KVKK Privacy Notice

1. Identity of the Data Controller

2. Categories of Personal Data Processed

Depending on the nature of the services provided, the following categories of personal data may be processed by our Company:

2.1 Identity Data

Name, surname, Turkish Identification Number (only for e-Archive/e-Invoice issuance and only during invoicing), and date of birth (optional).

2.2 Contact Data

Email address, mobile phone number, delivery address, and billing address.

2.3 Customer Transaction Data

Order number, order contents, order date, shopping cart preferences, coupon usage, loyalty points, return/exchange requests, and product reviews.

2.4 Financial Data

Invoice details, payment method, payment amount, and bank/card information (not stored by us; processed only through our authorized payment service provider's payment infrastructure).

2.5 Transaction Security Data

IP address, session information, username/password (hashed), login dates and times, and cookie data.

2.6 Marketing Data

Subject to your explicit consent: shopping habits, interests, preferred categories, and newsletter/SMS preferences.

2.7 Customer Service Data

Live chat messages (including AI-assisted systems), email correspondence, WhatsApp messages, contact form submissions, and call recordings (if applicable).

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

• Establishing and performing distance sales agreements (receiving, preparing, shipping, and tracking orders)
• Fulfilling legal obligations (e-Archive/e-Invoice issuance, ETBIS notifications, tax legislation, commercial law requirements)
• Responding to customer service requests (returns, exchanges, inquiries, and complaint management)
• Measuring customer satisfaction and improving service quality
• Conducting marketing activities with your explicit consent (campaign notifications, new product announcements, personalized recommendations)
• Implementing security measures (fraud prevention, fake order detection, account security monitoring)
• Improving the website and application (anonymous usage statistics)
• Responding to requests from competent public authorities as required by law
• Managing loyalty programs and customer segmentation (subject to explicit consent)

4. Method and Legal Basis for Collecting Personal Data

Your personal data is collected electronically when you create an account, place an order, complete a contact form, use live chat services, or contact us via WhatsApp or email.

Such personal data is processed pursuant to the legal grounds set forth in Articles 5 and 6 of the KVKK:

• Article 5/2(c): Processing is necessary for the establishment or performance of a contract (order fulfillment processes)
• Article 5/2(ç): Processing is necessary for compliance with a legal obligation (tax, e-Invoice, ETBIS obligations)
• Article 5/2(f): Processing is necessary for the legitimate interests of the Company (fraud prevention, security measures)
• Article 5/1: Explicit consent (marketing communications and personalized recommendations)

5. Transfer of Personal Data

Your personal data may be shared in accordance with Articles 8 and 9 of the KVKK and only to the extent necessary for providing our services.

5.1 Domestic Transfers

5.2 International Transfers

Some of our service providers maintain servers outside Türkiye. Such transfers are carried out in accordance with Article 9 of the KVKK and Articles 44–49 of the GDPR, using standard contractual safeguards and providers offering adequate levels of protection.

6. Retention Period of Personal Data

Your personal data is retained for the period required by applicable legislation or for as long as necessary to fulfill the purposes for which it is processed:

Upon expiration of the applicable retention period, personal data is periodically anonymized or deleted. These processes are carried out in accordance with the Regulation on Deletion, Destruction, and Anonymization of Personal Data under the KVKK.

7. Your Rights as a Data Subject (KVKK Article 11)

Pursuant to Article 11 of the KVKK, you may exercise the following rights by applying to our Company:

1. To learn whether your personal data is being processed;
2. To request information if your personal data has been processed;
3. To learn the purpose of processing and whether your personal data is used in accordance with such purpose;
4. To learn the third parties to whom your personal data has been transferred domestically or internationally;
5. To request correction of incomplete or inaccurate personal data;
6. To request the deletion or destruction of your personal data when the reasons requiring processing no longer exist, even if it has been processed in accordance with the KVKK and applicable legislation;
7. To request notification of correction, deletion, or destruction operations to third parties to whom your personal data has been transferred;
8. To object to any outcome against you resulting exclusively from the automated analysis of processed data;
9. To request compensation for damages suffered due to unlawful processing of personal data.

8. Application Methods

In accordance with Article 13 of the KVKK and the Communiqué on the Principles and Procedures for Applications to the Data Controller, you may exercise your rights using one of the following methods:

• By Email: destek@unlimitedpatch.com (If sent from an email address previously registered with our Company, identity verification shall be deemed completed.)
• By Registered Electronic Mail (KEP): xxxx@kep.org.tr
• By Secure Electronic Signature or Mobile Signature: Via the email or KEP address listed above
• In Writing (Notary Public or Registered Mail): Kırmızıtoprak Neighborhood, Porsuk Boulevard, Nilay Street, Emin Apartment No: 11/B, Odunpazarı / 26020 Eskişehir, Türkiye
• Through Our System: Via the “KVKK Application” section under “My Account”

Your application must include the following information:

• Your full name and signature if the application is submitted in writing;
• Your Turkish Identification Number (or passport/nationality information for foreign nationals);
• Your residential or business address for notification purposes;
• Your email address, phone number, and fax number (if applicable);
• A clear description of the request and the rights you wish to exercise.

Your application will be concluded within thirty (30) days at the latest, free of charge, depending on the nature of the request, pursuant to Article 13/2 of the KVKK. If the process requires additional costs, the fee determined by the Personal Data Protection Board may be charged.

9. Right to Lodge a Complaint with the Authority

If your application is rejected, if the response is found insufficient, or if no response is provided within thirty (30) days, you have the right to lodge a complaint with the Personal Data Protection Authority within thirty (30) days from the date you learn of the response and, in any event, within sixty (60) days from the date of your application.

10. Data Security

To ensure the security of your personal data, we implement the following technical and administrative measures:

• Protection of all website traffic through SSL/TLS encryption;
• Encryption of sensitive fields at the database level;
• Role-based access control through authorization matrices;
• Firewall protection (Cloudflare WAF) and DDoS mitigation;
• Two-factor authentication for administrator accounts;
• Regular backups and disaster recovery planning;
• Logging of all data access activities;
• Independent annual penetration testing;
• KVKK training programs and confidentiality agreements for employees.

11. Amendments

This Privacy Notice may be updated due to changes in legislation, developments in our services, or changes to Company policies. Significant changes will be notified to your registered email address and displayed as a notice when you log into the website. The most current version will always be available on this page.

This Privacy Notice has been prepared to fulfill our obligation to inform under Article 10 of the KVKK. By completing an order, creating an account, or using our services, you acknowledge that you have read and understood the contents of this notice.