# Privacy policy

> Which personal data Giyimport processes, why, where it is stored, how long it is kept and with whom it is shared.

This policy explains personal data processed by [Şirket ünvanı] ("Giyimport") in services offered via giyimport.com, app.giyimport.com and api.giyimport.com.

Last updated: 2026-11-07

### 1. Controller and processor

[Şirket ünvanı] ([Açık adres]) is the controller for panel users' (customers and staff) account data. For recipient data imported from customers' marketplace stores, the store owner (seller) is the controller and Giyimport is the processor.

### 2. Data we process

- Account data: name, email, company, optional phone, password hash (bcrypt), role, last sign-in.
- Usage data: IP address, browser information, panel page, API request logs and audit logs.
- Marketplace recipient data (only for customers who connect stores): recipient name, phone, email, delivery address, order number and order lines.
- Contact form data: name, email, company, phone and message.

### 3. Purposes and legal bases

- Providing the account and plan service — performance of contract.
- Fulfilling marketplace orders (viewing orders, address for shipping) — seller's instructions and performance of contract.
- Security, access control, abuse prevention and legal obligations — legitimate interest and legal obligation.
- Answering contact requests — legitimate interest.

### 4. Marketplace (Temu, Trendyol) recipient data

Recipient data is retrieved only to fulfil orders, from the store API our customer authorized. It is encrypted with AES-256-GCM before it is written to the database, masked in lists, full view is permission-restricted and every access is logged. It is permanently deleted 30 days after the order closes (at most 90 days for orders that never close). It is never used for marketing, profiling or sold to third parties.

### 5. Storage location and transfers

All data is processed and stored on our dedicated server in the Netherlands (Amsterdam metro area). Personal data is therefore transferred outside Türkiye (to the Netherlands) under Article 9 of KVKK with explicit consent or appropriate safeguards. The current sub-processor list is on the Sub-processors page.

### 6. Retention

- Account data: while the account is open and for statutory periods after closure.
- Recipient data: deleted 30 days after the order closes.
- Audit and API request logs: 365 days.
- Contact form messages: 2 years.

### 7. Cookies

giyimport.com uses no tracking or advertising cookies. The panel (app.giyimport.com) uses one strictly necessary cookie to keep your session. See the Cookie policy.

### 8. Your rights

You can exercise your rights under Article 11 of KVKK (access, rectification, erasure, objection, etc.) as described in the KVKK notice. If you are a marketplace buyer, please send your request to the seller you ordered from first; we assist in fulfilling it on the seller's instructions.

### 9. Contact

[Şirket ünvanı] · [Açık adres] · [İletişim e-postası] · KEP: [KEP adresi]