Sabit Fiyatlı Kargo WhatsApp ile İletişim Haftanın her günü Canlı Destek
My Account

Alt Kategoriler

Alt Kategoriler

Alt Kategoriler

Alt Kategoriler

Alt Kategoriler

Alt Kategoriler

Alt Kategoriler

Alt Kategoriler

Alt Kategoriler

Alt Kategoriler

Privacy Policy

Privacy Policy

Last updated: 2026-05-22

This Privacy Policy explains in detail how, why, and where personal data collected at Polikrami is processed. The KVKK Clarification Notice answers "which data, by whom" — this page answers "how is it protected, how long is it kept, where is it transferred". If anything is unclear, you can write to yasal@polikrami.com.

1. Scope

This policy applies to the personal data of everyone who visits the Polikrami website, creates an account, places an order, or subscribes to the newsletter. KVKK (Law No. 6698) is our primary reference for residents of Turkey; for visitors from within the EU, rights under GDPR (EU Regulation 2016/679) also apply.

2. Definitions

  • Data controller: The organisation that decides how your data is processed — Polikrami (Yatgak Bilişim Tic. ve San. LTD. ŞTİ).
  • Data processor: Business partners that process data on behalf of the data controller (e.g. payment provider, courier company).
  • Personal data: Any information that identifies you or makes you identifiable.
  • Special category personal data: Sensitive data that receives extra protection under the law (Turkish national ID number, health data, biometrics, etc.).
  • Processing: Any operation performed on data — collection, recording, storage, transfer, deletion, and so on.

3. Categories of Data We Collect and How We Collect It

3.1 Data you provide directly

  • Registration form: first name, last name, e-mail, phone number, password (stored as a hash).
  • Order form: billing and delivery address, Turkish national ID number (for invoicing only), phone number.
  • Profile page (optional): date of birth, profile photo, biography.
  • Review and workshop forms: review text, artist information.

3.2 Technical data collected automatically

  • IP address, browser type, operating system (User Agent), session data.
  • Page view timestamps (only if you have given cookie consent — Google Analytics).
  • Error logs (stack trace + IP) — only when a system error occurs.

3.3 From third-party sources

  • GeoNames (international address validation) — city/district data returned when a postal code is queried.
  • İş Bankası (payment) — confirmation of whether a payment was successful (card details are not passed to us).

4. Purposes of Processing and Legal Basis

PurposeLegal Basis
Account creation and managementPerformance of a contract — KVKK m.5/2-c, GDPR Art.6(1)(b)
Order processing and deliveryPerformance of a contract — KVKK m.5/2-c, GDPR Art.6(1)(b)
E-Invoice/E-Archive (incl. national ID)Legal obligation — KVKK m.5/2-ç, GDPR Art.6(1)(c), VUK m.230
Security logs, fraud detectionLegitimate interests — KVKK m.5/2-f, GDPR Art.6(1)(f)
Newsletter dispatchExplicit consent — KVKK m.5/1, GDPR Art.6(1)(a) — double opt-in
Birthday greetingExplicit consent — KVKK m.5/1, GDPR Art.6(1)(a)
Google AnalyticsExplicit consent (cookie consent) — KVKK m.5/1, GDPR Art.6(1)(a) + ePrivacy
International data transfersExplicit consent — KVKK m.9

5. Retention Periods

  • Order and invoice records: 10 years (TTK m.82, VUK).
  • Account information: For as long as your account is active + no later than 30 days following a deletion request.
  • Access logs: 1 year, balancing Law No. 5651 and KVKK requirements.
  • Cookies: Between session duration and 2 years depending on type (see Cookie Policy for details).
  • Newsletter subscription: Until the subscription is cancelled; deleted at the point of cancellation.
  • Contact form / KVKK application: 3 years after our obligation to respond has been fulfilled (as recommended in the KVKK Board guidance document).

6. Data Transfers

6.1 Domestic Transfers

  • İş Bankası Virtual POS — order information for payment processing (card details held by the bank).
  • PTT Kargo (coming soon) — name, address, and phone number for courier barcode.
  • GlitchTip — error tracking, running on our own server (Turkey).
  • Yatgak / Örütbağ.net — system e-mails (not a third party — our own infrastructure).

6.2 International Transfers (KVKK m.9 + GDPR Art.44)

The business partners listed below operate servers outside Turkey. Because the KVKK Board has not issued an adequacy decision for these countries, international transfers are subject to your explicit consent. We obtain this consent in the registration form and in the cookie preference banner.
  • Coolify (hosting, TR + EU) — site and database servers.
  • Anthropic Claude (AI, USA) — product/category text generation. No personal data is sent to Anthropic.
  • GeoNames (address validation, USA) — only international postal codes are queried.
  • Google Analytics (analytics, USA) — with IP anonymisation enabled, and only if you have given cookie consent.

For users visiting from the EU, we rely on the Standard Contractual Clauses (SCC) mechanism under GDPR Art.46; signed SCCs from Anthropic and Google are held in our partner agreements.

7. Data Security Measures

The technical and organisational measures we take to protect your personal data against unauthorised access, loss, or alteration:

  • HTTPS encryption: All communication between you and the site is encrypted with TLS 1.2+.
  • Password hashing: Your password is irreversibly hashed using sha1+salt; your plain-text password is never stored anywhere.
  • Access control: Only staff who need a particular piece of data for their role can access it; role-based permissions are maintained.
  • Server security: Regular updates, firewall, error monitoring (GlitchTip).
  • Backups: The database is backed up regularly in encrypted form.
  • Data minimisation: We collect only what is necessary; unnecessary fields are removed from forms.
  • Data breach notification: In the event of a potential breach, we will notify the KVKK Board within 72 hours (KVKK m.12).

8. Your Rights and How to Apply

Your rights under KVKK m.11 (right to learn, rectification, erasure, objection, compensation, etc.) and under GDPR Art.15–22 (access, rectification, erasure/right to be forgotten, restriction, portability, objection, objection to automated decision-making) are fully reserved.

How to contact us:

  • E-mail: yasal@polikrami.com
  • Post: Atatürk Mah. Hatice Beyaztaş Cad. Bahar APT. No: 7/A Merkez, Tunceli
  • Coming soon: online via our KVKK Application Form page

Response time: no later than 30 days. This may be extended by a further 30 days if necessary; we will inform you of the reason for any extension.

Right to complain: If you are not satisfied with our response, you may apply to the KVKK Authority or, if you reside in the EU, to the Data Protection Authority (DPA) of the relevant member state.

9. Cookies

We use three types of cookies on the site:

  • Strictly necessary cookies: Essential for the site to function (OCSESSID, pk_consent). No consent required.
  • Functional cookies: For your convenience (language, currency, theme). Generally persistent preferences.
  • Analytics cookies: Google Analytics (_ga, _ga_*, _gid). Only active with your explicit consent.

For full details on all cookies, see our Cookie Policy page. You can update your cookie preferences at any time via the "Cookie Preferences" link at the bottom of the page.

10. Children's Privacy

Polikrami membership is open to people aged 18 and over. Anyone under the age of 18 must not create an account or place an order on the site. If we become aware that a child's data is present in our system:

  • We will close the account immediately.
  • We will delete any data for which there is no statutory retention obligation.
  • Where applicable, we will inform the parent or legal guardian.

Note for users visiting from the EU: The GDPR Art.8 age threshold for children varies across member states (DE 16, FR 15, NL 16). Polikrami's policy is set at 18+ for all EU visitors, providing a higher level of protection.

11. Policy Changes

This Privacy Policy may be updated due to changes in legislation or the evolution of our services. We will notify you of significant changes by:

  • updating the "Last updated" date on this page,
  • sending an e-mail if you are subscribed to our newsletter,
  • displaying a pop-up notification at login.

If you need a previous version, you can request it at yasal@polikrami.com; we keep a version history in our internal records.

12. Contact

Data Controller: Yatgak Bilişim Teknolojileri Tic. ve San. LTD. ŞTİ — Tunceli Şubesi
Address: Atatürk Mah. Hatice Beyaztaş Cad. Bahar APT. No: 7/A Merkez, Tunceli, Türkiye
Phone: +90 501 633 98 45
KVKK Applications: yasal@polikrami.com
General Enquiries: bilgi@polikrami.com

Thank you for trusting Polikrami with your data. Honesty is the most important tool on our workbench.

This text has not been reviewed by a legal adviser; for any concerns, please contact: yasal@polikrami.com

⇄ Karşılaştır 0/4
Karşılaştır →