Personal Data Protection Notice (KVKK)

This notice has been prepared pursuant to Türkiye's Law No. 6698 on the Protection of Personal Data (“KVKK”) to inform you about the processing of your personal data within the scope of the Stok Gözlük platform (“Platform”) operated by Senem ÖZDEN in its capacity as data controller.

1. How We Collect Data — Consent Basis

• Personal data is collected only by businesses registering with the Platform themselves and entering their own information into the registration/profile forms. The system and its data grow organically in this way.
• The Platform does not buy, scrape, or bulk-import contact lists and does not send unsolicited (cold) messages.
• Your contact data (email, phone) is processed only after you enter it yourself during registration and provide the required consent, and for the purposes set out below.

2. Personal Data Processed

• Identity data: full name, national ID / tax identification number (within the scope of business verification).
• Contact data: mobile phone number, email address, business address.
• Customer transaction data: order, listing, request, dispute, and review records.
• Financial data: IBAN, entitlement (payout) and collection records. Your card details are never stored by the Platform in any way; payment transactions are carried out through a payment institution (iyzico) licensed under Law No. 6493.
• Transaction security data: IP address, device/session information, login records.
• Visual data: the product photos and business verification documents you upload.

3. Purposes of Processing and Electronic Messages

• Establishment and performance of the membership agreement; business verification (KYB),
• Conducting escrow-payment purchase-and-sale transactions and managing shipping and delivery processes,
• Resolving disputes, preventing fraud, and ensuring platform security,
• Fulfilling legal obligations (invoicing, accounting, responding to official requests),
• Sending transactional notifications: relating only to your own account — one-time login code (OTP — SMS/WhatsApp), order confirmation, payment/escrow status, shipping/delivery updates, and security alerts. These messages carry no marketing purpose.
• Commercial electronic messages subject to your explicit consent (only if you separately give consent); you may withdraw this consent at any time.
• Producing anonymized and aggregated market analyses (in a form that cannot be associated with your identity).

4. Legal Grounds

Your personal data is processed pursuant to KVKK Art. 5/2 on the grounds that it is necessary for the establishment and performance of a contract (b), the fulfilment of a legal obligation (ç), the establishment, exercise, or protection of a right (e), and legitimate interest provided that it does not harm your fundamental rights and freedoms (f); and, with respect to commercial electronic messages, on the basis of your explicit consent (Art. 5/1).

5. Recipients of Transfers

• Payment institution (iyzico): for collection, escrow, and payout transactions.
• Shipping companies (Geliver and contracted carriers): name, phone, and delivery address for carrying out delivery. As required by shipping legislation, this information appears on the shipment label; it is not kept as searchable data in the seller's panel.
• Notification providers (email and WhatsApp/SMS): phone/email information solely for delivering transactional notifications.
• Artificial intelligence service provider (Anthropic): only the product photos you upload may be processed abroad for the automatic extraction of the product profile; your identity and contact data are not transferred in this scope.
• Authorized authorities: public authorities that make requests where legally required.

Your identity is not disclosed to the other party to the sale; only city, rating, and number of transactions are visible. Information within the scope of the legal invoicing obligation appears only in the invoice issued to the counterparty of the relevant transaction after the transaction is completed.

6. Retention Periods

• Financial and transaction records: 10 years as required by the relevant legislation,
• Transaction security (log) records: 2 years,
• Documents from rejected membership applications: 6 months,
• When membership ends, data for which there is no retention obligation is deleted, destroyed, or anonymized.

7. Your Rights under Article 11

You have the right to learn whether your personal data is being processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in accordance with that purpose, to know the third parties to whom it is transferred domestically or abroad, to request its correction if it has been processed incompletely or incorrectly, to request its deletion or destruction within the framework of KVKK Art. 7, to request that these actions be notified to the third parties to whom the data has been transferred, to object to a result arising against you as a consequence of analysis carried out exclusively by automated systems, and to request compensation if you suffer damage.

8. How to Apply

You may submit your requests by email to kvkk@stokgozluk.com or in writing to the address above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your applications are concluded free of charge within 30 days at the latest.