Privacy Notice on the Processing of Personal Data
1. Data controller
[company name] (MERSİS [MERSİS no.], [address]), as the data controller, processes your personal data for the purposes and on the legal grounds explained below.
2. Data we process
- Identity: full name; for sellers, Turkish ID number (TCKN) or tax number (VKN), and tax office.
- Contact: email, phone, delivery and seller address, Instagram username.
- Financial: the seller's IBAN, order amounts, payment and refund records, payment institution reference numbers.
- Customer transactions: orders, shipping details, problem reports, in-platform messages, notifications.
- Transaction security: account and session details, an irreversible hash of the password, IP address and time records.
The card number, expiry date and security code are processed on the payment institution's page or by being sent directly to the payment institution; PayDM does not store this information. No special categories of personal data are processed.
3. How data is collected
Data is collected electronically through the sign-up and settings forms, the order form on the payment link, and the order and messaging screens; through transaction results returned by the payment institution; and through records the system creates automatically.
4. Purposes and legal grounds
- Opening the account, the payment link, receiving the payment, holding it, transferring it to the seller or refunding it, order tracking and messaging: formation and performance of a contract (KVKK art. 5/2-c).
- Obligations under e-commerce, consumer, tax, payment services and anti-money-laundering laws; requests from public authorities: legal obligation (art. 5/2-ç).
- Resolving disputes and protecting rights: establishing, exercising or protecting a right (art. 5/2-e).
- Preventing fraud, service security, debugging and improving the service: legitimate interest (art. 5/2-f).
5. Transfers
- N Kolay Ödeme ve Elektronik Para Kuruluşu A.Ş. (Paynkolay) (in Turkey), to receive the payment, transfer it to the seller and refund it.
- The other party to the order, to fulfil it: the seller's pre-information details to the buyer, and the buyer's delivery details to the seller.
- Competent public authorities and courts, on request.
- Suppliers we use for hosting and database (Convex, Inc.), web hosting (Vercel Inc.) and sending email (Resend, Inc.). Because these suppliers' servers are abroad (USA), the transfer is made under KVKK art. 9 by signing the standard contract published by the Personal Data Protection Board and notifying the Personal Data Protection Authority within the required period.
6. Retention period
Order, payment and accounting records are kept for 10 years under Law No. 6563, Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102. When an account is closed, data other than these records is deleted or anonymised. Security records are kept for as long as our infrastructure providers keep their logs. Data whose retention period has ended is destroyed under our Personal Data Retention and Destruction Policy.
7. Your rights (KVKK art. 11)
You have the right to learn whether your personal data is processed; to request information about it if it has been processed; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties in Turkey or abroad to whom it is transferred; to request its correction if it is incomplete or inaccurate; to request its deletion or destruction when the conditions in KVKK art. 7 are met, and to request that these actions be notified to the third parties to whom it was transferred; to object to a result against you that arises from analysis exclusively by automated systems; and to claim compensation if you suffer damage because of unlawful processing.
Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, you can send your requests in writing to [email] from the email address registered in PayDM, to the KEP (registered electronic mail) address [KEP address], or to the address above. Requests are answered free of charge within 30 days at the latest. To close your account, you can also use the closure request on the Settings page.
For information about cookies, see the Cookie Policy.