Document: Privacy Policy and Personal Data Processing Notice
Version: 2.1.1
Effective date: 29 July 2026
Last updated: 29 July 2026
1. Data Controller
- Seller: SEBATİ BARIŞKAN – Barışkan Kuyumculuk
- Registered business address: Cumhuriyet Mah. Bağcılar Cad. No:125 B, Bahçelievler/İstanbul
- Store, contact and return address: Çağlayan Mah. Vatan Cad. No:41/A, Kağıthane/İstanbul
- Tax office / tax number: KOCASİNAN VERGİ DAİRESİ / 1420831914
- Phone: +90 516 163 39 99
- Email: info@bariskankuyumculuk.com
- Working hours: Monday–Saturday, 09:00–20:00
The business identified above acts as data controller under Turkish Law No. 6698. This notice is independent from optional marketing consent; refusing marketing does not prevent account creation or purchasing.
2. Account and Authentication
- Data: name, surname, email, phone, password hash, account and session identifiers, verification records; Google/Facebook identifiers when social login is selected.
- Purpose and legal basis: creating and securing the account, authentication and fraud prevention; performance of the contract, legitimate interests and legal obligations.
- Collection/recipients: website, account forms, cookies and the selected authentication channel; hosting, information-technology infrastructure and, where selected, Google or Meta authentication services.
- International transfer/retention: where an overseas provider is used, the transfer follows the rules set out in section 9. Account data is retained during the relationship and for applicable limitation/record periods.
3. Orders, Delivery, Invoicing and Returns
- Data: identity/contact details, product and order records, delivery/billing address, TCKN/VKN where legally required, invoice, return/refund and correspondence records.
- Purpose and legal basis: concluding and performing the distance-sales contract, delivery, accounting, after-sales support and compliance with consumer/tax law.
- Collection/recipients: order, account and support forms; delivery providers, financial advisers/accountants, banks and legally authorised public bodies.
- Retention: for statutory accounting, consumer, evidentiary and limitation periods; transaction records are not deleted before mandatory periods expire.
4. Payments, Bank Transfers and AML/KYC
- Data: payment method, bank-transfer reference, transaction/amount records, encrypted identity data and one-way identity indexes, KYC status and audit logs.
- Purpose/legal basis: matching payments, preventing fraud, fulfilling AML/customer-identification and record-keeping obligations.
- Recipients/retention: banks and authorised public bodies including MASAK when legally required. AML records are retained according to the statutory period calculated for the relevant record type.
5. Security, Traffic and Technical Logs
- Data: IP address, device/browser information, session and CSRF identifiers, timestamps, request/security logs and attribution parameters.
- Purpose/legal basis: service security, abuse prevention, troubleshooting and legal claims; legitimate interests and legal obligations.
- Retention: limited log periods determined by security need and applicable law; longer only for an incident or legal claim.
6. Contact, Appointment, Repair and Uploaded Images
- Data: contact details, message/request content, appointment and repair details, product images and files uploaded by the user.
- Purpose/legal basis: answering the request and performing requested pre-contractual/contractual services.
- Recipients/international transfer: hosting, email provider and Cloudinary where an image is uploaded. Cloudinary may process data abroad; that transfer is subject to section 9. Records are retained for the request/service and relevant limitation period.
7. Email, reCAPTCHA and Service Providers
- Transactional email data is shared with email-infrastructure service providers solely to deliver account, order and support communications and to maintain delivery records.
- Google reCAPTCHA may process IP, device and interaction signals to prevent automated abuse.
- Provider, hosting and support access is limited to the service purpose and contractual/security safeguards.
8. Analytics and Advertising
- With your separate cookie/marketing choice, online identifiers, page/product interactions, campaign parameters, _ga/_fbp/_fbc and conversion events may be processed by Google Analytics, Google Ads and Meta services for measurement, attribution and advertising.
- These services may involve overseas processing; as explained in section 9, that transfer relies on your explicit consent. Non-essential scripts do not run before consent. You can withdraw consent at any time through Cookie Preferences without affecting the lawfulness of earlier processing.
9. International Transfers
- Transfers abroad follow the tiered regime in Article 9 of Law No. 6698: first, whether an adequacy decision announced by the Board covers the destination; if not, whether one of the appropriate safeguards—a standard contract signed by the parties and notified to the Board, an undertaking approved by the Board, binding corporate rules or an international agreement—is in place; only where neither exists may a transfer rely on the exceptional grounds listed in the Law, on an incidental basis.
- Transfers to analytics and advertising services (Google, Meta) rely on the explicit consent you give in your cookie/marketing choices. Without that consent no data is transferred to those services.
- For transfers required to keep the service running—hosting, email infrastructure and image processing at Cloudinary—the safeguard applied is determined per provider, and the method applied to a specific provider is disclosed on request.
- Every transfer is limited to the data the relevant service requires; overseas transfer of your identity or payment records for marketing purposes is not carried out.
10. Your Rights and Application
Under Article 11 you may ask whether data is processed, request information, learn purposes and recipients, request correction, deletion/destruction where conditions apply, notification of those operations to recipients, object to an exclusively automated adverse result, and claim compensation for unlawful processing.
Applications may be submitted in writing to Cumhuriyet Mah. Bağcılar Cad. No:125 B, Bahçelievler/İstanbul, or from an email address previously notified to and registered with the Seller to info@bariskankuyumculuk.com. The application must contain the information required to identify the applicant, contact details, the request and the preferred response method. Applications are concluded free of charge as soon as possible and no later than thirty days; the fee in the applicable tariff may be charged only if the process requires an additional cost.
