Privacy Notice

This privacy notice has been prepared under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") to inform people who visit tavladunyasi.com, send us a request, become a member or purchase products from us.

1. Data controller

Tavla Dünyası – Mehdi Turan
Fenerbahçe Mah. Mahur Sok. No: 20/1A Kat: 4, Kadıköy / Istanbul, Türkiye
Email: destek@tavladunyasi.com
WhatsApp: +90 539 690 02 81

2. Personal data we process

Request and contact forms: full name, phone number, email address, preferred contact channel, your message, the product you are interested in, your personalisation and budget preferences, and the page from which you sent the form.

Membership: full name, email address, password (stored only in irreversibly encrypted form), phone number, language and currency preference, delivery and billing details you add to your address book (for corporate invoices, company name, tax office and tax number), your favourite products, your request history, and the version and date of the texts you have accepted. If you sign in with Google, the name and email address Google shares with us.

Orders and sales: delivery and billing details, order contents, payment details (the amount and date of your bank transfer and the sending account details), shipping and delivery information, and your return and withdrawal requests.

Correspondence: information you share with us via WhatsApp, phone or email.

Security and technical data: IP address (not stored in raw form on the request form; only an irreversible hash is kept to limit abuse), browser information, session and sign-in times, and technical data assessed by Cloudflare Turnstile for bot protection.

Our website does not use advertising or tracking cookies. Details are on our Cookie Policy page.

3. Purposes and legal grounds

• Responding to your request, preparing quotes, handling orders and custom production, and delivering products: necessary for the conclusion or performance of a contract (KVKK Art. 5(2)(c)).
• Creating and managing your member account (sign-in, favourites, addresses, request history): conclusion and performance of a contract (Art. 5(2)(c)).
• Issuing invoices, keeping accounting records, handling withdrawal and return requests in line with the law, and responding to requests from authorities: compliance with a legal obligation (Art. 5(2)(ç)).
• Establishing and protecting our rights in the event of a dispute: necessary for the establishment, exercise or protection of a right (Art. 5(2)(e)).
• Keeping the website and accounts secure, preventing spam and abuse, and backing up data: necessary for our legitimate interests (Art. 5(2)(f)).
• Sending commercial messages about new products and campaigns: only with your explicit consent (Art. 5(1)) and within the scope of Law No. 6563 on the Regulation of Electronic Commerce. You can withdraw this consent at any time from your profile page or by writing to us.

4. Transfer of personal data

Your personal data is not sold or shared for advertising purposes. It is transferred only for the purposes above and to the extent necessary to the following recipients:

• Our service providers: Supabase (database and membership infrastructure; servers in Frankfurt, Germany), Cloudflare (website hosting, content delivery, bot protection, encrypted backups), Resend (sending membership emails), Google (only if you use "Sign in with Google"), WhatsApp / Meta Platforms (if you correspond with us on WhatsApp).
• Shipping companies: full name, address and phone number for delivery.
• Our accountant and banks: for invoicing, accounting and payment transactions.
• Competent public authorities and courts: where required by law or upon request.

Some of our service providers are based abroad or may process data on servers outside Türkiye. These transfers are carried out in accordance with the safeguards set out in KVKK Art. 9 (by means of standard contracts).

5. How we collect data

Your personal data is collected electronically, partly by automated means, through the forms and membership functions on our website, WhatsApp, phone and email correspondence, and the ordering process.

6. Retention periods

• Membership data: until you delete your account. You can delete your account at any time from your profile page; when you do, your profile, addresses and favourites are permanently deleted.
• Requests and correspondence that do not result in a sale: 2 years from the date of last contact.
• Sales, invoice and accounting records: 10 years, as required by the Turkish Commercial Code and the Tax Procedure Law.
• Consent to commercial messages: until you withdraw it; consent and opt-out records are kept for the period required by law.
• Encrypted backups: automatically deleted after 14 days.

Deleting your account does not affect records that must be kept by law (such as invoices); in that case your requests are kept for the periods above with their link to your account removed. When the period ends, the data is deleted, destroyed or anonymised.

7. Your rights

Under KVKK Art. 11, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its deletion or destruction under KVKK Art. 7; to request that these actions be notified to third parties to whom the data has been transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation if you suffer damage due to unlawful processing.

8. How to apply

You can send your application to destek@tavladunyasi.com from the email address you have previously given us and that is registered in our system, or in writing to our address above. Your application must include information that allows us to verify your identity and a clear description of your request.

We will respond to your application free of charge within 30 days at the latest, depending on its nature. If the process involves an additional cost, the fee set by the Turkish Personal Data Protection Authority may apply.