Personal Data Protection and Privacy

This notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK, the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, in order to inform visitors of Saat Koleksiyoneri (saatkoleksiyoneri.com), persons who correspond with us via WhatsApp or Instagram, and persons who use our live presentation service. Last updated: [DD.MM.YYYY].

1. Data Controller

Your personal data is processed by Saat Koleksiyoneri in its capacity as data controller.

• Address: İstanbul, Türkiye
• E-mail: […]
• Telephone: +90 551 461 67 54 / WhatsApp: +90 551 461 67 54
• Tax ID: […] / MERSİS: […]
• VERBİS (Data Controllers' Registry): [registration number: … / exempt from the registration obligation pursuant to Decision No. 2025/1572 of the Kişisel Verileri Koruma Kurulu (Turkish Data Protection Board, the "Board")]

2. Personal Data We Process

• Identity: first name, last name; for invoicing purposes, [Turkish Republic ID number / passport number for foreign customers].
• Contact: WhatsApp telephone number, e-mail address, Instagram username.
• Customer transaction: the brand and model you are interested in, quotation, order, invoice and sale date information.
• Delivery: delivery address, name of the person who will receive the delivery, shipment tracking number.
• Financial: [for payment by bank transfer/EFT, sender name and IBAN / for payment by credit card, the confirmation information received from the payment institution; the card number is neither seen nor stored by us / for cash on delivery, the collection record].
• Correspondence content: messages, photographs and voice messages you send via WhatsApp and Instagram.
• Live presentation: appointment date and time, presentation address within Istanbul, meeting notes.
• Website: your IP address is processed only momentarily at the time of the page request in order to suggest a language and currency based on your country, and is not recorded by us [if server access logs are kept: IP address and browser information are retained for … days for security purposes]. The site has no membership, forms, shopping cart or payment.

We do not process or request special categories of personal data.

3. Method of Collection

• By fully or partially automated means: WhatsApp correspondence initiated via the button on the product page, Instagram messages, e-mail; website cookies and country detection from the IP address.
• By non-automated means as part of a data recording system: notes taken during telephone calls, the written contract and delivery document drawn up at the live presentation.
• From third parties: delivery status information from the shipping company[; payment notification from the bank or payment institution].

4. Purposes of Processing and Legal Grounds

The subparagraph of Art. 5 of the Law on which we rely is indicated separately for each purpose.

1. Responding to the product enquiry you submit via WhatsApp or Instagram, discussing price and delivery terms, and concluding the distance sales contract — Art. 5(2)(c) (conclusion and performance of a contract).
2. Scheduling the live presentation appointment, our team's visit to your address, and concluding the contract if you make a purchase at the presentation — Art. 5(2)(c); obligations to draw up a written contract and retain documents for contracts concluded away from business premises — Art. 5(2)(ç) (legal obligation).
3. Preparing the order, handing it over to insured and tracked shipping, sharing the tracking number and delivery notification — Art. 5(2)(c).
4. Receiving the payment and matching it with your order [depending on the selected payment method] — Art. 5(2)(c).
5. Issuing invoices, e-archive, accounting and commercial book records — Art. 5(2)(ç) (Tax Procedure Law, Turkish Commercial Code).
6. Customs declaration for international shipments — Art. 5(2)(ç) and Art. 5(2)(c).
7. Handling withdrawal, defect, complaint and dispute processes; retaining correspondence and documents as evidence — Art. 5(2)(e) (establishment, exercise or protection of a right).
8. Security of the website and the administration panel, and suggesting the language and currency according to the visitor's country — Art. 5(2)(f) (legitimate interest) [after the balancing test has been documented: the balancing test was documented on DD.MM.YYYY].
9. Announcements of new models and campaigns — only with explicit consent (Art. 5(1)).
10. Playing the Instagram video you select on the site and Meta placing cookies on your device in the course of this — only with the explicit consent you give via the "Load content" button before the player is loaded (Art. 5(1)).

We send marketing communications only on the basis of explicit consent given separately from this notice and commercial electronic message approval registered with the İleti Yönetim Sistemi (İYS, Message Management System); approval is not a condition of purchase and may be withdrawn at any time via the opt-out option in each message. Order confirmations, shipment tracking and service notifications do not contain promotional content and do not require approval.

5. Domestic Transfers

• Shipping and courier companies [company names]: name, telephone and delivery address; carrying out the delivery.
• [Transport insurance company / insurance broker (name): recipient name, delivery address and shipment value; insuring the shipment and the compensation process in the event of damage.]
• [Banks / payment institution]: receiving and refunding payments.
• Certified public accountant / accounting office: fulfilling invoicing and bookkeeping obligations.
• Legal counsel: protecting our rights in the event of a dispute.
• Competent public authorities (tax office, customs administration, Ministry of Trade, courts and enforcement offices): upon a lawful request, limited to the scope of the request.
• Server hosting provider [name, country]: operating the website.

6. Transfers Abroad

Your WhatsApp and Instagram correspondence is stored on the Meta group's servers in the USA; this constitutes a transfer of your personal data abroad. There is no adequacy decision of the Board for the USA.

• WhatsApp LLC (USA) — WhatsApp correspondence: the transfer [is based, pursuant to Art. 9(4)(c) of the Law, on the provisions of the standard contract announced by the Board and contained in the WhatsApp Data Transfer Addendum; date/no. of notification to the Kişisel Verileri Koruma Kurumu (Turkish Data Protection Authority): …].
• Meta Platforms, Inc. (USA) — Instagram messages: the transfer is carried out under [the standard contract announced by the Board; date/no. of notification to the Authority: … / the legal basis to be determined by legal counsel].
• Meta's own processing is subject to its own privacy policy; our deletion of the correspondence from our devices may not affect the copy held by Meta.
• International deliveries: your name, address and contact details are transferred to [international shipping company] and the customs administration of the destination country — Art. 9(6)(b) (necessary for the performance of a contract) [standard contract for regular transfers].
• When you open an Instagram video with the "Load content" approval, your browser establishes a direct connection with Meta's servers (see 10. Cookies).

7. Retention Periods

• Invoice, accounting and commercial book records, and correspondence and order records that result in a sale: 10 years from the end of the relevant calendar year (Turkish Commercial Code (TTK) Art. 82; Turkish Code of Obligations (TBK) Art. 146; the 5-year period under Tax Procedure Law (VUK) Art. 253 falls within this).
• Information, withdrawal and delivery documents relating to distance contracts and contracts concluded away from business premises: at least 3 years (Regulation on Distance Contracts Art. 20; Regulation on Contracts Concluded Away from Business Premises Art. 18).
• Product enquiries and correspondence that do not result in a sale: [1 year / 2 years] from the last message.
• Live presentation appointment information where no contract is concluded: [6 months] from the presentation.
• Marketing explicit consent and İYS approval records: 3 years from the date on which the approval ceased to be valid (was withdrawn); opt-out requests and message dispatch records, 3 years from the date of recording (Regulation on Commercial Communication and Commercial Electronic Messages Art. 13).
• [If server access logs are kept: 30 days / 90 days.]
• Administration panel session cookie: at most 30 days.

At the end of the period, the data is deleted, destroyed or anonymised (Art. 7 of the Law).

8. Your Rights under Article 11 of the Law

Pursuant to Article 11 of the Law, by applying to us, you have the right to:

• Learn whether your personal data is being processed and, if so, request information in this regard;
• Learn the purpose of processing and whether it is used in accordance with that purpose;
• Know the third parties to whom it is transferred domestically or abroad;
• Request rectification if it has been processed incompletely or inaccurately, request its deletion or destruction under the conditions of Art. 7 of the Law, and request that these operations be notified to the third parties to whom it has been transferred;
• Object to a result that arises against you through analysis exclusively by automated systems;
• Claim compensation for damage if you suffer damage due to processing in breach of the Law

These are your rights under the Law.

9. How to Apply

You may submit your application in Turkish, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, through the following channels:

• In writing to the address İstanbul, Türkiye (with wet-ink signature; in person, by post/registered mail with return receipt, or through a notary public; the date of application is the date on which the document is served on us);
• Via [KEP (Registered Electronic Mail) address: …];
• With a secure electronic signature or mobile signature to […];
• From the e-mail address you have previously notified to us and which is registered in our system, to […].

The application must include your first name, last name, signature (for written applications), Turkish Republic ID number (nationality and passport number for foreign nationals), address for service, e-mail address and telephone number if available, and the subject of the request. We respond to your application free of charge within 30 days at the latest, in writing or electronically, and with reasons in the event of refusal; a fee of 1 TL per page may be charged only for written responses exceeding 10 pages. If you find our response insufficient or do not receive a response within 30 days, you may lodge a complaint with the Kişisel Verileri Koruma Kurulu (Turkish Data Protection Board) within 30 days from the date you learn of the response and in any case within 60 days from the date of application (Art. 14 of the Law).

10. Cookies

The site has no analytics, advertising or marketing cookies; visitor behaviour is not tracked. The three cookies written by us are first-party and contain no record that identifies you personally.

• sk_locale: written only when you select a language from the language menu and stores the language you selected; 1 year; first-party; functional.
• sk_currency: written only when you make a selection from the currency menu and stores the currency you selected; 1 year; first-party; functional.
• sk_admin: created only when the site administrator logs in to the administration panel and is not written to visitors; authentication; at most 30 days; first-party.
• Meta cookies (such as ig_did, datr, _fbp): third-party (Meta); operation of the Instagram player and Meta's own purposes; duration [duration stated in Meta's cookie policy]; only with your explicit consent as described below.

Unless you make a selection, the language and currency are determined on each visit according to the country detected from your IP address, and no cookie is written to your device. As the language and currency cookies are created only by your explicit choice, they are functional cookies that do not require explicit consent [legal counsel confirmation]. You can delete or block these cookies in your browser settings; in that case your selection will not be remembered.

Instagram content: The Instagram videos in the Reels section are not loaded when the page opens. When you click on a video cover, you first see a notice; the player is called from Meta's servers only if you press the "Load content" button in this notice; if you select "Cancel", no Meta cookies are written. Once the player is loaded, Meta may place the above third-party cookies on your device even if you do not have an Instagram account, and may receive your IP address and browser information. We are jointly responsible with Meta for the placement of these cookies; Meta's subsequent processing is subject to its own cookie policy.