KVKK Disclosure Statement

This English translation is provided for information purposes only. The legally binding text is the Turkish version.

Last updated: April 9, 2026

This notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK", the Turkish equivalent of the GDPR), in order to inform you about how Paksoy Kuyumculuk, acting as data controller, processes your personal data.

1. Identity of the Data Controller

2. Personal Data Processed

Your personal data in the categories listed below are processed:

• Identity data: first name, surname
• Contact data: email address, phone number, delivery and billing address
• Customer transaction data: order history, return requests, details of the products purchased
• Payment data: type of payment method (full card details are processed by PayTR and are not stored by us)
• Device and usage data: IP address, browser type, device information, session data, page navigation records
• Marketing preferences: your consent status for receiving commercial messages by email or SMS

3. Purposes of Processing Personal Data

• Creating and managing your membership account
• Taking, preparing and delivering orders and carrying out return processes
• Carrying out payment transactions and verification processes
• Responding to customer service and support requests
• Fulfilling legal obligations (tax, invoicing, MASAK — the Turkish financial crimes investigation board — and similar)
• Where consent has been given, sending commercial electronic messages about campaigns, discounts and new collection announcements
• Ensuring the security of the site and preventing fraud
• Analyzing site usage statistics and improving service quality

4. Parties to Whom Personal Data Are Transferred and the Purposes of Transfer

Your personal data may be shared with the following parties, for the purposes stated:

• Courier and logistics companies: your first name, surname and delivery address are shared in order to deliver your order.
• PayTR Bilişim Hizmetleri: your payment details are transmitted to the PayTR infrastructure so that payment can be carried out securely; card details are not stored by us.
• Cloud and infrastructure service providers: DigitalOcean (server hosting), MongoDB Atlas (database) and Redis (cache) services are used as part of our data processing activities.
• Competent public authorities and institutions: data may be shared with the relevant authorities where this is legally required.

5. Method of Collecting Personal Data and Legal Grounds

Your personal data are collected by the following means:

• Membership registration and order forms completed on our site
• Your communications through the contact form, by phone and by email
• Usage data collected automatically through cookies and similar technologies

These data are processed under Article 5 of the KVKK on the following legal grounds:

• Article 5/2-c — Formation or performance of a contract: order, delivery and return processes, as well as membership transactions, fall within this scope.
• Article 5/2-ç — Legal obligation: fulfilling obligations under tax legislation, e-invoicing rules and related legislation falls within this scope.
• Article 5/1 — Explicit consent: sending commercial electronic messages and profiling for marketing purposes are carried out solely on the basis of your explicit consent.
• Article 5/2-f — Legitimate interest: usage data may be processed on the basis of legitimate interest in order to ensure the security of the site and to prevent fraud.

6. Your Rights Under Article 11 of the KVKK

Pursuant to Article 11 of the KVKK, you may apply to the data controller to exercise the following rights:

• To learn whether your personal data are being processed
• To request information about the processing if your personal data have been processed
• To learn the purpose of processing your personal data and whether they are used in line with that purpose
• To know the third parties in Turkey or abroad to whom your personal data are transferred
• To request that your personal data be corrected if they have been processed incompletely or inaccurately
• To request the erasure or destruction of your personal data within the conditions set out in Article 7 of the KVKK
• To request that any rectification, erasure or destruction be notified to the third parties to whom the personal data were transferred
• To object to an outcome to your detriment that arises from the analysis of the processed data solely by automated systems
• To claim compensation for damage you suffer because your personal data were processed unlawfully

7. How Can You Exercise Your Rights?

To exercise the rights listed above, you may apply through the following channels:

• Email: info@paksoykuyumculuk.com — you can write to this address with "KVKK Başvurusu" (KVKK application) as the subject line.
• Post: Şazibey Mah. 2. Toptancılar Cad. No:91, Onikişubat / Kahramanmaraş — you can apply to this address with a hand-signed written petition.

Your applications will be concluded free of charge within thirty days at the latest. If the process entails an additional cost, the fee schedule set by the Personal Data Protection Board applies.