KVKK Privacy Notice
This is a courtesy translation. The Turkish version is legally binding.
Last updated: 11.09.2026
As Nurçin Ehlimanoğlu ("Deri Leather" or the "Company"), we process the personal data we obtain through our website at derileather.com, our customer service channels and affiliated digital platforms in accordance with Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, "KVKK") and related legislation.
This notice has been prepared to inform you in our capacity as data controller, pursuant to Article 10 of KVKK and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). For processing based on explicit consent, your consent is obtained separately from this notice at the relevant step (for example, in the cookie panel or via the commercial electronic message consent checkbox).
1. Data Controller
| Information | Details |
|---|---|
| Company name | Nurçin Ehlimanoğlu |
| Address | Barbaros Hayrettin Paşa Mah. 1003. Sk. No: 4 İç Kapı No: 3, Gaziosmanpaşa / İstanbul |
| Tax Office / Tax No. | Küçükköy Vergi Dairesi / 3260347070 |
| admin@derileather.com | |
| Phone | 0544 922 25 08 |
2. Categories of Personal Data Processed
| Category | Examples |
|---|---|
| Identity | First and last name; Turkish ID number (T.C. kimlik numarası) where required by legislation for issuing an invoice |
| Contact | E-mail address, phone number, delivery and billing address |
| Customer transaction | Order, cart and favorites information, billing information, return/exchange requests, request and complaint records, size and product preferences |
| Financial | Payment method, transaction amount, installment information, masked card information (e.g., last four digits), IBAN for refunds; tax office and tax number for corporate invoices |
| Transaction security | IP address, session and log records, device and browser information |
| Marketing | Purchase history, interests, campaign interactions, data obtained through cookies and similar technologies |
| Legal transaction | Correspondence, requests from public authorities, dispute records |
Your card number, expiration date and security code (CVV) are neither visible to nor stored by us; this information is processed directly by the payment institution.
We do not process special categories of personal data (such as health, religious or biometric data). Please do not share such information in order notes or correspondence.
3. Method of Collecting Personal Data
Your personal data is collected through the following channels, by fully or partially automated means, or by non-automated means provided that it forms part of a data filing system:
- Order, payment, return, stock notification and newsletter forms on our website
- Cookies, pixels and similar technologies (see the Cookie Policy for details)
- Customer service correspondence via e-mail, phone, WhatsApp and social media
- Transaction information forwarded to us by the payment institution, the shipping company and the e-Invoice integrator
4. Purposes of Processing and Legal Grounds
| Purpose of processing | Legal ground (KVKK Art. 5) |
|---|---|
| Receiving orders, establishing and performing the distance sales agreement, delivery | Art. 5(2)(c) establishment or performance of a contract |
| Collecting payment, installments, refunds | Art. 5(2)(c) performance of a contract; Art. 5(2)(ç) legal obligation |
| Issuing invoices, accounting and statutory retention obligations | Art. 5(2)(ç) legal obligation |
| Handling right of withdrawal, return, exchange and defective goods requests | Art. 5(2)(c) performance of a contract; Art. 5(2)(ç) legal obligation |
| Responding to requests and complaints, customer service | Art. 5(2)(c) performance of a contract; Art. 5(2)(f) legitimate interest |
| Stock notifications (if you request them) | Art. 5(2)(c) establishment or performance of a contract |
| Ensuring information security, preventing fraud, keeping log records | Art. 5(2)(ç) legal obligation; Art. 5(2)(f) legitimate interest |
| Improving site operation and service quality (within the scope of strictly necessary cookies) | Art. 5(2)(f) legitimate interest |
| Establishing, exercising and protecting rights in legal disputes | Art. 5(2)(e) establishment, exercise or protection of a right |
| Responding to requests from authorized public institutions and organizations | Art. 5(2)(ç) legal obligation |
| Sending commercial electronic messages about campaigns, new collections and offers | Art. 5(1) explicit consent, and approval under Law No. 6563 on the Regulation of Electronic Commerce |
| Analytics and marketing cookies, personalized advertising and retargeting | Art. 5(1) explicit consent |
5. Transfer of Personal Data
Your personal data may be transferred to the following groups of recipients, limited to the purposes above and in accordance with the conditions set out in Article 8 of KVKK:
| Recipient group | Purpose of transfer |
|---|---|
| Shipping and logistics companies (including Yurtiçi Kargo) | Delivering orders, collecting return shipments |
| The payment institution iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) and banks | Payment, 3D Secure verification, installments, fraud checks, refunds |
| Private e-Invoice / e-Archive integrator and the Revenue Administration | Issuing and transmitting invoices |
| Hosting, cloud infrastructure, e-mail and SMS service providers | Operating the site, storing data securely, order and service notifications |
| Message Management System (İYS) | Keeping records of consents to and refusals of commercial electronic messages |
| Advertising and analytics partners (Google, Meta) | Measurement and advertising, only if you have given your explicit consent |
| Legal, financial advisory and audit service providers | Consulting, auditing, protection of rights |
| Authorized public institutions and organizations, judicial authorities | Fulfilling legal obligations |
Transfers abroad
The servers of some of our service providers, such as Google (Google LLC / Google Ireland Limited), Meta (Meta Platforms Ireland Limited) and certain cloud infrastructure providers, may be located abroad. In that case, your personal data is transferred in accordance with Article 9 of KVKK, as amended by Law No. 7499:
- If the Personal Data Protection Board has issued an adequacy decision regarding the country of transfer, on the basis of that decision;
- If there is no adequacy decision, provided that one of the conditions in Article 5 or Article 6 of KVKK exists and one of the appropriate safeguards is in place, such as signing the standard contract announced by the Board (notified to the Personal Data Protection Authority within five business days of signing), binding corporate rules, or a written undertaking approved by the Board;
- If none of these is possible, in non-recurring and incidental cases, on the basis of your explicit consent, provided that you have been informed of the possible risks.
Transfers carried out through analytics and marketing cookies begin only if you consent to these categories in the cookie panel.
6. Retention Periods
Your personal data is retained for as long as required by the purpose of processing and as stipulated in the relevant legislation.
| Data / record | Retention period |
|---|---|
| Invoices, commercial books and accounting records | 10 years (Turkish Commercial Code No. 6102, Tax Procedure Law No. 213) |
| Order, preliminary information and distance sales agreement records | At least 3 years under the Distance Contracts Regulation (Mesafeli Sözleşmeler Yönetmeliği); in case of possible disputes, for the limitation periods under the Turkish Code of Obligations No. 6098 |
| Commercial electronic message consent records | 3 years from the date the consent ceases to be valid, under the Regulation on Commercial Communications and Commercial Electronic Messages (Ticari İletişim ve Ticari Elektronik İletiler Hakkında Yönetmelik) |
| Transaction security and log records | Up to 2 years |
| Cookie data | For the periods specified in the Cookie Policy |
| Marketing data | Until explicit consent is withdrawn |
Data whose retention period has expired is erased, destroyed or anonymized in periodic destruction processes carried out at intervals of no more than six months, in accordance with the Regulation on the Erasure, Destruction or Anonymization of Personal Data (Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik).
7. Your Rights as a Data Subject
Under Article 11 of KVKK, you have the following rights, which you may exercise by applying to the data controller:
- To learn whether your personal data is being processed,
- To request information about the processing if your personal data has been processed,
- To learn the purpose of processing your personal data and whether it is used in line with that purpose,
- To know the third parties, in Türkiye or abroad, to whom your personal data is transferred,
- To request the correction of your personal data if it has been processed incompletely or inaccurately,
- To request the erasure or destruction of your personal data under the conditions set out in Article 7 of KVKK,
- To request that the third parties to whom your personal data has been transferred be notified of any correction, erasure or destruction,
- To object to an outcome to your detriment arising from the analysis of your processed data exclusively through automated systems,
- To claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.
You may withdraw the consent you have given for processing based on explicit consent at any time; withdrawal does not affect the lawfulness of the processing carried out before it.
8. How to Apply
You may submit your application by one of the following methods, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ):
- In person or through a notary, with a petition bearing your wet signature: Barbaros Hayrettin Paşa Mah. 1003. Sk. No: 4 İç Kapı No: 3, Gaziosmanpaşa / İstanbul
- Signed with a secure electronic signature or mobile signature: admin@derileather.com
- From the e-mail address you have previously provided to us and that is registered in our system: admin@derileather.com
Your application must include:
- Your first and last name and, if the application is in writing, your signature
- For Turkish citizens, your Turkish ID number; for foreign nationals, your nationality, passport number or, if available, identification number
- Your residential or business address for service of notices
- If available, your e-mail address, phone or fax number for notifications
- The subject of your request and, if available, supporting documents
We kindly ask you to write "Kişisel Verilerin Korunması Kanunu Kapsamında Bilgi Talebi" (Request for Information under the Law on the Protection of Personal Data) on the envelope or in the subject line of the e-mail.
Your application will be concluded free of charge as soon as possible, depending on the nature of the request, and within 30 days at the latest. If the process involves an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.
If your application is rejected, if you find the response insufficient, or if no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of the date you learn of the response and, in any case, within 60 days of the date of your application (KVKK Art. 14).
9. Changes
This notice may be updated in line with changes in legislation or in our processing activities. The current version is always published at derileather.com.