Personal Data Protection Notice (KVKK)
This Personal Data Protection Notice has been prepared for velvetacare.com visitors, members and customers in accordance with the Personal Data Protection Law No. 6698 (“KVKK”).
1. Data Controller
Data Controller: Mina Keshavarz / Velveta Care
Adres: Yeniyol Mh. Gazi 3. Sk. SEGEM İş Merkezi, No: 3, İç Kapı: 5, Çorum Merkez / Türkiye
Email:[email protected]
Phone: +90 536 590 31 34
2. Personal Data Categories That Can Be Processed
Velveta can process the following categories of data depending on the operation being carried out:
- Identity: first name, last name, customer/user number.
- Contact: phone, email, shipping/billing address.
- Customer transaction: order, basket, invoice, delivery, return, request and complaint records.
- Payment transaction: transaction status, payment reference, limited transaction information transmitted by the payment institution.
- Transaction security/technical: IP, log, device, browser, session, authentication and anti-abuse records.
- Customer contact: user-sent messages via email, WhatsApp, and support tickets.
- Comment/rating: comment, rating, title, published name/nickname and order matching data.
- Legal transaction/approval: Pre-information Form, Distance Sales Agreement, commercial message and cookie preferences and their time, version and technical proof records.
It is essential that card number, CVV and similar sensitive card verification data are not stored unnecessarily in Velveta systems.
3. Collection Methods
Data; - Site forms, - membership and checkout, - order/payment integrations, - cargo/delivery integrations, - email/phone/WhatsApp, - user comments, - security logs, - legally compliant cookies and similar technologies
It can be obtained electronically or physically when necessary.
4. Purposes and Legal Reasons for Processing Personal Data
4.1. Order, Sales and Delivery
Name-surname, contact, address, order, invoice and limited payment transaction information;
- creation of the order,
- Establishment and execution of the sales contract,
- preparation and delivery of the product,
- Carrying out payment and billing processes
for its purposes; Within the scope of KVKK, it is processed based on the legal reasons that it is directly related to the establishment or execution of a contract and that the data controller fulfills its legal obligation.
4.2. Returns, Complaints and Customer Support
Order, contact, correspondence, product, return and complaint information;
- Execution of refund/withdrawal requests,
- answering customer demands,
- Managing defective goods and after-sales processes,
- Exercise and protection of rights in case of conflict
for its purposes; It is processed based on legal reasons such as the performance of a contract, legal obligation and the establishment, exercise or protection of a right.
4.3. Accounting and Legal Records
Order, invoice, payment, identity and transaction records;
- fulfillment of tax and accounting obligations,
- storing electronic commerce records,
- Meeting the lawful demands of authorized public institutions
It is processed based on the legal reason for the data controller to fulfill its legal obligation.
4.4. System and Process Security
IP address, session, device, browser, login, transaction and security logs;
- Ensuring account and Site security,
- preventing fraudulent orders, unauthorized access, fraud and abuse,
- Examining technical errors and security incidents,
- Protection of rights against legal claims
For these purposes, the data is processed on the legal basis of Velveta's legitimate interests, provided that the data subject's fundamental rights and freedoms are not harmed, and, where necessary, the establishment, exercise or protection of a right.
4.5. Transactional Communication
In line with the above processing purposes, contact information is processed based on the legal grounds of establishment/execution of a contract suitable for the specific transaction, legal obligation, protection of a right or legitimate interest, if conditions exist.
Currently, it is not planned to send marketing messages to customers and influencers. Ordering, payment, delivery, return/refund, support and account security with the customer; Necessary communication can be established with the influencer regarding the execution of the current program, application, contract, commission, payment and documents. The use of e-mail, SMS, phone or WhatsApp must be limited, necessary and proportionate to the need of the specific transaction, the contact information provided and the preferences. These messages should not contain promotions; Invitations to participate in new campaigns are not automatically considered transactional.
No separate marketing approval is required for this scope. Registration does not constitute consent to all kinds of messages. Within the scope of KVKK, data processing conditions appropriate to the specific transaction, informing data subjects, security and, if any, international transfer conditions are also provided.
If marketing is initiated in the future, the necessary separate permissions and IYS (Commercial Electronic Message Management System) procedures are completed before starting. Required marketing approval cannot be made a condition of membership/purchase; boxes cannot be pre-ticked. Approval and rejection records are kept and the procedures/periods in the legislation are applied.
4.6. Non-Essential Cookies
Processing of personal data through analysis, advertising, targeting or similar non-essential cookies is based on the prior explicit consent of the data subject, in the absence of any other valid data processing condition.
5. Recipient Groups to Which Transfer Can Be Made
Personal data is limited to the purpose of processing and to the extent necessary;
- to cargo and logistics providers,
- payment institution/bank/financial service providers,
- to invoicing, accounting and financial consultancy service providers,
- hosting, server, CDN, security, software and technical support providers,
- e-mail/SMS/customer communication service providers,
- analytics/advertising service providers only if appropriate legal requirement exists,
- to legal advisors and dispute parties to the extent necessary,
- authorized public institutions and organizations
transferable.
6. Transfer of Personal Data Abroad
Where a technical, communication, cloud, analytics or other service provider used by Velveta processes personal data abroad or transfers it abroad, the transfer is carried out on the basis of the applicable conditions under Article 9 of KVKK.
In cases where there is no adequacy decision for transfer abroad, regular data transfer will not be carried out without establishing a standard contract published by the Board, binding company rules, a letter of undertaking subject to Board permission, or one of the other appropriate assurance mechanisms foreseen in the Law, if applicable.
If a standard contract is based, the contract will be notified to the Personal Data Protection Authority within five (5) business days from the completion of the signatures.
Exceptional transfer provisions are used only in individual cases where the conditions set out in Article 9 of KVKK are actually met.
7. Storage
The data is kept for the purpose of processing and the retention periods in the relevant legislation.
Information, documents and electronic records regarding the business and transactions of the electronic commerce service provider within the scope of the Law are kept for 10 years from the date of the business or transaction.
If there is a longer or different legal retention period for tax, accounting, consumer, dispute and other records, the relevant period is applied.
At the end of the period, the data is deleted, destroyed or anonymized in accordance with the legislation.
8. Data Security
Velveta applies technical and administrative measures appropriate to the nature of the work and risk in order to prevent unlawful processing/access of personal data and to preserve the data.
Absolute security cannot be guaranteed for any internet system.
9. Rights under Article KVKK 11
Relevant persons, in accordance with the conditions in the legislation; - learning whether personal data is processed or not, - requesting information if processed, - learning the purpose of processing and its appropriate use, - Knowing the third parties to whom domestic/international transfers are made, - request correction of missing/incorrect data, - Request deletion/destruction when conditions are met, - Requesting correction/deletion/destruction operations to be notified to transferred third parties, - Objection to adverse results as a result of analysis exclusively through automated systems, - request compensation for damages due to unlawful processing
has the rights.
10. Application to Data Controller
Applications are made in accordance with the legislation; - written application, -KEP, - secure electronic signature, - mobile signature, - the e-mail address of the relevant person previously reported to Velveta and registered in the system, - a software/application installed for application purposes
can be transmitted via .
Posta: Yeniyol Mh. Gazi 3. Sk. SEGEM İş Merkezi, No: 3, İç Kapı: 5, Çorum Merkez / Türkiye
Convenient application via registered email:[email protected]
Velveta may request additional information in accordance with the legislation to verify the identity and authority of the applicant.
Applications are finalized as soon as possible and within 30 days at the latest, depending on the nature of the request.
11. Cookies
Cookies:Cookie Policy
12. Influencer Program
Separate privacy notice for influencer/partner applications and program data:Influencer Personal Data Protection Notice (KVKK)
Official sources
KVKK principles for informing data subjects:KVKK — official source
Application procedure:KVKK — official source
Transfer abroad:KVKK — official source
10 years of retention of electronic records:Official Gazette — relevant regulation
Updating the Text
Velveta may update this text and the relevant terms of service/operation at any time for the future. The current text and effective date are displayed on the relevant page or in the pre-transaction information. No additional fees will be charged to completed orders; Rights arising from previous transactions and mandatory legislation are protected. Changes that require notification/acceptance in existing contracts are made with the necessary procedure. If the purpose or legal requirement of data processing changes, the relevant clarification and, if necessary, new consent process are carried out before starting the changed processing.