Last Updated: 23 March 2026
As PazaryeriSoft, acting as data controller under Law No. 6698 on the Protection of Personal Data ("KVKK"), we would like to inform you about the processing of your personal data. This privacy notice is addressed to all natural persons who use our platform.
1. Identity of the Data Controller
Legal Name: PazaryeriSoft Teknoloji A.Ş.
Address: Orjin Maslak Plaza, Maslak Mah. Eski Büyükdere Cad. No:27, 34398 Sarıyer/İstanbul, Türkiye
E-mail: [email protected]
Phone: +90 212 248 88 88
2. Purposes of Processing Personal Data
Your personal data is processed for the following purposes:
- Creating a membership record and managing accounts
- Managing order processes and carrying out delivery and invoicing operations
- Completing payment transactions securely
- Providing, personalising and improving products and services
- Responding to customer support requests
- Fulfilling legal obligations (tax legislation, consumer legislation and the like)
- Carrying out communication activities
- Planning and auditing information security processes
- Ensuring platform security and preventing fraud
- Performing statistical analysis and reporting
- Monitoring and conducting legal proceedings
- Sending commercial electronic messages (within the scope of your explicit consent)
3. Categories of Personal Data Processed
Data Category | Description |
|---|---|
Identity Information | First name, last name, Turkish national ID number (for sellers), tax identification number |
Contact Information | E-mail address, phone number, address details |
Financial Information | Bank account details (IBAN — for sellers), invoicing details |
Customer Transaction Information | Order history, shopping cart details, return and exchange records |
Transaction Security Information | IP address, session information, device information, browser information |
Marketing Information | Cookie data, campaign preferences, shopping habits |
Legal Proceedings Information | Correspondence with judicial and administrative authorities, case file details |
4. Methods of Collecting Personal Data
Your personal data is collected by the following methods:
- Website and mobile application — through membership forms, order forms and contact forms
- Cookies and similar technologies — automatically
- E-mail, phone and live support channels
- Social media platforms — where social login is used
- Payment service providers — as part of the payment transaction
5. Legal Grounds for Processing Personal Data
Your personal data is processed on the following legal grounds set out in Articles 5 and 6 of the KVKK:
- Expressly provided for by law (tax legislation, e-commerce legislation, consumer rights legislation)
- Establishment and performance of a contract (membership agreement, sales agreement)
- Legal obligation of the data controller (statutory retention periods, notification obligations)
- Establishment, exercise or protection of a right (conducting legal proceedings)
- Legitimate interest of the data controller (platform security, fraud prevention, service improvement)
- Explicit consent (sending commercial electronic messages, profiling for marketing purposes)
6. Transfer of Personal Data
Your personal data may be transferred to the following parties in accordance with the conditions set out in Articles 8 and 9 of the KVKK:
Recipient | Purpose of Transfer |
|---|---|
Shipping and logistics companies | Carrying out order delivery processes |
Payment institutions and banks | Executing payment transactions |
Legal advisers and audit firms | Legal process management and audit activities |
Authorised public institutions and organisations | Fulfilling legal obligations |
Business partners and suppliers | Delivering the service and managing operational processes |
Cloud service providers | Hosting and backing up data securely |
Where your personal data is hosted on servers located abroad or where service providers based abroad are used, it may be transferred outside Türkiye in accordance with the conditions in Article 9 of the KVKK. The necessary technical and legal measures are taken to ensure an adequate level of protection for such transfers.
7. Retention Period for Personal Data
Your personal data is retained for as long as the purpose of processing requires and within the statutory retention periods prescribed by the relevant legislation. The principal retention periods are:
- Commercial books and records: 10 years (Turkish Commercial Code, Art. 82)
- Invoices and financial documents: 10 years (Tax Procedure Law, Art. 253)
- Consumer transaction records: 3 years (Law on the Protection of Consumers)
- Electronic commerce records: 10 years (E-Commerce Law, Art. 6)
- Cookie data: session cookies when the browser is closed, persistent cookies for a maximum of 2 years
Once the retention period expires, your personal data is deleted, destroyed or anonymised pursuant to Article 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
8. Data Security Measures
The following technical and administrative measures are applied to protect your personal data:
Technical Measures:
- Encrypted data transmission with SSL/TLS
- Database encryption and access controls
- Firewall and penetration testing practices
- Regular backups and disaster recovery plans
- Keeping and monitoring access logs
Administrative Measures:
- Providing personal data security training to employees
- Having confidentiality agreements signed
- Maintaining a data processing inventory
- Reviewing personal data processing policies regularly
- Establishing data breach response procedures
9. Rights of the Data Subject
Pursuant to Article 11 of the KVKK you have the following rights:
- to learn whether your personal data is being processed
- to request information if your personal data has been processed
- to learn the purpose of processing your personal data and whether it is used in line with that purpose
- to know the third parties in Türkiye or abroad to whom your personal data has been transferred
- to request correction if your personal data has been processed incompletely or inaccurately
- to request deletion or destruction of your personal data within the conditions of Article 7 of the KVKK
- to request that correction and deletion operations be notified to the third parties to whom your personal data was transferred
- to object to an outcome to your detriment arising from the analysis of your processed data solely by automated systems
- to claim compensation if you suffer damage due to the unlawful processing of your personal data
10. How to Apply
You may submit requests relating to the rights listed above by the following methods, pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller:
E-mail: [email protected] (from your registered e-mail address)
Post: Orjin Maslak Plaza, Maslak Mah. Eski Büyükdere Cad. No:27, 34398 Sarıyer/İstanbul, Türkiye (by wet-signed petition)
Your application must clearly state your first name, last name, Turkish national ID number, address for service and your request. Your application will be concluded free of charge within 30 days at the latest. If the process incurs an additional cost, the tariff set by the Personal Data Protection Board may be applied.
If your request is rejected, the response given is found insufficient, or no response is given within the time limit, you have the right to lodge a complaint within 30 days of the response being served on you, and in any event within 60 days of the application date, with the Personal Data Protection Board.
11. Changes to This Privacy Notice
This privacy notice may be updated in line with changes to legal regulations and company policies. The current text will always be published on this page, and material changes will additionally be notified to you when you enter the site.
This privacy notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data.