Privacy Notice
This Privacy Notice is prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Duty to Inform, to inform you about the personal data processed through this website, why and on what legal grounds it is processed, who receives it and what rights you have. This text is not a consent form; reading or confirming it does not mean you consent to your data being processed for other purposes.
Last updated: 17 October 2026
1. Data Controller
- Legal name: Hüseyin Ölmez
- Address: Yukarı Bahçelievler Mah. Aşkabat Cad. (Eski 7. Cad) No: 47/2, Çankaya/Ankara
- Phone: +90 555 770 21 68
- Email: info@piercingland.com.tr
- Tax office / number: Maltepe Vergi Dairesi / 6540386072
- KEP: huseyin.olmez.5@hs01.kep.tr
2. What Is Processed and How It Is Collected
Personal data is collected electronically, by automated means, when you fill in the forms on this website and use it. Part of it is also obtained through the payment institution and the courier.
| Category of data | Data processed |
|---|---|
| Identity and contact | Name, surname, email address, phone number. |
| Orders and transactions | Order number and date, items and quantities, amount, payment method and status, records of cancellations, withdrawals, returns and complaints, customer correspondence. |
| Delivery | Delivery address, delivery method, courier and tracking number. |
| Invoice and finance | Invoice type (personal/company), the name or company name to invoice, invoice address and optional invoice email; for a company invoice also tax office, tax number and e-Fatura status; for a personal invoice, your national ID number only if you choose to give it. Card details are not collected. |
| Account | Email, a one-way hash of your password, name, phone, saved addresses, favourites and language. If you sign in with Google, the email and name Google passes to us. |
| Appointment and reviews | For an appointment request: name, phone, email, service, placement, date and time and the request note (health information should not be written in it). For a product review: name (shown shortened), rating, review and photo; location data in the photo is removed. |
| Technical logs and security | IP address, date and time, the address opened and browser details; request counters that limit abuse and the hosting provider’s server logs. For confirmations of contracts, the date of the confirmation, the IP address and the browser details. |
| Cookies and usage | Necessary cookies and, if you choose, anonymous usage data for the recommendations feature (see the Cookie Policy). |
We use no visit-statistics tool (such as Google Analytics).
A national ID number, card details or special-category personal data are not requested for an order. The camera image in the virtual try-on is processed only on your device and is not sent to us.
3. Purposes and Legal Grounds
| Purpose | Legal ground |
|---|---|
| Taking the order, making and performing the sales contract, collecting payment, delivery, running accounts and appointments, withdrawals and returns | Processing is directly related to making or performing a contract (KVKK Art. 5/2-c) |
| Issuing invoices, keeping tax and accounting records, keeping distance-sales records, answering requests from authorities | Fulfilling a legal obligation (Art. 5/2-ç) and express provision in law (Art. 5/2-a) |
| Keeping order, return and complaint records as evidence in a dispute; proving confirmations of contracts | Establishing, exercising or defending a right (Art. 5/2-e) |
| Answering customer requests | According to the request, performance of a contract (Art. 5/2-c); legitimate interest, provided it does not harm the data subject’s fundamental rights and freedoms (Art. 5/2-f) |
| Site security, preventing abuse and fraud, view counts that carry no identity | Legitimate interest (Art. 5/2-f) |
| Showing recommendations based on what you viewed | Explicit consent (Art. 5/1); asked for separately in the cookie preferences and withdrawable at any time |
Sending commercial electronic messages for marketing is not among these purposes; no messages are sent for that purpose at present. If sending begins, permission is asked for separately and is optional (see the Commercial Electronic Messages and Marketing Permission Policy).
4. Who Receives the Data
- **Courier (Yurtiçi Kargo):** name, address, phone and order details, to deliver the item.
- **Payment institution (PayTR) and banks:** the order and transaction details needed to take, verify, cancel and refund a card payment. Your card details are entered directly on PayTR’s secure page and do not reach us.
- **Hosting and email provider (Hostinger):** the website and emails run on this provider’s servers.
- **Accountant:** the information needed to meet invoicing, tax and accounting obligations.
- **Authorised public bodies and courts:** under a legal obligation or a properly made request, limited to the data requested.
- **Google:** only if a visit-statistics or ad-measurement tool is brought into use in future and you give explicit consent in the cookie preferences; these tools are not in use at present.
Personal data is not sold or handed to third parties for marketing. Transfers are limited to what is needed for the purposes stated.
5. Transfer Abroad
Because the servers of our hosting and email provider Hostinger are outside Türkiye, the data you enter on the website is transferred abroad. The transfer takes place under the conditions of Article 9 of KVKK, within the contract with the provider. If Google is brought into use in future, its servers are also abroad; in that case the transfer is notified separately and takes place with explicit consent in the cookie preferences.
6. Retention Periods
| Data | Period |
|---|---|
| Order and invoice records | Ten years, under the Tax Procedure Law and the Turkish Commercial Code. |
| Distance sales contract, pre-contract information and confirmation records | At least 3 years; those that must be kept with the order records, 10 years. |
| Account | Until the member deletes it. On deletion, personal data on past orders is anonymised and only the financial record is kept. |
| Appointment requests and product reviews | Until deletion is requested; except what the law requires us to keep. |
| View counts that carry no identity | 90 days. |
| Record of the cookie choice | 6 months; then the choice is asked again. |
When the retention period ends and no other legal ground for keeping the data remains, it is deleted, destroyed or anonymised.
7. Your Rights (KVKK Art. 11)
As a data subject you have the right to:
- learn whether your personal data is processed and, if it is, ask for information about it;
- learn the purpose of the processing and whether the data is used for that purpose;
- know the third parties to whom the data is transferred, in Türkiye or abroad;
- ask for the data to be corrected if incomplete or wrong, and for this to be notified to the third parties it was transferred to;
- ask for the data to be erased or destroyed under the conditions in Article 7 of KVKK, and for this to be notified to the third parties it was transferred to;
- object to an outcome against you that results solely from the analysis of the data by automated systems;
- claim compensation for damage you suffer because the data was processed unlawfully.
These rights are exercised within the exceptions in the law and the controller’s legal retention duties. For example, deleting an account does not require invoice and order records that must be kept by law to be erased at once. You can download your data as a file or delete your account from your account page.
8. How to Apply and When You Get an Answer
You can send your requests in Turkish, with enough information to verify your identity, in writing to Yukarı Bahçelievler Mah. Aşkabat Cad. No: 47, İç Kapı No: 2, Çankaya / Ankara, with a secure electronic or mobile signature, from the email address registered with us to info@piercingland.com.tr, or by KEP to huseyin.olmez.5@hs01.kep.tr. Requests are answered, according to their nature, within 30 days at the latest and free of charge; if the process needs a separate cost, the fee in the tariff set by the Board may be charged. If a request is refused, the reasons are given.
If your request is refused, the answer is inadequate or no answer is given in time, you can complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the date of your request.
9. Updates
This text is updated when data processing, providers or the law change. The current text is published on this page and the date at the top shows the last update.