KVKK Clarification Text

KVKK CLARIFICATION TEXT

1. IDENTITY OF THE DATA CONTROLLER AND INTRODUCTION

In order to fulfill the clarification obligation under Article 10 of the Law on the Protection of Personal Data No. 6698 ("KVKK" or "Law"); as ÖRS EVCİL HAYVAN ÜRÜNLERİ DANIŞMANLIK İNŞAAT TURİZM SANAYİ VE TİCARET A.Ş. ("ÖRS A.Ş.", "Woodsman" or the "Company"), acting in the capacity of data controller, we show maximum sensitivity to the processing, protection, and security of the personal data of our customers, site visitors, and all parties with whom we establish commercial relations, in accordance with the Constitution of the Republic of Turkey, the KVKK, and relevant secondary legislation.

This Clarification Text has been prepared to transparently inform you about which categories and for what purposes your personal data, which you transfer to our company or which is collected by our company due to your visiting our website www.woodsman.com.tr, becoming a member, shopping, or participating in our operational processes (cargo, support, etc.), will be processed, to whom it may be transferred, its collection methods, legal grounds, and your rights listed in Article 11 of the Law.

2. PROCESSED PERSONAL DATA CATEGORIES

As Woodsman (ÖRS A.Ş.), we process your personal data, categorized below, to ensure that you can safely benefit from the services we provide through our website and that our commercial/legal operations can be carried out completely:

  • Identity and Contact Data: Your name, surname, your Turkish ID Number / Tax Identification Number (required for e-archive invoice issuance thresholds or corporate invoice requests), delivery address, billing address, mobile phone number, and e-mail address.
  • Customer Transaction and Financial Data: Your order and cart history, details of the products you purchased, records of your cancellation/return and exchange requests, your written communications with our customer service, your declared IBAN/bank account information (in cases where a refund is required), and masked credit/debit card information (showing only the first 6 and last 4 digits) transmitted to us by the intermediary payment institution.
  • Transaction Security Data: The IP address information with which you access our site, and your in-site connection and navigation (log) records, which we are legally obliged to record in accordance with the Law No. 5651 on Regulating Broadcasts Made on the Internet and Fighting Against Crimes Committed Through These Broadcasts.
  • Visual Records (Order/Packaging Security): To record that your orders are delivered to the cargo company completely and undamaged, instant visual records recorded by security cameras during the "Video Packaging" processes applied in our workshop and warehouse areas, which also reflect your name, surname, and address information on the cargo label along with the order content.

3. PURPOSES OF PROCESSING PERSONAL DATA AND VIDEO PACKAGING PROCESS

Your obtained personal data is processed by Woodsman (ÖRS A.Ş.) in accordance with Article 20 of the Constitution and the general principles in Article 4 of the KVKK (being in compliance with the law and honesty rules, being accurate and up-to-date, being processed for specific, explicit, and legitimate purposes, being related to, limited to, and proportionate to the purpose for which they are processed) for the following purposes:

General Commercial and Operational Purposes:

  • Receiving and confirming the orders you create through our website and establishing and executing the Distance Sales Contract,
  • Issuing e-invoices / e-archive invoices and keeping accounting records in accordance with the Tax Procedure Law (VUK) and relevant financial legislation,
  • Ensuring the safe delivery of the products you purchased to your address via cargo companies,
  • Providing after-sales support services, managing your cancellation, return, and exchange requests and potential complaints,
  • Carrying out the information security processes of our site and fulfilling our obligations arising from Law No. 5651 (log records).

Video Packaging Process (Specific Security and Proof Purpose): The instant camera recordings obtained within the scope of the "Video Packaging" application carried out in our workshop and warehouse areas, which also reflect your cargo label (name, surname, address):

  • Recording that the cargo package content is delivered to the cargo company completely, accurately, and without damage,
  • Ensuring the rights of both parties (our company and our customer) by revealing the material truth in potential consumer objections such as "missing product," "wrong product," or "empty box,"
  • It is processed only limited to and connected to these purposes for the purposes of fulfilling our legal "burden of proof" before Consumer Arbitration Committees and Courts in potential disputes and preventing abuse/fraud attempts.

4. MARKETING ACTIVITIES AND SENDING COMMERCIAL ELECTRONIC MESSAGES

As Woodsman (ÖRS A.Ş.), the mandatory notification messages (SMS/E-mail) we send you regarding the status of your order (confirmation, cargo tracking, cancellation/return processes) are within the scope of the execution of the commercial contract, and your explicit consent is not sought for these notifications.

However; marketing and advertising activities that fall outside the scope of mandatory service notifications are strictly subject to transparent consent. In this context:

  • New product promotions,
  • Discount, campaign, and promotion announcements,
  • Reminders for items left in the cart,
  • Newsletter distributions and market research surveys,

the ability to send Commercial Electronic Messages (SMS, E-mail, Phone call) to you for such purposes is solely dependent on the **"Explicit Consent"** you will provide within the scope of the KVKK No. 6698 and the **"Commercial Message Approval"** you will provide within the scope of the Law on the Regulation of Electronic Commerce No. 6563.

These consents are obtained on the condition that you actively and of your own free will check the relevant boxes that appear when you become a member of our site or place an order. These commercial message consents collected by us are registered simultaneously with the Message Management System (İYS) affiliated with the Ministry of Trade, as required by legal legislation.

Right to Withdraw Consent (Opt-out): You may withdraw the explicit consent and commercial message approval you have given at any time, without providing any justification and free of charge. You can perform the opt-out process by applying the "RET" (REJECT) instruction at the end of the SMS sent to you, by clicking the "Unsubscribe from the newsletter list" link at the bottom of the e-mails, or by directly logging into the İYS (Message Management System) panel via the e-Government gateway with a single click. Following the receipt of your rejection notice, all marketing communications to you will be stopped within 3 (three) business days.

5. METHOD OF COLLECTING PERSONAL DATA AND LEGAL GROUNDS

Collection Methods: Your personal data is collected by Woodsman (ÖRS A.Ş.) through fully or partially automated means by filling out membership/order forms on our website, by contacting us via our support e-mail address (info@meraklipati.com.tr), and via cookies that analyze your in-site navigation movements anonymously. In addition, for order security, "Video Packaging" images are automatically obtained via physical and electronic integrated systems (security cameras) in our workshop/warehouse areas.

Legal Grounds (Our Legal Basis): Your collected personal data is processed based on the following legal grounds and conditions specified in Article 5 of the KVKK No. 6698:

  • Pursuant to Article 5/2-(c) of the KVKK, "It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract": Carrying out membership procedures, establishing the Distance Sales Contract, receiving the order, payment confirmation, and delivering the products via cargo.
  • Pursuant to Article 5/2-(ç) of the KVKK, "It is mandatory for the data controller to fulfill its legal obligation": Issuing invoices as required by the VUK, keeping IP/Log records as required by Law No. 5651, and performing our legal obligations arising from the Consumer Law No. 6502.
  • Pursuant to Article 5/2-(e) of the KVKK, "Data processing is mandatory for the establishment, exercise, or protection of a right": Exercising our right to proof in cargo disputes by taking "Video Packaging" records in the workshop, and conducting potential legal processes before Consumer Arbitration Committees and Courts.
  • Pursuant to Article 5/2-(f) of the KVKK, "It is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject": Performing fraud checks, increasing customer satisfaction, and ensuring the security of our operational processes.
  • Pursuant to Article 5/1 of the KVKK, "Explicit Consent": Only in commercial electronic message (marketing, campaign, SMS/E-mail) sending processes (if you provide explicit consent).

6. TRANSFER OF PROCESSED PERSONAL DATA (Data Sharing)

As Woodsman (ÖRS A.Ş.), our most fundamental principle is to ensure the security of your personal data and protect its confidentiality. Your personal data collected by our company is absolutely not sold, rented, or arbitrarily shared with third parties for any commercial purpose. Your personal data is shared with the following persons and institutions only for the purpose of carrying out operational processes, in accordance with the conditions stipulated in Article 8 of the KVKK (Transfer of personal data domestically) and the legal grounds specified above (in Article 5):

  • Cargo and Logistics Companies: In order to ensure that the products you purchased are delivered to your address safely and on time and to carry out cargo tracking processes; your identity (name-surname) and contact (address, phone) data are shared with domestic cargo companies with which we have an agreement (e.g., Yurtiçi Kargo, Aras Kargo, etc.).
  • Licensed Payment Institutions and Banks: In order to ensure your payment transactions are processed in accordance with international PCI-DSS security standards, to facilitate collection, and to conduct fraud checks; your financial data and order amount are shared directly with TCMB/BDDK licensed intermediary payment institutions (e.g., Iyzico, PayTR) and relevant banks via secure connections (SSL).
  • Financial Advisory and E-Invoice Integrators: For the purpose of fulfilling our legal obligations arising from tax legislation, issuing e-archives/e-invoices, and maintaining our official accounting records; your identity, Tax ID/Turkish ID, address, and order amount data are shared with our company's legal financial advisors and licensed e-invoice integrator software firms.
  • Authorized Public Institutions and Organizations: For the purpose of fulfilling our legal obligations under the law or establishing, exercising, or defending a legal right; your personal data and "Video Packaging" visual recordings may be shared upon request and within legal limits with Consumer Arbitration Committees, Courts, Enforcement Offices, Law Enforcement Units, and other authorized administrative/judicial authorities.
  • Technology and Infrastructure Providers: In order to host our site's technical infrastructure, ensure database security, and (only for users who provide consent) send SMS/E-mail newsletters via IYS (Message Management System) integration; data is shared with domestic technology, cloud, and software infrastructure providers whose servers are strictly located within the borders of the Republic of Türkiye.

7. PERSONAL DATA RETENTION PERIODS AND DISPOSAL POLICY

Woodsman (ÖRS A.Ş.) retains the personal data it processes for the maximum period stipulated in the relevant legislation or required for the purpose for which they are processed. Within this scope, our company has adopted as a fundamental privacy principle not to store personal data in its databases indefinitely.

Our legal retention periods according to data categories are as follows:

  • Financial and Commercial Records (Invoices, etc.): In accordance with the Turkish Commercial Code (TTK) No. 6102 and the Tax Procedure Law (VUK) No. 213, e-invoices/e-archive invoices and financial records regarding your order are stored for 10 (ten) years.
  • Contracts and Consumer Transactions: In accordance with the general statute of limitations of the Turkish Code of Obligations (TBK) No. 6098 and the Consumer Law No. 6502, the Distance Sales Contract concluded with you and order details are retained for 10 (ten) years from the date of the transaction. (Technical transaction logs within the scope of Electronic Commerce legislation are stored for 3 years).
  • Transaction Security (IP and Log) Records: Site browsing and IP traffic (log) records, which are mandatory to be kept under Law No. 5651, are stored for 2 (two) years.
  • Visual Records (Video Packaging): Workshop camera recordings taken during cargo security processes are retained periodically (generally in the range of 6 months - 1 year), taking into account legal complaint periods for possible cargo or delivery disputes, and are deleted from the system when the risk of dispute is eliminated.
  • Commercial Electronic Message Consents: Records are legally kept for an additional 3 (three) years from the date your "Explicit Consent / Commercial Message Consent" withdrawal (cancellation) request is received via the Message Management System (IYS) or directly to our company.

Disposal and Anonymization: In the event that the aforementioned legal statute of limitations and mandatory retention periods expire or the legal reasons requiring the processing of the data are completely eliminated; your personal data will be deleted, destroyed, or made anonymous (anonymized) beyond recovery, either ex officio (automatically) or upon the request of the Data Subject (you), in accordance with our company's prepared "Personal Data Retention and Disposal Policy".

8. RIGHTS OF THE DATA SUBJECT AND APPLICATION PROCEDURE (KVKK Article 11)

Your Rights Regarding Your Personal Data: Your rights under Article 11 of the Law, which "regulates the rights of the data subject," are listed below:

  • To learn whether your personal data is being processed,
  • To request information if your personal data has been processed,
  • To learn the purpose of processing and whether they are used in accordance with their purpose,
  • To know the third parties to whom your personal data is transferred domestically or abroad,
  • To request the correction of your personal data in case it is processed incompletely or incorrectly,
  • To request the deletion or destruction of your personal data within the framework of the conditions set forth in Article 7 of the Law (Right to be Forgotten),
  • To request that the correction, deletion, and destruction processes be notified to third parties to whom your personal data has been transferred,
  • To object to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
  • To request the compensation of damages in case you suffer loss due to the unlawful processing of your personal data.

Application Procedure and Communication Channels: To exercise the rights listed above and to submit all kinds of requests regarding your personal data to our Company, you may choose one of the following channels in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

  1. Application via E-Mail: You may send an e-mail to info@meraklipati.com.tr clearly stating your requests through the e-mail address registered in our system or the one you used when creating your membership.
  2. Via KEP (Registered Electronic Mail): As the method with the highest legal validity, you may apply to our company's official KEP address [SirketKayıtlıKKEPAdresi@hs01.kep.tr] with your secure electronic signature (e-signature) or mobile signature.
  3. Written Application: You may deliver it in person or send it via notary to our company headquarters at [Şirketin Açık Fiziki Adresi - Ankara], including documents identifying you along with a wet-signed petition.

Your requests will be concluded free of charge as a rule, as soon as possible and in any case within 30 (thirty) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.