Personal Data Protection Notice (KVKK)

This English text is provided for convenience only; the Turkish version is the legally binding text.

This notice is issued by Gizem Duymaz ("Gizemli Tasarımlar") as data controller under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK").

1. Data Controller

– Data controller: Gizem Duymaz — "Gizemli Tasarımlar"

– Address: Yedikule Mahallesi, Hacıkadın Caddesi No: 133, Fatih / İstanbul

– E-mail: info@gizemlitasarimlar.com

2. Personal Data Processed

– Identity: name, surname.

– Contact: e-mail, phone, delivery and billing address.

– Customer transactions: order contents and history, cart, favorites, return/cancellation records, payment status (excluding card data — card data is processed solely by the payment institution PayTR).

– Personalization: the name/letters, color and stone choices you share to be crafted onto the product.

– Transaction security: IP address, session and log records, cookie data.

– Marketing preferences: newsletter subscription and commercial message consents.

3. Purposes

Your data is processed to receive your order, produce the personalized product, collect payment, arrange delivery, manage your account, handle return/cancellation and withdrawal requests, answer questions and complaints, fulfil legal obligations, secure the site, and — only with your explicit consent — send newsletters and campaign notifications.

4. Legal Bases

Data is processed under Article 5/2 KVKK on the bases of: (c) necessity for the formation and performance of the contract, (ç) compliance with legal obligations, (e) establishment and protection of rights, and (f) legitimate interest without harming your fundamental rights. Newsletters and marketing messages rely solely on your explicit consent, which you may withdraw at any time.

5. Transfers

Your data may be transferred, only as necessary, to shipping carriers for delivery, to PayTR and relevant banks for payment, to accounting/legal advisors, and to competent public authorities. Our hosting and e-mail infrastructure providers' servers may be located abroad; such transfers comply with the conditions of Article 9 KVKK (adequacy decision, standard contract or explicit consent).

6. Collection Method

Data is collected through the order, registration, contact and newsletter forms on the site, through cookies, and through e-mail and WhatsApp correspondence, by partly automated and automated means.

7. Retention

Order and contract records are kept for the applicable limitation periods (as a rule 10 years); transaction security and traffic logs for the minimum statutory period under Law No. 5651; marketing consents until withdrawn. Expired data is periodically deleted, destroyed or anonymized.

8. Baby Names and Children's Data

The baby name shared for personalization is limited information knowingly provided by the parent/guardian; it is processed solely to produce the product and keep the order record, never for marketing. No other data about children is requested.

9. Your Rights (Article 11 KVKK)

You may learn whether your data is processed, request information, learn the purpose, know the third parties it is transferred to, request correction or deletion, request notification of corrections/deletions to third parties, object to results of exclusively automated analysis, and claim compensation for damages caused by unlawful processing.

10. Applications

You may submit requests to info@gizemlitasarimlar.com by e-mail or in writing to Yedikule Mahallesi, Hacıkadın Caddesi No: 133, Fatih / İstanbul, in line with the Communiqué on Application Procedures. Applications are concluded free of charge within thirty (30) days at the latest. If rejected or answered insufficiently, you may lodge a complaint with the Turkish Personal Data Protection Board.

11. Commercial Electronic Messages

Newsletters and campaign e-mails are sent only with your explicit opt-in; consents are managed via the Turkish Message Management System (İYS) under Law No. 6563. Every message contains an unsubscribe link; you may withdraw consent at any time via İYS or the link in the message.