RETAY MAĞAZACILIK A.Ş. (the “Company” or “SUMONE”) acts as the data controller under the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”). This notice explains for which purposes the personal data we collect through iamsumone.com and our other channels is processed, to whom it may be transferred, and what your rights are.
1. Data Controller
- Title: RETAY MAĞAZACILIK A.Ş.
- Address: Eski Hadımköy Yolu Cd. Istanbul / Büyükçekmece, Türkiye
- Telephone: 0 212 970 27 05
- E-mail: [email protected]
- Website: iamsumone.com
2. Personal Data We Process
| Data Category | Examples |
|---|
| Identity | First name, last name |
| Contact | E-mail address, phone number, delivery and billing address |
| Customer Transaction | Order, return, shipment tracking, request and complaint records |
| Transaction Security | IP address, cookie records, session and login information |
| Financial | Payment method, transaction amount, invoice information |
| Marketing | Purchase history, communication permissions, campaign and newsletter preferences |
Credit card details entered during checkout are neither visible to nor stored by the Company; they are processed directly through the infrastructure of a licensed payment institution.
3. Purposes of Processing
- Orders and delivery: Creating your order, collecting payment, preparing the product and handing it over to the carrier
- Customer relations: Handling your requests, questions, returns and complaints, and running support processes
- Membership: Creating and managing your account and providing your order history
- Legal obligations: Issuing invoices and fulfilling accounting, tax and consumer-law obligations
- Security: Ensuring the security of the website and preventing fraud and misuse
- Improvement: Measuring site performance and improving our products and services
- Marketing: Sending commercial electronic messages about campaigns, discounts and news where you have given explicit consent
4. Legal Grounds for Processing
- Conclusion and performance of a contract (KVKK Art. 5/2-c): Order, payment, delivery and return processes
- Legal obligation (KVKK Art. 5/2-ç): Invoicing, accounting and statutory retention obligations
- Establishment and protection of rights (KVKK Art. 5/2-e): Use as evidence in the event of a dispute
- Legitimate interest (KVKK Art. 5/2-f): Site security, fraud prevention and service quality
- Explicit consent (KVKK Art. 5/1): Commercial electronic messages and non-essential cookies
5. Method of Collection
Your personal data is collected electronically, by automated and partly automated means, through membership and order forms on our website, our contact and support channels (e-mail, telephone), cookies and similar tracking technologies, and our social media accounts.
6. Transfer of Personal Data
Limited to the purposes stated above, your personal data may be shared with:
- Cargo and logistics companies: For the delivery of your order
- Payment institutions and banks: For collecting payments and processing refunds
- E-invoice, accounting and audit service providers: For fulfilling legal obligations
- IT, infrastructure and e-commerce service providers: For operating, hosting and securing the website
- Authorised public institutions: Within the scope of statutory requests
Where service providers with servers located abroad are used, transfers are carried out in accordance with the KVKK provisions on cross-border data transfers.
7. Retention Period
Your personal data is retained for as long as necessary for the purpose of processing and until the statutory limitation and retention periods expire (as a rule 10 years for commercial and tax records). Once the period expires, the data is deleted, destroyed or anonymised.
8. Your Rights as a Data Subject
Under Article 11 of the KVKK, you have the right to:
- Learn whether your personal data is processed
- Request information if it has been processed
- Learn the purpose of processing and whether the data is used in accordance with that purpose
- Know the third parties to whom the data is transferred, domestically or abroad
- Request rectification if the data is incomplete or incorrect
- Request erasure or destruction within the conditions set out in the legislation
- Request that rectification, erasure and destruction be notified to third parties to whom the data was transferred
- Object to an adverse outcome arising from analysis carried out exclusively by automated systems
- Claim compensation if you suffer damage due to unlawful processing
9. How to Apply
You may submit your requests, together with information verifying your identity, by e-mail to [email protected] or in writing to the address stated above. Depending on the nature of the request, your application is concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged.
10. Updates
RETAY MAĞAZACILIK A.Ş. may update this notice in line with legislative changes or developments in its business processes. The current text enters into force on the date it is published on iamsumone.com.