Processing Of Personal Data

At Kayalar Jewellery, we place great importance on protecting the personal data of our customers, registered members, website visitors and individuals who communicate with us. We believe that personal information should be handled lawfully, securely, transparently and responsibly throughout our business operations.

Our approach to personal data protection is guided by Türkiye's Personal Data Protection Law No. 6698 (KVKK) and other applicable legislation. Where the relevant legal conditions are met, additional international data protection requirements, including the European Union's General Data Protection Regulation (GDPR) and applicable United Kingdom data protection legislation, may also apply.

This page explains the general principles followed by Kayalar Jewellery in relation to personal data protection, data security, information handling and individual privacy rights. Detailed information concerning specific processing activities, their legal bases, data recipients and retention arrangements is provided through the relevant Personal Data Protection notices and our Privacy Policy.

1. Our Approach to Personal Data Protection

Kayalar Jewellery recognises that protecting personal information is an essential element of customer trust and responsible business management.

We aim to process personal data only for specified, explicit and legitimate purposes, ensuring that the information used is relevant, limited and proportionate to the activities for which it is required.

Appropriate consideration is given to maintaining the accuracy of personal information, protecting it against unauthorised access and retaining it only for the periods permitted or required by applicable legislation.

Our data protection approach includes reviewing relevant technical and organisational safeguards, access arrangements, business processes and applicable legal obligations.

Where personal information is processed in connection with international customers or external service providers, the applicable privacy requirements and any relevant cross-border data transfer conditions must also be considered.

2. What Is Personal Data?

Personal data means any information relating to an identified or identifiable natural person.

Depending on the nature of your interaction with Kayalar Jewellery, personal information may include one or more of the following categories:

• Identification Information: Name, surname and other information necessary to identify the relevant individual.
• Contact Information: Telephone numbers, email addresses and other communication details.
• Delivery & Billing Information: Postal addresses, recipient information and billing details associated with an order.
• Membership Information: Customer account details, registration information and relevant account preferences.
• Order & Purchase Information: Products purchased, order history, transaction references and related customer records.
• Customer Communication Records: Enquiries, complaints, requests and other information shared during customer service interactions.
• Technical Information: IP addresses, device information, browser details and website usage data.
• Other Relevant Personal Information: Additional information processed where necessary for a particular lawful business activity.

Not every category of personal information listed above is necessarily collected from every customer or website visitor. The information involved depends on the services used and the nature of the relevant processing activity.

3. Fundamental Principles of Personal Data Processing

Kayalar Jewellery aims to conduct personal data processing activities in accordance with the fundamental principles established under applicable data protection legislation.

These principles include:

• Lawfulness & Fairness: Personal information must be processed lawfully and in accordance with the principles of fairness and good faith.
• Accuracy: Personal data should be accurate and, where necessary, kept up to date.
• Purpose Limitation: Information must be processed for specified, explicit and legitimate purposes.
• Data Minimisation: Processing must be relevant, limited and proportionate to the purposes for which the information is required.
• Storage Limitation: Personal information must be retained only for the period required by applicable legislation or the relevant processing purpose.
• Security & Confidentiality: Appropriate measures must be considered to protect information against unauthorised access, unlawful processing, accidental loss or improper disclosure.

These principles guide the assessment of personal data processing activities associated with our website, customer services and jewellery retail operations.

4. Purposes of Personal Data Processing

Personal data may be processed for purposes connected with the operation of Kayalar Jewellery, the provision of our services and the fulfilment of applicable legal or contractual obligations.

Depending on the relevant activity and legal basis, these purposes may include:

• Creating and managing customer accounts and membership services.
• Processing jewellery orders and managing sales transactions.
• Supporting payment verification, invoicing, accounting and financial administration.
• Arranging domestic and international shipping and delivery.
• Managing customer enquiries, requests and complaints.
• Providing after-sales support, including returns, exchanges and product-related assistance.
• Maintaining the security of the website and relevant information systems.
• Preventing fraudulent transactions, unauthorised access and other security risks.
• Complying with applicable taxation, accounting, consumer protection and other legal obligations.
• Establishing, exercising or defending legal claims.
• Conducting marketing or customer experience activities where an appropriate legal basis exists and relevant communication requirements are satisfied.

For international orders, certain personal information may be required by couriers, customs authorities or other relevant service providers to facilitate lawful shipment and delivery.

The specific purposes and legal bases associated with individual processing activities are explained in the relevant Personal Data Protection notices.

5. Legal Bases for Processing Personal Data

Personal data is processed on the basis of an appropriate legal condition established under Türkiye's Personal Data Protection Law No. 6698 and any other legislation applicable to the relevant activity.

Depending on the circumstances, the legal grounds for processing may include:

• Processing expressly permitted or required by law.
• Processing directly necessary for the establishment or performance of a contract.
• Compliance with a legal obligation applicable to the data controller.
• Establishment, exercise or protection of a legal right.
• Legitimate interests where permitted by law and where the individual's fundamental rights and freedoms are appropriately protected.
• Explicit consent where it is an appropriate and legally required basis for the relevant processing activity.
• Other processing conditions expressly recognised by applicable data protection legislation.

Where the EU GDPR or applicable UK data protection legislation governs a particular processing activity, the relevant legal basis must also satisfy the requirements of that framework.

6. Methods of Personal Data Collection

Personal information may be collected through different physical and electronic channels, depending on how individuals interact with Kayalar Jewellery.

These channels may include our official website, customer registration forms, checkout procedures, order management processes, customer support communications and other relevant business interactions.

Information may also be obtained through telephone conversations, email correspondence, authorised messaging channels and interactions at our physical store, where relevant to the service provided.

Certain technical information may be generated through website sessions, server records, cookies and similar technologies.

Where optional cookies or tracking technologies require consent, the relevant processing must be managed in accordance with applicable legal requirements.

7. Sharing Personal Data

Kayalar Jewellery may share personal information with third parties where necessary for a legitimate business purpose, the performance of a contract, compliance with legal obligations or another appropriate legal basis.

Depending on the relevant transaction and processing activity, personal data may be shared with:

• Shipping & Logistics Providers: Courier companies and logistics services responsible for order fulfilment and delivery.
• Banks & Payment Service Providers: Financial institutions and payment providers involved in transaction processing, verification and refunds.
• Information Technology Providers: Website infrastructure, hosting, software and technical support providers.
• Accounting & Financial Service Providers: Organisations providing accounting, invoicing and financial administration services.
• Legal & Professional Advisers: Advisers involved in relevant legal, compliance or professional support activities.
• Competent Public Authorities: Courts, tax authorities, customs administrations and other bodies where disclosure is required or permitted by law.
• Other Authorised Service Providers: Relevant service providers and business partners where the disclosure has an appropriate legal basis.

Information sharing should be limited to the personal data necessary for the particular activity.

Where third parties process personal data on behalf of Kayalar Jewellery, the relevant contractual responsibilities, technical safeguards and applicable data protection requirements must be considered.

International shipping arrangements may require the disclosure of recipient details to couriers, customs authorities or delivery partners outside Türkiye, subject to applicable legal requirements.

8. International Transfers of Personal Data

The operation of an international e-commerce business may involve personal data being transferred to, stored in or accessed from another country.

Such circumstances may arise through international shipping arrangements, technology infrastructure, cloud-based services, communication systems or other relevant business activities.

Where personal data is transferred outside Türkiye, the transfer must comply with Article 9 of Türkiye's Personal Data Protection Law No. 6698 and the relevant secondary legislation.

Depending on the applicable circumstances, international transfers may rely on an appropriate adequacy decision, recognised safeguards or another legally permitted transfer mechanism.

Recognised safeguards may include applicable standard contracts, approved binding corporate rules or other arrangements expressly provided for under the relevant legislation.

In specific exceptional circumstances, other statutory transfer grounds may be available, subject to their individual legal conditions.

Explicit consent is not a general substitute for the safeguards and legal conditions required for routine international transfers.

Where the EU GDPR or applicable United Kingdom data protection legislation also governs a particular transfer, the relevant international transfer restrictions and safeguards must be considered separately.

Further information about actual transfer destinations, relevant recipients and applicable legal mechanisms should be provided through the appropriate privacy notices where required by law.

9. Personal Data Security

Kayalar Jewellery recognises the importance of protecting personal data against unlawful processing, unauthorised access, accidental loss, misuse or inappropriate disclosure.

Appropriate technical and organisational safeguards are considered according to the nature of the information processed, the systems involved and the relevant security risks.

Depending on the applicable systems and operational requirements, relevant security measures may include:

• Access authorisation and user permission management.
• Appropriate account authentication and password security practices.
• Website and information system security measures.
• Relevant technical logging and monitoring procedures.
• Measures intended to reduce the risk of unauthorised access or disclosure.
• Review of relevant service providers and operational security responsibilities.
• Security assessments and improvements where reasonably necessary.

The suitability of security measures should be reviewed in light of technological developments, changes in business processes and applicable legal obligations.

Although no internet-based system can be guaranteed to be entirely risk-free, appropriate security practices remain an essential part of responsible personal data processing.

10. Access to Personal Data

Access to personal information should be limited to individuals who require that information for legitimate and authorised business purposes.

Access permissions should reflect relevant responsibilities and the nature of the processing activity, with appropriate safeguards intended to prevent unauthorised use.

Where external service providers require access to personal information, such access must be assessed according to the applicable contractual arrangements and data protection requirements.

Information should not be disclosed or used for purposes unrelated to its lawful processing without an appropriate legal basis.

11. Retention of Personal Data

Personal information is retained for periods determined by the purpose of the relevant processing activity and the requirements of applicable legislation.

Different categories of information may be subject to different retention requirements, including those associated with customer accounts, orders, invoices, accounting records, customer support requests and legal obligations.

Information must not be retained for longer than necessary for the lawful purpose concerned, subject to applicable statutory retention periods and other recognised legal grounds.

Where the purpose of processing no longer exists and there is no other lawful basis or obligation requiring continued retention, personal data must be handled in accordance with the relevant rules concerning deletion, destruction or anonymisation.

The relevant retention periods, or the criteria used to determine them, should be explained in the applicable activity-specific data protection notices where required by law.

12. Cookies & Website Data

The Kayalar Jewellery website may use cookies and similar technologies to support essential website functionality, manage shopping sessions, remember selected preferences and understand website performance.

Depending on the website configuration, such technologies may also support analytics, advertising or other optional services.

Where applicable legislation requires consent for non-essential cookies or similar tracking technologies, the relevant consent must be obtained through an appropriate mechanism before the activity begins.

Users should be provided with suitable information and controls for managing optional cookie preferences where required by law.

Further details concerning cookie categories, purposes, relevant service providers, retention and preference management are available in our Cookie Notice.

13. Explicit Consent & Privacy Notices

Kayalar Jewellery treats the obligation to provide privacy information and the process of obtaining explicit consent as separate legal matters.

Individuals must receive the relevant information about the collection and processing of their personal data in accordance with applicable legal requirements.

Under Türkiye's Personal Data Protection Law, the applicable privacy notices must provide the information required by Article 10, including the identity of the data controller, processing purposes, relevant recipients, collection methods, legal bases and individual rights.

Where a particular processing activity requires explicit consent, it must be requested separately through an appropriate mechanism.

Consent should be specific, informed and freely given. Where applicable law requires an affirmative choice, silence, inactivity or pre-selected consent options are not sufficient.

Refusing optional consent does not, by itself, prevent the provision of essential services that can lawfully be carried out on another legal basis.

Further information is available through our Privacy Policy, Personal Data Protection notices and Explicit Consent Statement.

14. Commercial Electronic Communications

Personal data protection obligations and permission to receive commercial electronic communications are separate legal matters.

Where required by applicable legislation, promotional communications involving new jewellery collections, special offers, discounts, campaigns or product announcements are subject to an appropriate marketing permission process.

Customers who create an account or complete a purchase do not automatically provide unrestricted consent to receive marketing communications.

Where marketing permission has been granted, individuals may update their preferences or withdraw the relevant permission in accordance with applicable law.

Further information is provided in our Marketing Communications Consent information.

15. Your Personal Data Protection Rights

Individuals whose personal data is processed by Kayalar Jewellery may exercise the rights granted under the data protection legislation applicable to the relevant activity.

Under Article 11 of Türkiye's Personal Data Protection Law No. 6698, individuals have the following rights, subject to the applicable legal requirements:

• To learn whether their personal data is being processed.
• To request information where their personal data has been processed.
• To learn the purposes of processing and whether personal data is used consistently with those purposes.
• To know the third parties to whom their personal data has been transferred, whether within Türkiye or internationally.
• To request the correction of incomplete or inaccurate personal data.
• To request the deletion or destruction of personal data where the statutory conditions are satisfied.
• To request notification of relevant correction, deletion or destruction operations to third parties to whom the personal data has been transferred.
• To object to an outcome arising against them from the analysis of their personal data exclusively through automated systems.
• To claim compensation for damage arising from unlawful personal data processing, where the applicable legal conditions are satisfied.

Where the EU GDPR or applicable UK data protection legislation governs a particular processing activity, additional or differently defined rights may be available.

Depending on the relevant legal conditions, these may include rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent, together with protections relating to certain automated decisions.

Individuals may also have the right to lodge a complaint with a competent supervisory authority where the applicable legislation provides for that right.

The scope and availability of any particular right must be assessed according to the legislation governing the relevant processing activity.

16. Personal Data Requests

Individuals may submit requests concerning their personal data to Kayalar Jewellery in accordance with Türkiye's Personal Data Protection Law No. 6698 and any other applicable legislation.

For requests governed by Turkish law, applications must be submitted in writing or through another method recognised by the Personal Data Protection Board.

Under Article 13 of Law No. 6698, data controllers must respond to applicable requests as soon as possible and, in any event, within 30 days, subject to the relevant legal requirements.

Where EU or UK data protection legislation applies, different response deadlines and procedural requirements may be relevant.

To assist with the appropriate handling of a request, individuals may be asked to provide information reasonably necessary to verify their identity and identify the personal data concerned.

For further information about the recognised application methods and the details required for a request, please refer to our Data Subject Request Form and the relevant Personal Data Protection notices.

17. Personal Data Security Incidents

Where an incident involving personal data is identified or reasonably suspected, the circumstances must be assessed according to the nature of the information concerned, the potential risks and the relevant legal requirements.

Appropriate technical, organisational and legal measures may be necessary to investigate the incident, limit its consequences and address any identified security vulnerabilities.

Where applicable legislation requires notification of a personal data breach to a supervisory authority or affected individuals, the relevant notification obligations and deadlines must be observed.

Under Türkiye's Personal Data Protection Law, relevant notification obligations may arise where personal data has been obtained unlawfully by others.

Where the EU GDPR or applicable UK data protection legislation also governs the incident, any additional notification thresholds, deadlines and reporting procedures must be considered.

Data security incidents are assessed according to the specific circumstances and the applicable obligations of the relevant data controller and service providers.

18. Updates & Changes

Kayalar Jewellery may review and update its personal data protection practices to reflect changes in legislation, technological developments, relevant security risks and business operations.

This page may also be updated to provide clearer information about our general approach to personal data protection.

Updated information may be published on our official website.

Where a material change to personal data processing requires additional information, a different legal basis or renewed consent, the relevant legal requirements must be satisfied separately.

The publication of revised privacy information does not, by itself, constitute consent to new processing activities.

19. Contact Information

If you have questions about personal data protection, privacy practices, international data transfers, consent preferences or the exercise of your data protection rights, please contact Kayalar Jewellery through the official communication channels below.