Personal Data Protection Law (KVKK)

IN ACCORDANCE WITH LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA (“KVKK”), REGARDING THE PROTECTION OF PERSONAL DATA.

INFORMATION TEXT

Update Date: 10.11.2024

Erwa Retail Import Export Industry and Trade Limited Company aspect; As the data controller, we attach great importance to the security of your personal data. In this regard, we would like to inform you about the Law No. 6698 on the Protection of Personal Data (“the Law”).

1. Data Controller

Your personal data will be processed by us as the data controller. Erwa Retail Import Export Industry and Trade Limited Company This data will be recorded, stored, classified, updated, and, when necessary, transferred to third parties by [Company Name] for the purposes stated in this Privacy Notice. 

Erwa Mağazacılık İthalat İhracat Sanayi ve Ticaret Limited Şirketi (“the Company”) or ('Erwa') considers the privacy and security of your personal data to be among its top priorities. Erwa processes your personal data in compliance with the regulations of the Law No. 6698 on the Protection of Personal Data (‘KVKK’) and secondary legislation. In order to inform data subjects about the processing, storage, and transfer of their personal data within the scope of our activities arising from relevant legislation and legal regulations, and in order to enable them to benefit from the services offered on Erwa's mobile applications and/or websites (“Platform Services”), we have prepared this Personal Data Processing Information Text (“Information Text”).

Your personal data, which we obtain in the ways described below, will be processed within the scope of our commercial relations or our service relationship with you; and only for the purposes that necessitate their processing. in a manner that is relevant to the purpose, limited and proportionate, We hereby inform you that the personal data you have provided to us, or as it has been provided to us, will be recorded, stored, maintained, reorganized, shared with institutions legally authorized to request this personal data, transferred to domestic or foreign third parties, assigned, classified, and processed in other ways listed in the KVKK (Personal Data Protection Law), while maintaining its accuracy and up-to-date status.

Your personal data means any information that identifies or makes you identifiable. Detailed information about the cookies and SDKs (“Cookies”) used when you visit our website and/or mobile application is included in the Cookie Policy. Personal data processed through cookies is explained in this Privacy Notice. Erwa may make changes to this Privacy Notice at any time as necessary. These changes will become effective immediately upon publication of the Privacy Notice at ………………. address.

2.  Your Processed Data 

The personal data processed by Erwa, the data controller, is listed below. If you are a platform member, your personal data will be processed during the membership process, while continuing without membership, during the purchase of products and services through the site, during complaints and support requests, during the conduct of legal processes, during the processing and transfer of credit card data, during user experience studies, and during the use of interactive support services.

• Your Personal Information: Your name, surname, date of birth, Turkish Republic ID number, and gender.
• Your Contact Information: Your mobile phone number, billing and delivery address, and email address.
• Your User Account Information: Your customer number, membership email address, and if you add your user information, your date of birth, height, and weight.
• Your Customer Transaction Information: Your order and billing information, your transaction history related to your purchases, your requests and complaints, your platform usage information, information you personally share in your comments and/or questions regarding products on the platform, your ratings and reviews, information related to chat conversations, your cancellation/return information, and your membership date information.
• Your Delivery InformationThe phone number and delivery address information you provided for the delivery of your order, along with your delivery tracking information,
• Your Payment Information: Your information regarding payments and payment methods, registered card details, encrypted credit card information, bank account/IBAN number information,
• Your Transaction Security Information: Your device information, IP address information, username information, password information, cookie information, platform access logs, login method (via Google/Facebook), website login and logout information, traffic data (connection time/duration, etc.)
• Your Legal Proceedings Information: Information from correspondence with authorized persons, institutions and organizations, information from court and enforcement files, and your legal information requests,
• Your Visual and Audio Recording Information: Your voice recording if you spoke with the call center. Photos you added to your comments and account information.

3. How do we collect your personal data?

Your personal data www.shoppypella.com This information is obtained through the forms you fill out on the website. 

Your personal data www.shoppypella.com This information is obtained through the WhatsApp contact line located on the website.

Erwa collects your personal data electronically through the Website and Mobile Application using fully automated and partially automated methods; electronically through the channel you use to contact us via live chat, call center or email; and physically when transmitted by post or notified by legal authorities.

4What are the legal grounds and purposes for processing your personal data?

In accordance with the law, as the Data Controller, we will record, store, classify, update, and process your personal data in accordance with Articles 5 and 6 of the KVKK (Law on Protection of Personal Data) and within the framework described below, in order to fulfill the purposes stated in the paragraph below.

During the membership and account creation process; Your personal information, contact information, user account information, customer transaction information, and transaction security information are processed for the following legal reasons: because it is explicitly required by law, because it is necessary for Erwain to fulfill its legal obligations, and because it is necessary for the performance of our membership agreement; for the establishment and performance of the membership agreement; for managing the creation and closure of platform member profiles/accounts; for verifying contact information; for carrying out activities related to your purchases through the platform; for the conduct and supervision of the company's business activities; for ensuring the security of platform operations; for fulfilling obligations arising from legislation to which Erwa is subject, primarily the Law No. 6563 on the Regulation of Electronic Commerce, the Turkish Commercial Code No. 6102, the Turkish Penal Code No. 5237, and the Law No. 6502 on Consumer Protection; for ensuring that platform activities are carried out in accordance with the legislation; and for fulfilling Erwa's data sharing and storage obligations in accordance with our obligations arising from legislation. 

During the ordering process, delivery, and cancellation and return processes; Your personal information, contact information, user account information, delivery information, customer transaction information, payment information, and transaction security information are processed for the following legal reasons: to fulfill Erwain's legal obligations and to ensure the fulfillment of our membership agreement; to place and create orders; to establish and fulfill the distance sales contract; to carry out delivery and logistics activities; to manage cancellation and/or return processes; to manage payment and invoicing processes; to fulfill legal obligations stipulated in the legislation to which Erwain is subject, primarily the Regulation on Distance Contracts and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce, and/or decisions, guidelines, and manuals published by authorized authorities; and to manage the purchase processes of product/service groups on the Platform. 

In customer experience processes, your personal information, contact information, user account information, customer transaction information, delivery information, transaction security information, legal transaction information, and audio recording information are processed for the following legal reasons: for the performance of our membership agreement and for Erwa's legitimate interests; to ensure quick and easy access to products that match your preferences and interests; to provide a better user experience during service transitions between Erwa's Platform Services; to improve and enhance your user experience; to improve our service quality; to conduct analysis and reporting; to carry out communication activities; to evaluate requests, complaints, and suggestions regarding our products and services; and to provide after-sales support services for goods and services. 

Your personal information, contact information, user account information, customer transaction information, delivery information, payment information, and transaction security information are used by the company in its information security, risk, audit, and control processes.,  Your data is processed for the following legal reasons: necessary for the performance of our membership agreement and for Erwa's legitimate interests; for the execution and auditing of financial and accounting processes; for the execution of billing processes; for the execution of information security processes and investigation of suspicious transactions; for ensuring the security of operations related to the Platform; for the control, development, and improvement of the quality of products and services offered by Erwa; for risk identification and analysis; for complaint management; for the prevention of fraud; and for Erwa to conduct legal and financial due diligence activities in the event of possible company mergers, acquisitions, joint ventures, divisions, and other structural changes. 

Your personal information, contact information, user account information, customer transaction information, delivery information, payment information, transaction security information, legal transaction information, audio recording information are processed for the following legal reasons: the establishment, exercise or protection of a right, and the fulfillment of Erwa's legal obligations; the conduct of legal and litigation matters, responding to your legal claims, reviewing and responding to your duly submitted applications as a data subject; ensuring compliance with legislation; fulfilling obligations arising from legislation to which Erwa is subject; conducting legal consultancy processes; sharing information with authorized persons, institutions and organizations upon request; and for the purpose of exercising and protecting a right in case of a legal dispute. 

In processes conducted based on explicit consent, your identity information, contact information, user account information, customer transaction information, delivery information, and payment information are processed for the purposes of marketing, advertising, and promotional activities, conducting financial offer processes, providing you with personalized offers, carrying out activities aimed at increasing your satisfaction, and sending commercial electronic messages within this scope, all based on the legal grounds of having explicit consent. 

5) To whom and for what reasons are your personal data transferred?

Erwa transfers your personal data in accordance with the purposes stated in this Privacy Notice and in compliance with Articles 8 and 9 of the KVKK (Personal Data Protection Law). 

Your personal data is shared with the recipient groups detailed below within Turkey, based on the legal grounds explicitly provided for in the laws pursuant to Article 8 of the KVKK (Law on Protection of Personal Data), being necessary for Erwa to fulfill its legal obligations, being necessary for the establishment or performance of a contract, being necessary for the establishment, exercise or protection of a right, and/or being necessary for Erwa's legitimate interests.

In addition, in cases where your personal data is transferred abroad by Erwa, appropriate safeguards must be provided through a standard contract as stipulated in Article 9 of the KVKK (Law on Protection of Personal Data) and the Regulation on Procedures and Principles Regarding the Transfer of Personal Data Abroad, or  Personal data is shared with the recipient groups detailed below, based on the legal grounds arising from one of the situations stipulated in Article 9, paragraph 6 of the KVKK (Law on Protection of Personal Data), on an incidental basis. Erwa takes care to process your personal data by ensuring necessary data minimization and taking the necessary technical and administrative security measures.

During the membership and account creation process, Your personal data may be shared with our affiliates and group companies for the purposes of enabling you to benefit from Platform Services within the scope of the services we receive from the Platform pursuant to our contractual relationship, establishing and fulfilling the membership agreement, conducting Platform operations, and obtaining information, technology, and software services, based on legal grounds such as necessity for the establishment or performance of the contract and ensuring appropriate security through standard contracts. This information is shared with our subsidiaries, group companies, business partners, and service providers that provide, operate, or service our IT infrastructure, as well as with our subsidiaries and group companies located abroad.

During the ordering process, delivery, cancellation, and return processes; for the purposes of fulfilling Erwa's legal obligations, establishing or performing the contract, and providing appropriate security with a standard contract, enabling you to benefit from Platform Services, managing the purchase and invoicing processes, fulfilling the obligations arising from the legislation to which Erwa and the seller from whom you purchased the product are subject, and for the purpose of carrying out logistics activities and tracking delivery processes, you may share your information with the seller or service provider of the product you wish to purchase. We use your product information to process and track your payment transactions with our partner banks and other payment institutions, and to provide you with information regarding matters such as the delivery of the product you purchased. For bulk SMS/email sending services, and if you order products from abroad, your information is shared with overseas cargo and logistics companies, the seller of the product you purchased, and customs consultancy companies for the purposes of managing order delivery and return processes, logistics and supply chain processes, customs processes, and platform operations.

In customer experience processes; Personal data is shared with our business partners providing call center services, customer support service providers, service providers located abroad, our affiliates providing IT infrastructure, software and technology services, our group companies, business partners and consultants for the purposes of providing Platform services and running Platform operations, for the purpose of providing Platform services and running Platform operations, for the purposes of providing goods and services sales and after-sales support services, ensuring customer satisfaction, and handling requests and complaints, provided that it is necessary for the establishment or performance of the contract, that appropriate assurance is provided by the Standard contract, and on an incidental basis, for the existence of one of the situations stipulated in Article 9, paragraph 6 of the KVKK (Personal Data Protection Law); and for the purposes of providing goods and services sales and after-sales support services, ensuring customer satisfaction, and handling requests and complaints, and for the purposes of carrying out activities aimed at developing and improving the products and services offered by Erwa, all based on legal grounds.

Erwa shares personal data with its business partners, consultants and service providers, banks, e-invoicing partners, cargo and courier companies, private integrators, independent auditing firms, customs, and financial advisor/accounting service partners for the following purposes: fulfilling Erwa's legal obligations, establishing or performing contracts, and being necessary for Erwa's legitimate interests in its information security, risk, audit, and control processes; conducting billing processes, sending e-invoices electronically to customers, delivering physical contracts or invoices, managing financial and accounting processes, identifying and evaluating risks, and preventing fraud; ensuring the security of company operations, controlling and improving the quality of products and services offered by the company, and conducting risk identification and analysis; and with its group companies, subsidiaries, private integrators, technology companies, business partners, and service providers.

In the execution of legal proceedings, data may be processed for legal reasons such as: being explicitly provided for in the laws; fulfilling Erwa's legal obligations; establishing, exercising, or protecting a right; being necessary for the establishment or performance of a contract; and, incidentally, for the existence of one of the circumstances stipulated in Article 9, paragraph 6 of the KVKK (Personal Data Protection Law); fulfilling obligations arising from the legislation to which Erwa is subject and conducting Platform activities in accordance with the legislation; providing information to authorized persons, institutions, and organizations; monitoring and conducting legal affairs; exercising and protecting a right in case of a legal dispute; and with authorized public institutions and organizations such as regulatory and supervisory bodies, courts and enforcement offices, and mediators; and with lawyers, auditors, tax consultants, forensic IT experts, cybersecurity consultants, tax consultants, our group companies, affiliates, other third parties from whom we receive consultancy and services, and business partners, for the purposes of conducting Erwa's audit activities, conducting legal consultancy processes, ensuring the security of company operations, and conducting investigations into suspicious transactions. If such an event occurs, information is provided to authorized persons, institutions and organizations abroad, and in case of a legal dispute, it is shared with authorized public institutions and organizations for the purposes of exercising and protecting a right.

With your explicit consent, your personal data is shared with affiliates, group companies, service providers, and business partners for the purposes of conducting marketing, advertising, and promotional activities, providing you with personalized offers, and carrying out activities aimed at increasing your satisfaction.

6) Protection of Your Personal Data

Erwa, as the data controller, assumes responsibility for establishing the necessary organizational structure and implementing and adapting technical measures to protect the confidentiality and integrity of information in accordance with the relevant provisions of the applicable legislation. Personal data shared with Erwa is under Erwa's supervision and control. 

Accordingly, as stipulated in the legislation, penetration tests are conducted periodically in accordance with international and national technical standards concerning data privacy, and regular risk analyses are performed regarding personal data processing activities. Furthermore, actions are taken to mitigate risks, access and authorization controls are implemented to prevent unauthorized access to personal data, and data processing policies are updated regularly.

7) What are your rights regarding the protection of your personal data?

In accordance with Article 11 of the KVKK (Law on the Protection of Personal Data), your rights regarding the processing of your personal data are listed below:

• To find out whether your personal data is being processed,
• If it has been processed, request information about it.,
• To learn the purpose for which your personal data is processed and whether it is being used appropriately for that purpose,
• Knowing the third parties to whom it is transferred, whether domestically or internationally.,
• The right to request the correction of personal data if it has been processed incompletely or inaccurately.,
• You can request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK (Law on Protection of Personal Data).,
• You have the right to request that the actions taken in accordance with your rights regarding correction, deletion, and destruction mentioned above be notified to third parties to whom your personal data has been transferred.,
• You have the right to object to an outcome that is detrimental to you, resulting solely from the analysis of your personal data by automated systems.,
• You have the right to claim compensation for any damages you suffer as a result of your personal data being processed in violation of relevant legislation. 

You have rights.

Erwa's Data Storage and Destruction Policy ensures that your personal data storage and deletion processes are carried out in accordance with the legislation. Data storage and destruction processes are conducted within the scope of these policies. Accordingly, if a retention period for data is specified in the Personal Data Protection Law (KVKK) or relevant laws and other relevant legislation, the data must be stored for at least that period. After this period, your personal data will be deleted, destroyed, and/or anonymized by Erwa or upon your request, using methods within the scope of the Personal Data Protection Law and related regulations. You can withdraw your consent for the processing of personal data, other than data required by law, at any time.. If you request the deletion of your data for a valid reason, your data will be deleted by the data controller within 30 days at the latest, if legally possible. Requests for the deletion or destruction of your data before the retention period stipulated by legislation will not be accepted. 

8) Application and Contact for Your Rights and Claims

You can submit your requests and inquiries regarding your personal data using the data subject application form;

• With a wet signature and a photocopy of the ID. Acarlar Neighborhood, Çubuklu Çiftlik Yolu Street, H Block No:2h, Inner Door No:4, Beykoz/Istanbul by sending it to this address,
• By applying in person to Erwa Mağazacılık İthalat İhracat Sanayi ve Ticaret Limited Şirketi with a valid identification document,
• By sending an email to our registered electronic mail address erwa@hs01.kep.tr using a registered electronic mail (KEP) address and a secure electronic signature or mobile signature,
• By sending an email from the email address previously provided by the relevant person to Erwa Mağazacılık İthalat İhracat Sanayi ve Ticaret Limited Şirketi and registered in our system, to our email address ………………..com

You can forward this to Erwa Mağazacılık İthalat İhracat Sanayi ve Ticaret Limited Şirketi.

Please write "Data Subject Request under the Personal Data Protection Law" on the envelope or in the subject line of the email containing the application form.

According to the Communiqué on the Procedures and Principles for Applications to the Data Controller, the Data Subject must include the following information in their application: name, surname, signature (if the application is in writing), Turkish Republic Identity Number (or passport number if the applicant is a foreigner), residential or business address for notification purposes, email address (if any), telephone number, fax number, and information regarding the subject of the request.

The relevant person must clearly and understandably state the request in their application, which should include explanations regarding the right they wish to exercise as mentioned above. All relevant information and documents must be attached to the application.

While the subject of the request must relate to the applicant personally, if acting on behalf of someone else, the applicant must be specifically authorized to do so and this authorization must be documented (a special power of attorney). Furthermore, the application must include identity and address information, and supporting documents verifying identity must be attached. Requests made by unauthorized third parties on behalf of others will not be considered.

As data subjects, if you submit your requests regarding your rights to Erwa, Erwa will process your request free of charge within a maximum of 30 (thirty) days. However, if the response to your application requires a cost in accordance with the legislation, Erwa may charge a fee according to the tariff determined by the Personal Data Protection Board. If your application is rejected, the reasoned reasons for rejection will be communicated to you via email or postal mail to the address you provided in your application, or, if possible, through the same method by which you submitted your request.

9) Changes to be Made to the Privacy Policy

Erwa reserves the right to update this Personal Data Protection Notice at any time within the framework of possible changes in the applicable legislation.