Privacy Policy and Personal Data Notice

As Öz Ürgüp ("Company", "we"), we attach great importance to the privacy and security of your personal data. This Privacy Policy informs you, within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK") and applicable legislation, about the purposes for which personal data collected through ozurgup.com ("Site") is processed, the legal grounds for processing, transfer conditions, and your rights.

By using the Site or benefiting from our services, you are deemed to have accepted the terms set forth in this policy.

Information regarding the organization acting as the data controller under KVKK:

• Öz Ürgüp
• Adnan Kahveci Caddesi No:42 / Ürgüp Nevşehir
• info@ozurgup.com
• +90 534 367 10 50

The following personal data is collected in order to provide our services:

First name, last name, Turkish ID number (for invoicing purposes).

Email address, phone number, delivery and billing address.

Username, email, encrypted password, account creation date.

Order history, order details, delivery status, invoice information, return/exchange requests.

Preferred payment method and transaction reference numbers. This data is processed and protected by the iyzico infrastructure in compliance with PCI DSS standards.

IP address, browser type and version, operating system, device information, pages visited, visit duration, referring URL, cookie data.

Message content transmitted to us via contact form, email, or telephone.

Your personal data is processed for the following purposes based on the legal grounds specified in Articles 5 and 6 of KVKK:

• Creating, processing, shipping, delivering orders, and issuing invoices
• Managing payment confirmation, refunds, and chargeback processes (via iyzico)
• Managing requests, complaints, and suggestions; providing support
• Compliance with tax legislation, e-commerce regulations, and consumer protection legislation
• Detecting and preventing fraud; ensuring system security
• Enhancing service quality, improving user experience, conducting statistical analyses
• Sending campaign, discount, and informational messages (only with your explicit consent)

Your personal data is processed based on the following legal grounds listed in Article 5(2) of KVKK:

• Being directly related to the establishment or performance of a contract (Art. 5/2-c)
• Fulfilment of the data controller's legal obligation (Art. 5/2-ç)
• Legitimate interest of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5/2-f)
• Explicit consent of the data subject (for marketing activities)

Your personal data may be transferred to the following parties, limited to the purposes stated above:

Your personal data is not shared with third parties other than those listed above and is never sold for commercial purposes under any circumstances.

• Secure processing of payment transactions
• Delivery of your orders
• Fulfilment of invoice and tax obligations
• Legal consultancy and dispute resolution
• Where required by law (court order, prosecutor's request, etc.)
• Technical infrastructure providers offering hosting, email, and SMS services (data is transferred in encrypted form)

Your payment transactions are processed through the iyzico secure payment infrastructure. iyzico:

Your credit/debit card information (card number, expiration date, CVV) is absolutely not stored on Company servers and cannot be viewed by Company employees. This data is processed in encrypted form directly within the iyzico infrastructure.

• Operates a licensed virtual POS infrastructure
• Provides a secure payment environment compliant with PCI DSS standards
• Ensures data security through 256-bit SSL encryption
• Supports the 3D Secure protocol

Cookies are used on the Site to improve user experience and optimize our services.

Required for the basic functions of the Site to operate. Used for session management, cart information, and security purposes. These cookies cannot be disabled.

Help us understand how visitors use the Site. Used for page view statistics and error reporting. Collected data is anonymous.

Used to remember your language preference, region, and personalization settings.

You may manage, delete, or block cookies through your browser settings. However, disabling cookies may cause some features of the Site to not function properly.

Your personal data is retained for the period required by the purposes of processing and in accordance with legal retention obligations:

Upon expiry of the retention period, data is deleted, destroyed, or anonymized in compliance with KVKK.

• 10 years (Turkish Commercial Code Art. 82)
• 5 years (Tax Procedure Law)
• 3 years (Law No. 6563)
• 3 years
• Until consent is withdrawn

The following measures are implemented to prevent unlawful processing of and access to your personal data and to ensure its safekeeping:

• Secure data transmission via SSL/TLS encryption
• Protection of passwords using hash algorithms
• Access control and authorization policies
• Regular security updates and patches
• Firewall protection
• Regular data backups
• Employee awareness training on data security

Under Article 11 of KVKK, you have the following rights:

To exercise these rights, you may submit a written request via our Contact page or to info@ozurgup.com. Your request will be concluded within 30 (thirty) days at the latest.

• To learn whether your personal data is being processed
• To request information if your personal data has been processed
• To learn the purpose of processing and whether it is used in accordance with that purpose
• To know the third parties to whom your personal data is transferred domestically or abroad
• To request correction if your personal data is incomplete or inaccurately processed
• To request deletion or destruction of your personal data under the conditions set forth in Article 7 of KVKK
• To request that correction and deletion operations be notified to third parties to whom personal data has been transferred
• To object to a result arising against you solely through analysis of processed data by automated systems
• To claim compensation for damages suffered due to unlawful processing of personal data

The Company reserves the right to update this Privacy Policy in accordance with legal regulations and business requirements. Significant changes will be announced on the Site. The updated policy shall be effective from the date of publication.

For any questions, requests, or complaints regarding this Privacy Policy and your personal data, you may reach us via our Contact page or through the following channels:

• info@ozurgup.com
• +90 534 367 10 50
• Adnan Kahveci Caddesi No:42 / Ürgüp Nevşehir