Privacy & Personal Data Protection

PRIVACY & PERSONAL DATA PROTECTION
AND PROCESSING POLICY (“PRIVACY POLICY”)

Punicana Tekstil ve Dış Tic. A.Ş.
Arnavutkoy Mah. Üvez Sok. Ümit Apt. No:13 Daire:1
34345 Besiktas / Istanbul
Türkiye
[Mersis No:] 0733-0942-0400-0001
[Website]: www.punicana.com
Version 0.0.1
19/05/2021

The Company is the owner of the website located at [www.punicana.com] and all the pages and mobile applications affiliated with the website (“Website”). The Company acts as the data controller regarding the personal data of the customers and users of the Website in accordance with the Personal Data Protection Law No. 6698 (“KVKK”). The Company give utmost importance to privacy and protection of your personal data as the data controller. The purpose of this Privacy Policy is to inform the users and visitors of the Website regarding processing of personal data in compliance with Article 10 of KVKK.

This Privacy Policy may be updated from time to time due to changes on our services or legal requirements. We recommend you check the Privacy Policy on a regular basis.

“Company” and “we” and “us”, means [Punicana Tekstil ve Dış Tic. A.Ş.] located at the address of [Arnavutkoy Mah. Üvez Sok. Ümit Apt. No:13 Daire:1 34345 Besiktas / Istanbul Türkiye].

“Data Subject”, means the natural person, whose personal data are processed,

“Product(s)”, mean the products, which are offered to sale on the Website.

Principles of Processing of Personal Data

The Company complies with the general principles required in KVKK regarding processing of personal data.

General principles are as follows:

a) Lawfulness and fairness
b) Being accurate and kept up to date where necessary.
c) Being processed for specified, explicit and legitimate purposes.

ç) Being relevant, limited and proportionate to the purposes for which they are processed.

d) Being stored for the period laid down by relevant legislation or the period required for the purpose for which the personal data are processed.

Legal Basis for Processing of Personal Data

The Company processes personal data only when at least one of the following conditions is met in accordance with Article 5 of KVKK.

Explicit consent of the data subject: Data subject’s explicit consent must be with respect to a specific subject matter, be an informed decision and freely given. Personal data is processed for the purposes mentioned in the explicit consent and in compliance with the scope of the consent. There is no need to obtain data subject’s explicit consent only in cases where one of the following conditions is met.

It is expressly provided for by the laws: Personal data is processed within the limits of the data categories and processing purposes provided for in the relevant law.

Impossibility to obtain an explicit consent: Personal data can be processed if it is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid.

Direct relationship with establishment or performing a contract: Personal data can be processed if processing of personal data of the parties of a contract is necessary, provided that it is directly related to and necessary for the establishment or performance of the contract.

Legal obligation of the Company: Data subject’s personal data can be processed if data processing is required for compliance with a legal obligation to which the data controller is subject.

Data subject made their personal data public: If the personal data has been made public by the data subject, such personal data may be processed within the limits of the purpose of making it public.

Necessary for establishment or protection of a right: Data processing is necessary for the establishment or protection of any right.

Legitimate interests: Processing of data is necessary for the legitimate interests of the Company, provided that the processing shall not violate the fundamental rights and freedoms of the data subject.

Which personal data do we process?

Below table shows which personal data we process and the applicable legal basis.

Personal Data	Legal Basis	Scope
Name, last name, title, identity number, tax number and address of the customer	(i) Performance of the sale agreement (ii) Tax laws	Data is processed to issue invoice when a customer purchases a product on the Website.
Name, last name, address of the customer	Performance of the sale agreement	Data is processed for delivery of the purchased item.
Name, last name, title, e-mail address of the customer	Performance of the sale agreement	Data is processed to ensure customer satisfaction in scope of performance of the sale agreement in case of complaints about the purchased item or its delivery or to inform the customers in case of delays of delivery or to manage return of purchased items.
Customer invoices	(i) Tax laws (ii) To establish or protect a right	Invoices are retained until the end of applicable statute of limitations (i) to prepare tax declarations and to submit to authorities in case of tax audits. (ii) to settle disputes with customers and to defend ourselves in litigation with customers.
Agreements with customers	To establish or protect a right	Agreements are retained until the end of applicable statute of limitations to settle disputes with customers and to defend ourselves in litigation with customers.
IP address	Legitimate interest	We process this information to determine the IP addresses of persons who attempt to breach our security and use the Website for unlawful purposes and to prevent them to re-enter the Website.
E-mail address	Explicit consent	We process this information to send you information about our campaigns, promotions, sales, monthly or weekly newsletters regarding our product and services provided that you give your explicit consent to receive electronic commercial messages.

Transfer of personal data to third parties

We need to transfer some of the personal data we receive to third party company or firms that we obtain services from, in compliance with the legal basis of data processing as mentioned above.

Payments for any purchase from the Website are made through iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico), which is a third party payment solution provider. When you make a purchase on the Website, your identity information, order details and the amount are transferred to iyzico. We do not see your credit card details that you give to iyzico. For more information regarding protection of your personal data, please read privacy policy of iyzico: https://www.iyzico.com/gizlilik-politikasi#gizlilik-kiisel-veri-politikas
We get hosting services for our Website. Hosting firms are processing the personal data mentioned in above paragraph III as the data processor on our behalf. We sign data processing agreement with hosting firms.
We use the services of a third party firm for website design and maintenance. Such firm may have access to personal data while performing its services. We sign a data processing agreement with such firm in accordance with KVKK.
We may share your personal data with law enforcement officers and other authorized bodies when we are required to do so by law or to prevent a crime.

Transfer of personal data to third countries

Following personal data may be transferred to third countries.

Provided that the users give their consent to receive electronic commercial messages, their e-mail addresses are shared with electronic messages service provider to send them information about our campaigns, promotions and sales regarding our products and services and weekly/monthly newsletters.

We use Mailchmip Platform founded by The Rocket Science Group LCC’, with its headquarters at 675, Ponce de Leon Ave. NE, Suite 5000, Atlanta, GA, 30308 USA. You can read Mailchimp’s privacy policy for further details: https://mailchimp.com/legal/privacy/

We use Google Universal Analytics service provided by Google Inc. to analyse how users use the Website. GUA processes personal of users such as IP addresses with the help of cookies and other identifiers.

Google Inc. 1600 Amphitheatre Parkway Mountain View CA 94043, U.S.A. You can read Google Universal Analytics’ privacy policy for further details: https://support.google.com/analytics/answer/2838718?hl=en&ref_topic=6010376

Please read our Cookie Policy to for more details regarding cookies and how you can set your cookie settings.

Organizational and technical measures regarding protection of personal data

The Company takes the appropriate necessary measures to prevent unlawful processing of and unlawful access to personal data and to protect them in accordance with article 12 of the KVKK.

Retention Period of Personal Data

Once the reason of data processing no longer exists, personal data is either deleted, destroyed or made anonymous.

Data Subjects’ Rights

Data subjects’ rights under article 11 KVKK are as follows:

to learn whether their personal data are processed or not,
to demand for information if their personal data have been processed,
to learn the purpose of the processing of their personal data and whether these personal data are used in compliance with the purpose,
to know the third parties to whom their personal data are transferred in country or abroad,
to request the rectification of the incomplete or inaccurate data, if any,
to request the erasure or destruction of their personal data in accordance with KVKK,
to request reporting of the operations carried out pursuant to sub-paragraphs (e) and (f) to third parties to whom his/her personal data have been transferred,
to object to the occurrence of a result against the person himself/herself by analysing the data processed solely through automated systems,
to claim compensation for the damage arising from the unlawful processing of their personal data.

Data subjects can send their requests regarding their above mentioned rights in writing by using registered electronic mail (KEP), secure electronic signature, mobile signature or e-mail which has been previously notified to the Company.

Requests shall be concluded at the latest within thirty days free of charge. If the relevant transaction necessitates a cost, a fee can be charged in accordance with the tariff determined by the Board of Personal Data Protection.

Contact Details

You can contact us through the following contact details with respect to your questions or concerns regarding this Privacy Policy and your personal data.

Company Name: Punicana Tekstil ve Dış Tic. A.Ş.

Mersis No: 0733-0942-0400-0001

Address: Arnavutkoy Mah. Üvez Sok. Ümit Apt. No:13 Daire:1
34345 Besiktas / Istanbul
Türkiye

E-mail: punicana@punicana.com
Telephone: +90 (212) 287 98 29