance of the relationship set up at your request). To prevent misuse, an irreversible digest of your connection address (IP) and the number of requests are kept for 1 hour at most (KVKK art. 5(2)(f): legitimate interest).
• Answering your questions about products and sending you the answer by e-mail (KVKK art. 5(2)(c): performance of the relationship set up at your request); showing the questions and answers the store approves on the product page with the name you chose, so that other customers can read them too (KVKK art. 5(2)(f): legitimate interest). To prevent misuse, an irreversible digest of your connection address (IP) and the number of questions are kept for 1 hour at most (KVKK art. 5(2)(f): legitimate interest).
• Processing the photos you upload for made-to-order products only to make the product (for example to print them on it) (KVKK art. 5(2)(c): directly related to the conclusion or performance of a contract).
• Sending commercial electronic messages about campaigns, discounts and news: only on the basis of the consent you give per channel under Law No. 6563; you can withdraw it at any time.
• Recording consents to commercial electronic messages and requests to withdraw them, and reporting them to the Message Management System (İYS) under Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages; not sending commercial electronic messages to people who withdrew their consent (KVKK art. 5(2)(ç): legal obligation).
• Measuring website usage statistically: only if you give explicit consent to analytics cookies in the cookie preferences (KVKK art. 5(1)); you can withdraw it at any time.
• Recording which channel and campaign an order came from (storing the order source and campaign data with the order) and measuring advertising with Google's advertising features: only if you give explicit consent to marketing cookies in the cookie preferences (KVKK art. 5(1)); you can withdraw it at any time.

4. Transfers of personal data

Your personal data may be transferred, limited to the purposes above, to:

• The carrier (Yurtiçi Kargo) for delivery and returns.
• The payment institution PayTR and the banks involved, to collect payment and prevent fraud.
• E-invoice/e-archive, marketplace and accounting integration service providers (PraPazar and its private integrator) and our accountant, for invoicing, accounting and order management.
• Our hosting, e-mail delivery and technical infrastructure providers, to run the website.
• İleti Yönetim Sistemi A.Ş. (İYS), to record consents to commercial electronic messages and their withdrawal.
• The Ministry of Trade, the Revenue Administration, courts and other competent public authorities on request, to meet legal obligations.

Transfers abroad: The content delivery and security service used to protect and speed up the website (Cloudflare) and, only if you consent to analytics or marketing cookies, Google (Google Analytics and Google's advertising features) and, if you choose to sign in with your Google account or consent to functional cookies, Google (Sign in with Google) may process data on servers abroad. Transfers abroad are made under the conditions of article 9 of the KVKK.

5. How data is collected

Your personal data is collected electronically, by automated and partly automated means, through the order, account and contact forms, the favourites button and the cart page on the website, the photo upload, "Tell me when it is back" and question fields on product pages, the gift list, review and notification pages in your account, the links in e-mails, cookies and browser storage, Google when you choose to sign in with your Google account, e-mail and phone. Gift recipients' details are provided by the person placing the order; the details in gift lists by the member who creates the list.

6. Retention periods

• Pre-contract information, distance sales agreements and acceptance records: at least 3 years (Distance Contracts Regulation art. 20).
• Invoices, commercial books and documents: 10 years (Turkish Commercial Code No. 6102 art. 82; Tax Procedure Law No. 213).
• Commercial message consent records and records of their withdrawal: while the consent is valid and, after it ends, for the period required by the applicable legislation. If you give your consent again after withdrawing it, the new consent record replaces the withdrawal record.
• Account data: while the account exists; after it is closed, for the legal periods above and the limitation periods for possible disputes.
• Favourites list: until you remove the products or your account is closed; deleted at once when you ask for erasure. A list kept without signing in stays only in your browser until you delete it or clear your browser data.
• Products set aside in the cart: until you remove them from the cart, add them to an order or your account is closed; deleted at once when you ask for erasure. Products set aside without signing in are kept only for the length of your session.
• Gift lists: until you delete the list or your account is closed; a list you delete is permanently deleted within 30 days at the latest and its share link stops working at once; deleted at once when your account is closed or when you ask for erasure.
• Product reviews: published until you delete the review; a review you delete is permanently deleted within 30 days at the latest. Closing your account does not delete your reviews by itself; when you ask for erasure, your name, e-mail address and IP address on your reviews are anonymised, while the rating and the review text stay with the product. The photos and videos of a review are deleted with the review, when you remove them, and when you ask for erasure.
• Notifications: read notifications are kept for 90 days and all notifications, unread ones included, for 365 days at most (the newest 200 per account); deleted at once when you delete them, when your account is closed or when you ask for erasure. Your e-mail notification preferences are kept while your account exists.
• Photos for made-to-order products: kept in a protected area that only authorised staff can reach until the product is made; deleted as soon as the order is delivered, cancelled or refunded, and at the latest 30 days after the order is shipped. Photos of orders whose payment failed are deleted after 7 days. Uploads that do not become an order are deleted as soon as you remove the product from your cart, and at the latest 48 hours after the cart was last used. When you ask for erasure, the photos of orders still being prepared are kept until the product is made; the others are deleted at once.
• "Tell me when it is back" requests: deleted as soon as the product is on sale again and you have been told; if the product does not come back, deleted after 6 months at the latest. Members can cancel a request on the product page at any time; deleted at once when you ask for erasure.
• Product questions: questions and answers on a product page stay there while the product is on the website and are deleted when the product is removed for good. Questions not on a page (waiting for an answer, or answered to you alone) are deleted after 6 months at the latest. When you ask for erasure, your questions not on a page are deleted; on those on a page your name and e-mail address are deleted and the question and the answer stay there without a name.
• Password reset: the reset key is valid for 24 hours at most and stops working once used or when a new request is made; the request counters used to prevent misuse are deleted after 1 hour at the latest.
• Analytics and marketing cookie data: for the periods stated in the Cookie Policy; order source data stored with an order, together with the order record.

Personal data whose retention period has expired is deleted, destroyed or anonymised.

7. Your rights

Under article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its deletion or destruction under the conditions of article 7 of the KVKK; to request that corrections, deletions and destructions be notified to the third parties to whom the data was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage because of unlawful processing.

8. How to apply

You can send requests about your rights in writing to Merkez Mah. Şükran Sk. Murat Apt No: 3 İç Kapı No: 8 Güngören / İstanbul, by KEP to [email protected], or by e-mail to [email protected] from the e-mail address registered with us. If you have an account, you can also ask for your account and personal data to be deleted under "Delete my account" on the My account → Account details page. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, your request is answered free of charge within 30 days at the latest; if the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board.

9. Other

The Seller's MERSİS number is published on the website as required by Law No. 6563 on the Regulation of Electronic Commerce and its regulation. For more on our privacy and information security practices, see the Privacy Policy.

Text version: 2026-09-30