Personal Data Protection and Privacy Policy

2. Categories of Personal Data Processed

Identity data: name, surname and any other identity information you share in connection with your request.

Contact data: e-mail address, telephone number, delivery and invoice address.

Customer transaction data: order records, order number, invoice and payment records, return and withdrawal requests, support correspondence.

Transaction security data: server logs, IP address, browser and device information, and similar technical data kept so that the system operates securely.

Marketing data: your e-mail address and subscription preferences, where you subscribe to the newsletter.

Any other information contained in documents you send us in connection with your request.

No special categories of personal data (health, biometric data and the like) are requested or processed. Please do not share such data in support correspondence.

3. Purposes of Processing

Carrying out product purchase processes: receiving, verifying, preparing and delivering your order.

Issuing invoices and meeting document retention obligations arising from tax legislation.

Handling right-of-withdrawal, return, exchange, warranty and non-conformity claims.

Answering and recording support enquiries, questions and complaints.

Ensuring the security of the website and related systems, detecting faults and preventing misuse.

Sending newsletters and commercial electronic messages, where you have given explicit consent.

Fulfilling obligations arising from legislation and responding to requests from authorised public authorities.

4. Legal Grounds for Processing

Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK:

Direct relation to the conclusion or performance of a contract (Art. 5/2-c): order, payment, delivery, return and warranty processes.

Necessity for the data controller to fulfil a legal obligation (Art. 5/2-ç): issuing invoices, keeping commercial books and records, and the information and record-keeping duties imposed by consumer legislation.

Necessity for the establishment, exercise or protection of a right (Art. 5/2-e): retaining records that would serve as evidence in the event of a dispute.

Necessity for the legitimate interests of the data controller, provided that your fundamental rights and freedoms are not harmed (Art. 5/2-f): system security, log retention, fraud prevention.

Your explicit consent (Art. 5/1): obtained solely for newsletter subscription and commercial electronic messages. You may withdraw your consent at any time; withdrawal does not render processing carried out until that date unlawful.

5. Method of Collection

Your personal data is collected through forms on the website, the order flow and newsletter registration; through the contact you initiate by e-mail, telephone and support channels; and through server logs generated automatically while the systems operate.

Data is obtained by wholly or partly automated means, or by non-automated means forming part of a filing system.

6. Transfers and Recipient Groups

Your personal data may be transferred to the following recipient groups, to the extent necessary to achieve the purposes listed above and in accordance with Article 8 of the KVKK:

Shipping and logistics providers: your name, address and contact details, so that the order can be delivered.

Payment and banking infrastructure providers: for the collection and verification of payment. We do not store your card details; payment is processed through infrastructure operated by [PAYMENT SERVICE PROVIDER].

IT and hosting providers: for the operation of the site and e-mail infrastructure.

Accounting, audit and legal advisers: for the fulfilment of financial and legal obligations.

Authorised public authorities and judicial bodies: within the scope of requests for information and documents arising from legislation.

Beyond this, your personal data is not sold, rented or transferred to third parties for marketing purposes.

7. Cross-Border Transfers

Some of the IT services used may have servers located abroad. In that case your personal data is transferred in accordance with the tiered regime set out in Article 9 of the KVKK as amended by Law No. 7499.

Transfers are made primarily to countries for which the Board has issued an adequacy decision. Where no adequacy decision exists, one of the appropriate safeguards listed in the same article is relied upon (in particular the standard contract published by the Board), and the standard contract is notified to the Board within five business days of signature.

Where those safeguards cannot be provided and none of the occasional-transfer situations set out in the article applies, no transfer is made.

8. Retention Periods

Your personal data is retained for as long as necessary for the purpose for which it is processed, having regard to the limitation periods laid down in the relevant legislation.

Order, delivery, withdrawal and disclosure records: at least 3 years under the Distance Contracts Regulation.

Electronic commerce records: 10 years under Law No. 6563 and its implementing regulation.

Invoices and financial records: 5 to 10 years under the Tax Procedure Law and the Turkish Commercial Code.

Newsletter subscription data: for as long as your subscription continues; where you withdraw consent, it is deleted in the first periodic destruction cycle.

Once these periods expire, your personal data is deleted, destroyed or anonymised.

9. Your Rights as a Data Subject

Under Article 11 of the KVKK, you have the following rights, which you may exercise by applying to the data controller:

To learn whether your personal data is being processed and, if so, to request information about it.

To learn the purpose of processing and whether the data is used in accordance with that purpose.

To know the third parties to whom your personal data is transferred, whether in Türkiye or abroad.

To request rectification where your personal data is incomplete or inaccurate.

To request the erasure or destruction of your personal data under the conditions laid down in Article 7 of the KVKK.

To request that rectification, erasure and destruction be notified to the third parties to whom your data has been transferred.

To object to an outcome adverse to you arising from the analysis of processed data exclusively by automated systems.

To claim compensation where you suffer loss as a result of unlawful processing of your personal data.

10. How to Exercise Your Rights

You may submit requests concerning your rights through the following channels, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller:

By a wet-signed petition delivered in person to the address above, or sent through a notary.

By registered electronic mail to [KEP ADDRESS], signed with a secure electronic signature or mobile signature.

By e-mail to support@t3gemstone.org from an e-mail address already registered in our systems.

Your application must state your name, surname, signature, Turkish ID number (for foreign nationals, nationality and passport number), your address for notification, your e-mail address and telephone number if any, and the subject of your request.

Your request will be concluded free of charge as soon as possible and in any event within 30 days, depending on its nature. Where the process entails a separate cost, the fee set out in the tariff determined by the Board may be charged.

If your application is rejected, if you find the response inadequate, or if no response is given within the period, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning the response and in any event within 60 days of the date of application.

11. Cookies

Detailed information on the use of cookies on our website is set out in the Cookie Policy.

12. Amendments and Entry into Force

This disclosure text may be revised in line with changes in legislation or updates to our processing activities. The current text is always published on this page, and the date of last update is stated at the top of the page.

Where the purposes of processing change, a fresh disclosure is made before the data is processed.