Personal Data Protection Notice

This notice has been prepared by Akpınar Altın ve Kıymetli Madenler San. Tic. Ltd. Şti. as data controller under Article 10 of the Personal Data Protection Law No. 6698 ("Law") and Article 4 of the Communiqué on Fulfilment of the Obligation to Inform. It is not a consent statement; it is for information only. 1. DATA CONTROLLER SELLER / DATA CONTROLLER Trade name: Akpınar Altın ve Kıymetli Madenler San. Tic. Ltd. Şti. Address: Küçükbakkalköy Mah. Başöğretmen Cad. No: 6, 34750 Ataşehir / İstanbul Tax office / no: Kozyatağı Vergi Dairesi / 0330980994 MERSIS no: {{FIRMA_MERSIS}} Phone: 0533 012 60 00 E-mail: info@akpinaraltin.com Registered e-mail (KEP): {{FIRMA_KEP}} Jewellery Trade Licence no: {{KUYUM_YETKI_BELGE_NO}} Professional chamber: {{MESLEK_ODASI}} Website: www.akpinarmucevherat.com 2. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL BASES Each line: data category — purpose — legal basis (Article 5 of the Law). a) Identity (name, surname): order creation, invoicing, delivery — Art. 5/2-(c) conclusion and performance of a contract; Art. 5/2-(ç) legal obligation. b) Identity (Turkish ID number): invoicing obligation (Tax Procedure Law); customer identification under Law No. 5549 (MASAK) for transactions above the statutory threshold — Art. 5/2-(a) expressly provided by law; Art. 5/2-(ç). b.1) Identity verification (date of birth, front/back images and expiry date of the Turkish identity card, and manual review result): age verification, determining the account's ordering entitlement, fraud prevention and supporting obligations under Law No. 5549 — Art. 5/2-(a), (ç), (f). Static document review is not certified remote identification and does not by itself conclusively prove identity. c) Contact (e-mail, phone, delivery and invoice address): order notifications, delivery, sending the contract and invoice — Art. 5/2-(c). d) Customer transactions (order, payment, return, withdrawal, contract approval records): performance of the contract, statutory record-keeping, establishment and protection of rights in disputes — Art. 5/2-(c), (ç), (e). e) Finance (bank transfer sender details, receipt, IBAN): matching payment to the order, refunds — Art. 5/2-(c). f) Transaction security (IP address, session and log records, device/browser data, strictly necessary cookie identifiers): site security, fraud prevention, account security, proof of contract approval — Art. 5/2-(f) legitimate interest; Art. 5/2-(e). g) Membership (username, password hash, address book, favourites): provision of the membership service — Art. 5/2-(c). h) Marketing (commercial electronic message preference, newsletter subscription, non-essential cookies): campaign and promotional messages, interest-based content — Art. 5/1 EXPLICIT CONSENT (obtained separately and optionally; never a condition of ordering). When card payment is offered, card data is not stored by us; it is processed by a licensed payment institution. 3. METHOD OF COLLECTION Your personal data is collected by fully or partly automated means through the membership, identity verification, order, contact and newsletter forms on our website, e-mail correspondence and log/cookie records generated during site use; and by non-automated means as part of a filing system during authorised staff review of identity documents and phone/e-mail contact with customer service. 4. TRANSFERS Your personal data is transferred only to the following recipient groups for the stated purposes: - Carrier ({{KARGO_FIRMASI}}): name, phone, address for delivery. - Accountant and e-invoice/e-archive integrator: identity, ID number, address and order data for invoicing and fiscal obligations. - Hosting and e-mail delivery providers: operation of the site and notifications (as data processors). - Competent public authorities (MASAK, tax administration, courts, arbitration committees): legal obligation and upon request. Identity card images are not stored in a public file area. They are kept in encrypted private storage and are available only to authorised panel users through a watermarked viewer whose access is audit-logged. No customer or third-party download link is provided. Your personal data is not sold to third parties for marketing. Any transfer abroad is carried out under the conditions of Article 9 of the Law (standard contract and notification to the Authority); providers established abroad, if any, are listed in the Cookie Policy. 5. RETENTION PERIODS - Order, contract, preliminary information and withdrawal records: at least 3 years (Distance Contracts Regulation Art. 20). - Invoices and fiscal records: 5 years (Tax Procedure Law Art. 253); commercial books and correspondence: 10 years (Commercial Code Art. 82); e-commerce transaction records: 10 years (Law No. 6563 Art. 11). - MASAK identification documents: 8 years from the last transaction (Law No. 5549 Art. 8). - Commercial electronic message consent records: 3 years after the consent ends. - Membership data: for the duration of membership and the statutory periods thereafter. - Log and transaction security records: for the period required by law. At the end of the period, data is deleted, destroyed or anonymised. 6. YOUR RIGHTS (ARTICLE 11) Under Article 11 of the Law you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose and whether it is used accordingly; to know the third parties to whom it is transferred; to request correction if incomplete or inaccurate; to request deletion or destruction under Article 7; to request notification of these operations to third parties; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing. 7. HOW TO APPLY Under the Communiqué on Application to the Data Controller, you may apply in writing to the address above, via our KEP address, with a secure electronic or mobile signature, or from the e-mail address registered in our system to info@akpinaraltin.com. The application must include your name and surname, Turkish ID number (nationality and passport number for foreigners), address for service, e-mail/phone if any, and the subject of the request. Applications are concluded free of charge within 30 days at the latest. If your application is refused, the reply is insufficient or no reply is given in time, you may lodge a complaint with the Personal Data Protection Board. The last update date is shown at the top of the page.