KVKK Clarification Text

Data Controller: NUR JEWELLERY KUYUMCULUK SANAYİ VE TİCARET LİMİTED ŞİRKETİ Address: Yenibosna Merkez Mah. Kuyumcukent Sk. Kuyumcukent No: 4M İç Kapı No: 1065, Bahçelievler/İstanbul, Turkey Tax ID: 6321535825 MERSİS No: 0632153582500001 Trade Registry No: 1099222 Email: [email protected]

We collect the following personal data categories: • Identity Data: Name, surname, Turkish ID number (for invoicing) • Contact Data: Email address, phone number, postal address • Financial Data: Bank account details, order and payment information • Digital Data: IP address, browser info, cookies, website usage data • Visual Data: Profile photos (if uploaded)

Your personal data is processed for the following purposes in accordance with KVKK Article 5 and Article 6: • Execution of purchase agreements and order fulfillment • Delivery and shipment processes • Customer relationship management • Legal and regulatory obligations (tax, MASAK/AML for precious metals) • Service improvement and analytics (with consent) • Marketing communications (with explicit consent) • Information security processes

Your data is processed under these legal bases (KVKK Art. 5/2): • Explicitly required by law (tax, AML/MASAK regulations) • Necessary for contract performance (orders, delivery) • Necessary for the legitimate interests of the data controller (fraud prevention, analytics) • Explicit consent (marketing, cookies, profiling)

Your personal data may be transferred to: • Payment service providers (PayTR) — for payment processing • Cargo/logistics companies — for delivery • Tax authorities and regulatory bodies — as required by law • Cloud infrastructure providers — for hosting (with adequate protection) • Legal advisors and auditors — when legally required International transfers are made with adequate protection measures per KVKK Art. 9.

We implement: • SSL/TLS encryption • Encrypted storage (passwords hashed with bcrypt) • PCI DSS compliant payment processing • Access controls and role-based authorization • Regular security audits and penetration testing • Two-Factor Authentication (2FA) for account protection • Logging and monitoring

As a data subject, you have the right to: a) Learn whether your data is processed b) Request information about processing c) Learn the purpose and whether data is used accordingly d) Know third parties to whom data is transferred e) Request correction of inaccurate/incomplete data f) Request deletion/destruction under KVKK Art. 7 g) Request notification of corrections/deletions to third parties h) Object to processing results that are against your interests i) Claim compensation for damages caused by unlawful processing

You may exercise your KVKK rights by: • Email: Send a signed request to [email protected] • Registered Mail: Send to Yenibosna Merkez Mah. Kuyumcukent Sk. Kuyumcukent No: 4M İç Kapı No: 1065, Bahçelievler/İstanbul, Turkey • In Person: Visit our office with valid ID We will respond to your request within 30 days free of charge. If the request requires additional costs, we may charge fees as determined by the KVK Board.

Personal data is retained for: • Account data: Duration of membership + 10 years (Turkish Commercial Code) • Transaction data: 10 years (Tax Procedure Law) • MASAK records: 8 years (AML regulations) • Marketing consent: Until withdrawal • Cookie data: As specified in cookie preferences • Legal dispute data: Until statute of limitations expires

Our website uses cookies for functionality, analytics, and marketing. You can manage cookie preferences through our cookie settings. For details, see our Privacy Policy.