Privacy Policy of www.poldybaby.com/

This website and Application collects some Personal Data from its Users.

Users may be subject to different protection standards and broader standards may therefore apply to some. In order to learn more about the protection criteria, Users can refer to the applicability section.

This document can be printed for reference by using the print command in the settings of any browser.

Owner and Data Controller

Poldy Baby Customer Services Office,

UMURBEY MAHALLESİ ÇOBANBEY CADDESİ NO:2/1 İÇ KAPI NO:3 YILDIRIM, BURSA, TURKEY

Owner contact email: [email protected]

Types of Data collected

Among the types of Personal Data that this Application collects, by itself or through third parties, there are: Cookies; Usage Data; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example); email address; geographic position; language; Universally unique identifier (UUID); Data communicated while using the service; various types of Data.

Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection.
Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using this Application.
Unless specified otherwise, all Data requested by this Application is mandatory and failure to provide this Data may make it impossible for this Application to provide its services. In cases where this Application specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or the functioning of the Service.
Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner.
Any use of Cookies – or of other tracking tools – by this Application or by the owners of third-party services used by this Application serves the purpose of providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy, if available.

Users are responsible for any third-party Personal Data obtained, published or shared through this Application and confirm that they have the third party's consent to provide the Data to the Owner.

Mode and place of processing the Data

Methods of processing

The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.
The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Application (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time.

Legal basis of processing

The Owner may process Personal Data relating to Users if one of the following applies:

• Users have given their consent for one or more specific purposes. Note: Under some legislations the Owner may be allowed to process Personal Data until the User objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases. This, however, does not apply, whenever the processing of Personal Data is subject to global data protection laws;
• Provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
• Processing is necessary for compliance with a legal obligation to which the Owner is subject;
• Processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;
• Processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.

In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Place

The Data is processed at the Owner's operating offices and in any other places where the parties involved in the processing are located.

Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.

If broader protection standards are applicable, Users are also entitled to learn about the legal basis of Data transfers to a country outside the European Union or to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by the Owner to safeguard their Data.

If any such transfer takes place, Users can find out more by checking the relevant sections of this document or inquire with the Owner using the information provided in the contact section.

Retention time

Personal Data shall be processed and stored for as long as required by the purpose they have been collected for.

Therefore:

• Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
• Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.

The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.

Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.

The purposes of processing

The Data concerning the User is collected to allow the Owner to provide its Service, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as the following: Handling payments, Access to third-party accounts, Analytics, Advertising, Traffic optimization and distribution, Managing contacts and sending messages, Interaction with external social networks and platforms, Commercial affiliation, Remarketing and behavioral targeting, User database management, Interaction with live chat platforms and Registration and authentication.

For specific information about the Personal Data used for each purpose, the User may refer to the section “Detailed information on the processing of Personal Data”.

Facebook permissions asked by this Application

This Application may ask for some Facebook permissions allowing it to perform actions with the User's Facebook account and to retrieve information, including Personal Data, from it. This service allows this Application to connect with the User's account on the Facebook social network, provided by Facebook Inc.

For more information about the following permissions, refer to the Facebook permissions documentation and to the Facebook privacy policy.

The permissions asked are the following:

Basic information

By default, this includes certain User’s Data such as id, name, picture, gender, and their locale. Certain connections of the User, such as the Friends, are also available. If the User has made more of their Data public, more information will be available.

Contact email

Access the User's contact email address.

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

• Access to third-party accounts

This type of service allows this Application to access Data from your account on a third-party service and perform actions with it.
These services are not activated automatically, but require explicit authorization by the User.

Facebook account access (Facebook, Inc.)

This service allows this Application to connect with the User's account on the Facebook social network, provided by Facebook, Inc.

Permissions asked: Contact email.

Place of processing: United States – Privacy Policy.

Category of personal information collected according to CCPA: identifiers.

• Advertising

This type of service allows User Data to be utilized for advertising communication purposes. These communications are displayed in the form of banners and other advertisements on this Application, possibly based on User interests.
This does not mean that all Personal Data are used for this purpose. Information and conditions of use are shown below.
Some of the services listed below may use Trackers to identify Users or they may use the behavioral retargeting technique, i.e. displaying ads tailored to the User’s interests and behavior, including those detected outside this Application. For more information, please check the privacy policies of the relevant services.
Services of this kind usually offer the possibility to opt out of such tracking. In addition to any opt-out feature offered by any of the services below, Users may learn more on how to generally opt out of interest-based advertising within the dedicated section "How to opt-out of interest-based advertising" in this document.

Facebook Audience Network

Facebook Audience Network is an advertising service provided by Facebook, Inc. or by Facebook Ireland Ltd, depending on how the Owner manages the Data processing, In order to understand Facebook's use of Data, consult Facebook's data policy.

This Application may use identifiers for mobile devices (including Android Advertising ID or Advertising Identifier for iOS, respectively) and technologies similar to cookies to run the Facebook Audience Network service. One of the ways Audience Network shows ads is by using the User's ad preferences. The User can control this in the Facebook ad settings.

Users may opt-out of certain Audience Network targeting through applicable device settings, such as the device advertising settings for mobile phones or by following the instructions in other Audience Network related sections of this privacy policy, if available.

Personal Data processed: Cookies; unique device identifiers for advertising (Google Advertiser ID or IDFA, for example); Usage Data.

Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

Category of personal information collected according to CCPA: identifiers; internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Pinterest Ads (Pinterest, Inc.)

Pinterest Ads is an advertising service provided by Pinterest, Inc. that allows the Owner to run advertising campaigns on the Pinterest advertising network.

Users may opt out of behavioral advertising features through their device settings, their Pinterest personalization settings or by visiting the AdChoices opt-out page.

Facebook Lookalike Audience

Facebook Lookalike Audience is an advertising and behavioral targeting service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, that uses Data collected through Facebook Custom Audience in order to display ads to Users with similar behavior to Users who are already in a Custom Audience list on the base of their past use of this Application or engagement with relevant content across the Facebook apps and services.
On the base of these Data, personalized ads will be shown to Users suggested by Facebook Lookalike Audience.

Users can opt out of Facebook's use of Trackers for ads personalization by visiting this opt-out page.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

• Analytics

The services contained in this section enable the Owner to monitor and analyze web traffic and can be used to keep track of User behavior.

Facebook Ads conversion tracking (Facebook pixel)

Facebook Ads conversion tracking (Facebook pixel) is an analytics service provided by Facebook, Inc. or by Facebook Ireland Ltd, depending on how the Owner manages the Data processing, that connects data from the Facebook advertising network with actions performed on this Application. The Facebook pixel tracks conversions that can be attributed to ads on Facebook, Instagram and Audience Network.

Personal Data processed: Cookies; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Yahoo Advertising conversion tracking (Yahoo! Inc.)

Yahoo Advertising conversion tracking is an analytics service provided by Yahoo! Inc. that connects data from the Yahoo advertising network with actions performed on this Application.

Personal Data processed: Cookies; Usage Data.

Place of processing: United States – Privacy Policy.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Google Ads conversion tracking

Google Ads conversion tracking is an analytics service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that connects data from the Google Ads advertising network with actions performed on this Application.

Personal Data processed: Tracker; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Google Analytics

Google Analytics is a web analysis service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, (“Google”). Google utilizes the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services.
Google may use the Data collected to contextualize and personalize the ads of its own advertising network.

Personal Data processed: Tracker; Usage Data.

Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Yandex Metrica (YANDEX, LLC)

Yandex Metrica is an analytics and heat mapping service provided by YANDEX, LLC.
Yandex Metrica is used to display the areas of this Application that Users interact with most frequently. This shows where the points of interest are.

Personal Data processed: Tracker; Usage Data.

Place of processing: Russian Federation – Privacy Policy.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Meta Events Manager (Meta Platforms Ireland Limited)

Meta Events Manager is an analytics service provided by Meta Platforms Ireland Limited. By integrating the Meta pixel, Meta Events Manager can give the Owner insights into the traffic and interactions on this Application.

Personal Data processed: Trackers; Usage Data.

Place of processing: Ireland – Privacy Policy.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

• Handling payments

Unless otherwise specified, this Application processes any payments by credit card, bank transfer or other means via external payment service providers. In general and unless where otherwise stated, Users are requested to provide their payment details and personal information directly to such payment service providers. This Application isn't involved in the collection and processing of such information: instead, it will only receive a notification by the relevant payment service provider as to whether payment has been successfully completed.

Iyzico Payment System

Iyzico is a payment service provided by Iyzico.

Personal Data processed: various types of Data as specified in the privacy policy of the service.

Place of processing: Turkey – https://www.iyzico.com/en/privacy-policy/.

Category of personal information collected according to CCPA: internet information.

• Interaction with external social networks and platforms

This type of service allows interaction with social networks or other external platforms directly from the pages of this Application.
The interaction and information obtained through this Application are always subject to the User’s privacy settings for each social network.
This type of service might still collect traffic data for the pages where the service is installed, even when Users do not use it.
It is recommended to log out from the respective services in order to make sure that the processed data on this Application isn’t being connected back to the User’s profile.

YouTube button and social widgets

The YouTube button and social widgets are services allowing interaction with the YouTube social network provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing.

Personal Data processed: Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

• Interaction with live chat platforms

This type of service allows Users to interact with third-party live chat platforms directly from the pages of this Application, in order to contact and be contacted by this Application‘s support service.
If one of these services is installed, it may collect browsing and Usage Data in the pages where it is installed, even if the Users do not actively use the service. Moreover, live chat conversations may be logged.

Facebook Messenger Customer Chat

The Facebook Messenger Customer Chat is a service for interacting with the Facebook Messenger live chat platform provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing,

Personal Data processed: Data communicated while using the service; Trackers; Usage Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

• Managing contacts and sending messages

This type of service makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with the User.
These services may also collect data concerning the date and time when the message was viewed by the User, as well as when the User interacted with it, such as by clicking on links included in the message.

• Registration and authentication

By registering or authenticating, Users allow this Application to identify them and give them access to dedicated services.
Depending on what is described below, third parties may provide registration and authentication services. In this case, this Application will be able to access some Data, stored by these third-party services, for registration or identification purposes.
Some of the services listed below may also collect Personal Data for targeting and profiling purposes; to find out more, please refer to the description of each service.

Facebook Oauth

Facebook Oauth is a registration and authentication service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, and is connected to the Facebook social network.

Personal Data processed: Trackers; various types of Data.

Place of processing: United States – Privacy Policy; Ireland – Privacy Policy.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

• Remarketing and behavioral targeting

This type of service allows this Application and its partners to inform, optimize and serve advertising based on past use of this Application by the User.
This activity is facilitated by tracking Usage Data and by using Trackers to collect information which is then transferred to the partners that manage the remarketing and behavioral targeting activity.
Some services offer a remarketing option based on email address lists.
In addition to any opt-out feature provided by any of the services below, Users may opt out by visiting the Network Advertising Initiative opt-out page.

Users may also opt-out of certain advertising features through applicable device settings, such as the device advertising settings for mobile phones or ads settings in general.

Google Ads Remarketing

Google Ads Remarketing is a remarketing and behavioral targeting service provided by Google LLC or by Google Ireland Limited, depending on how the Owner manages the Data processing, that connects the activity of this Application with the Google Ads advertising network and the DoubleClick Cookie.

Users can opt out of Google's use of cookies for ads personalization by visiting Google's Ads Settings.

Personal Data processed: Tracker; Usage Data.

Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Facebook Custom Audience

Facebook Custom Audience is a remarketing and behavioral targeting service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, that connects the activity of this Application with the Facebook advertising network.

Users can opt out of Facebook's use of Trackers for ads personalization by visiting this opt-out page.

Personal Data processed: email address; Trackers.

Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

Category of personal information collected according to CCPA: identifiers; internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Facebook Remarketing

Facebook Remarketing is a remarketing and behavioral targeting service provided by Meta Platforms, Inc. or by Meta Platforms Ireland Limited, depending on how the Owner manages the Data processing, that connects the activity of this Application with the Facebook advertising network.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out.

Category of personal information collected according to CCPA: internet information.

This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

• Traffic optimization and distribution

This type of service allows this Application to distribute their content using servers located across different countries and to optimize their performance.
Which Personal Data are processed depends on the characteristics and the way these services are implemented. Their function is to filter communications between this Application and the User's browser.
Considering the widespread distribution of this system, it is difficult to determine the locations to which the contents that may contain Personal Information of the User are transferred.

• User database management

This type of service allows the Owner to build user profiles by starting from an email address, a personal name, or other information that the User provides to this Application, as well as to track User activities through analytics features. This Personal Data may also be matched with publicly available information about the User (such as social networks' profiles) and used to build private profiles that the Owner can display and use for improving this Application.
Some of these services may also enable the sending of timed messages to the User, such as emails based on specific actions performed on this Application.

Information on opting out of interest-based advertising

In addition to any opt-out feature provided by any of the services listed in this document, Users may learn more on how to generally opt out of interest-based advertising within the dedicated section of the Cookie Policy.

The rights of Users

Users may exercise certain rights regarding their Data processed by the Owner.

Users entitled to broader protection standards may exercise any of the rights described below. In all other cases, Users may inquire with the Owner to find out which rights apply to them.

In particular, Users have the right to do the following:

• Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
• Object to processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent. Further details are provided in the dedicated section below.
• Access their Data. Users have the right to learn if Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.
• Verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
• Restrict the processing of their Data. Users have the right, under certain circumstances, to restrict the processing of their Data. In this case, the Owner will not process their Data for any purpose other than storing it.
• Have their Personal Data deleted or otherwise removed. Users have the right, under certain circumstances, to obtain the erasure of their Data from the Owner.
• Receive their Data and have it transferred to another controller. Users have the right to receive their Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the Data is processed by automated means and that the processing is based on the User's consent, on a contract which the User is part of or on pre-contractual obligations thereof.
• Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

Details about the right to object to processing

Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection.

Users must know that, however, should their Personal Data be processed for direct marketing purposes, they can object to that processing at any time without providing any justification. To learn, whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise these rights

Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.

Applicability of broader protection standards

While most provisions of this document concern all Users, some provisions expressly only apply if the processing of Personal Data is subject to broader protection standards.

Such broader protection standards apply when the processing:

• is performed by an Owner based within the EU;
• concerns the Personal Data of Users who are in the EU and is related to the offering of paid or unpaid goods or services, to such Users;
• concerns the Personal Data of Users who are in the EU and allows the Owner to monitor such Users’ behavior taking place in the EU.

Cookie Policy

This Application uses Trackers.

Additional information about Data collection and processing

Legal action

The User's Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Application or the related Services.
The User declares to be aware that the Owner may be required to reveal personal data upon request of public authorities.

Additional information about User's Personal Data

In addition to the information contained in this privacy policy, this Application may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, this Application and any third-party services may collect files that record interaction with this Application (System logs) use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

How “Do Not Track” requests are handled

This Application does not support “Do Not Track” requests.
To determine whether any of the third-party services it uses honor the “Do Not Track” requests, please read their privacy policies.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Application and/or - as far as technically and legally feasible - sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

Should the changes affect processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.

Categories of personal information collected, disclosed or sold

In this section we summarize the categories of personal information that we've collected, disclosed or sold and the purposes thereof. You can read about these activities in detail in the section titled “Detailed information on the processing of Personal Data” within this document.

Information we collect: the categories of personal information we collect

We have collected the following categories of personal information about you: identifiers, internet information, geolocation data and inferred information.

We will not collect additional categories of personal information without notifying you.

How we collect information: what are the sources of the personal information we collect?

We collect the above mentioned categories of personal information, either directly or indirectly, from you when you use this Application.

For example, you directly provide your personal information when you submit requests via any forms on this Application. You also provide personal information indirectly when you navigate this Application, as personal information about you is automatically observed and collected. Finally, we may collect your personal information from third parties that work with us in connection with the Service or with the functioning of this Application and features thereof.

How we use the information we collect: sharing and disclosing of your personal information with third parties for a business purpose

We may disclose the personal information we collect about you to a third party for business purposes. In this case, we enter a written agreement with such third party that requires the recipient to both keep the personal information confidential and not use it for any purpose(s) other than those necessary for the performance of the agreement.

We may also disclose your personal information to third parties when you explicitly ask or authorize us to do so, in order to provide you with our Service.

To find out more about the purposes of processing, please refer to the relevant section of this document.

Sale of your personal information

For our purposes, the word “sale” means any “selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing, or by electronic means, a consumer's personal information by the business to another business or a third party, for monetary or other valuable consideration”.

This means that, for example, a sale can happen whenever an application runs ads, or makes statistical analyses on the traffic or views, or simply because it uses tools such as social network plugins and the like.

Your right to opt out of the sale of personal information

You have the right to opt out of the sale of your personal information. This means that whenever you request us to stop selling your data, we will abide by your request.
Such requests can be made freely, at any time, without submitting any verifiable request, simply by following the instructions below.

Instructions to opt out of the sale of personal information

If you’d like to know more, or exercise your right to opt out in regard to all the sales carried out by this Application, both online and offline, you can contact us for further information using the contact details provided in this document.

What are the purposes for which we use your personal information?

We may use your personal information to allow the operational functioning of this Application and features thereof (“business purposes”). In such cases, your personal information will be processed in a fashion necessary and proportionate to the business purpose for which it was collected, and strictly within the limits of compatible operational purposes.

We may also use your personal information for other reasons such as for commercial purposes (as indicated within the section “Detailed information on the processing of Personal Data” within this document), as well as for complying with the law and defending our rights before the competent authorities where our rights and interests are threatened or we suffer an actual damage.

We will not use your personal information for different, unrelated, or incompatible purposes without notifying you.

Iyzico Privacy & Personal Data Policy

1. Overview

This Privacy & Personal Data Policy is meant to provide information on the personal data collected, retained, processed, shared and transferred by iyzico. Any person who visits iyzico website, or uses any service provided by iyzico (e.g. makes a payment with his/her credit card to a merchant that receives payments via iyzico) is covered by this Privacy & Personal Data Policy

When the term "iyzico" is used, it covers both iyzico Turkey and iyzico Europe as they share the same privacy principles and policy. iyzico might be referred to as "we", "us" or "our" in this policy. Legal titles and contact information of iyzico companies can be found at the end of this document.

The terms "personal data", "personal information" and "your information" are used interchangeably and they mean any information than can be associated to an identified or identifiable natural person (e.g. name, e-mail address, birth date, national ID number)

We are aware that personal data is important for our clients as well as end users and we endeavor to undertake all necessary measures to ensure this policy is complied with by everyone within iyzico and that your personal data is kept safe.

Purpose of this Privacy & Personal Data Policy is:

• To explain, in the most transparent and readable way possible, our ways and purposes of using the data we collect about you;

• To clarify the types of information we collect upon your permission and the purposes and methods for processing of them;

• To inform you on the third parties we transfer this information to as well as our purpose and method in doing so;

• To let you know your choices and legal rights with respect to your personal data;

• To describe the extent of our responsibility for protection of your rights and privacy.

This policy applies to products and services of iyzico only. On websites and mediums that do not belong to iyzico, the policies and rules of the respective person or organization. Sometimes, in addition to iyzico's policies and rules, e.g. on a checkout form placed on a merchant's website, but transmits payment data to iyzico) both iyzico and the merchant's privacy policies shall apply.

The type of personal data processed by iyzico depends on which services you benefit (some of them may not be available according to your region and legal status) and how you benefit from them.

2. Personal Data Collected by iyzico

We collect different types of personal data about you when you visit our website or use our services.

When you visit our websites, send or receive a payment via iyzico, or register to open an account you may use for receiving or sending funds and similar purposes; we will collect information necessary to offer and fulfill your request in an efficient and secure way. This information may include:

• Your contact details (e.g. your name, address, e-mail address, ID number).

• Payment details (e.g. your credit card number, expiry date, instalment choice).

• When someone sends funds to, or enters into any transaction that requires them to provide personal information about third persons, we collect personal data about those third persons.

• Information obtained from third-party sources, such as our clients from whom we receive category and name of the products or services you wish to purchase from the merchant, details on your membership with the merchant, your IP address and past transactions. We also receive information about your purchase from delivery companies to monitor your transaction's status.

• If you are applying to use the services of iyzico, your business details (e.g. your business name and category, tax ID, bank account details) some of the information requested may be related to a legal person and therefore outside the scope of personal data, however, as far as these details contain information related to a real person, you declare that you are authorized to share these pieces of personal information.

• If you are a seller utilizing a platform (e.g. a marketplace) which uses our services, the platform may transfer your personal data such as contact details and bank account number.

• Additional details you provide to us when you make use of optional services provided by iyzico or when you contact iyzico (e.g. via the contact us form located on our website or e-mail).

• Information obtained through cookies, beacons and other tracking technologies (e.g. device, geolocation and usage details). Please read the Section 4 below for more information on how we use cookies and other tracking technologies for provision of our services and interest-based marketing.

3. Use of Personal Data by iyzico and Legal Basis for Processing

We use your personal data for various purposes permitted under data protection laws in Turkey and the European Union. Our purposes in using your personal data are explained with some examples below and are justified by lawfulness criteria stipulated in data protection regulations of the European Union and Turkey, such as performance of contractual obligations, our legitimate interests, and legal obligations.

• To operate our sites and provide our services,

We need to use your information to initiate payments, transfer funds, store your credit cards for your future use, and enable you to create, access and modify your account.

• To improve our services and manage our business needs,

We monitor usage of our sites and services by you and analyze usage data to enhance our performance.

• To mitigate and manage risk and protect our platform and customers from harm,

We detect and prevent fraud by identifying customers and measuring their risk level. These decisions may be made by automatic algorithms as well as human effort under set rules. If you learn that your application or a transaction you want to make has been rejected as a result of those procedures, you may contact us at the contact information provided at the end of this document.

• To contact you when needed,

We may contact you regarding the status of your transaction. Also, when there is an issue related to your account or a payment you make, we may use your personal information to reach out to you so that we can resolve the issue. You may be contacted by iyzico employees, or by employees of our business partners, in which case we need to share your personal data with those business partners.

• To meet our legal obligations or resolve disputes,

Some regulations in the jurisdictions require us to use and retain your information in certain ways. As a payment services provider, we are obliged to keep and inspect records of all transactions we facilitate for various reasons including data retention, anti-money laundering and taxation.

When there is a legal dispute between iyzico and you, or between parties of a transaction facilitated by iyzico, your information may be used to resolve the dispute and presented to courts and other authorized dispute resolution authorities.

We may also use your information in additional ways that you have consented to. For instance, we may seek your consent for sending you marketing material, receiving your feedback or other processing activities. In those cases, you can always withdraw your consent by contacting us at the addresses provided at the end of this Policy. You should include information that enable us to recognize you in that notification. Your notification of withdrawal of your consent will be effective in the future and therefore will not make our prior processing unlawful but it will make us cease to process that information from the receipt of your notification onwards.

4. Use of Cookies and Other Tracking Technologies

When you use the iyzico website, access information related to you, such as your ISP's (Internet Sevice Provider) name, your IP Address, your browsing information and geolocation may be collected by iyzico. This information is used for improvement of iyzico's infrastructure, statistical evaluations, and better targeting of marketing material. Cookies and other tracking technologies (e.g. web beacons) that are operated by iyzico or third party service providers may also be used for collecting information on your usage to enable the website's functionalities such as customization, to mitigate risk (e.g. by prevent fraud), manage our infrastructure, and to promote our services.

Our website uses a web analytics tool named Google Analytics developed by Google, Inc. ("Google"). Google Analytics utilizes cookies and other identifiers to help website owners analyze the use of their website by their visitors and for rendering of the services provided by Google. Information related to your use of the website may be transferred to Google's servers located in various countries and be processed by Google at those locations. Google shall use this information for analyzing your use of the web, drafting reports on the usage of website for website owners and providing other services related to internet use (e.g. creating user segmentations). Google may transfer this information to third parties upon legal obligation and when third parties process this information on behalf of Google. For more information on privacy practices of Google with respect to Google Analytics, please visit this website: https://www.google.com/policies/privacy/partners/ If you do not wish your information to be used by Google Analytics, you may use the following link to opt out: https://tools.google.com/dlpage/gaoptout/

Our website utilizes a service provided by Hotjar Ltd. ("Hotjar") that identifies users' experiences on a website and evaluates the ease of use of the website and receives anonymous feedback from users. Cookies are placed on your computer for the provision of this service.

Our website utilizes a service provided by Optimizely Inc. ("Optimizely") that helps find out which version of the website is more suitable for use by showing different versions to different users. Cookies are placed on your computer for the provision of this service.

This website and iyzico merchant control panel utilize a service provided by Sosyo Plus Bilgi Bil. Tekn. Dan. Hiz. Tic. A.Ş. ("Insider") that helps merchants to find out the features they were not able to use before. Cookies are placed on your computer for the provision of this service.

This website utilizes a service provided by Doğan İnternet Yayıncılığı ve Yatırım A.Ş. ("Medyanet") that analyses user behavior. Cookies are placed on your computer for the provision of this service.

You may reject the use of cookies by applying the relevant settings to your web browser. However, please do not forget that this may cause you to be unable to use some or even all functions of the website. By using our website or services, you consent to processing of your personal data, as explained above, by Google, Hotjar, Optimizely, Insider, Medyanet and other third party service providers.

5. Retainment and Erasure of Personal Data

iyzico retains your personal data in an identifiable format for the shortest period of time necessary to fulfil our legal obligations and for our business needs.

When the period during which we retain your personal data ends, we will erase or anonymize your personal data so that they can no longer be associated with you, in line with our internal procedures that aim to ensure safety of your personal data.

When you close your account or request erasure of your personal data, we will erase or anonymize parts of it that we are not legally obliged to reject your erasure request or to keep even if your account is deleted.

The cookies we use have defined expiration times; unless you visit our sites or use our services within that time, the cookies are automatically disabled and retained data is deleted. You may also manually delete those cookies through your web browser's settings.

6. Transfer of Personal Data to Third Parties

While providing our services, we sometimes share your personal information with third persons for purposes explained in this section.

We share your personal data within the iyzico group companies in order to manage our operations and provide our services in a safe and consistent manner. The transfer between iyzico group companies takes place with adequate safeguards in place, and your personal data does not fall outside the scope of this privacy policy because of this transfer.

We utilize services of other companies as necessary and we may need to share your personal data with some of them. For example, when we receive your payment details (either directly from you or via the merchant you wish to make a payment to) we need to transfer them to respective financial institutions to initiate the payment. Or when the transaction you have made requires some additional steps to be taken (e.g. if it is an international purchase and customs procedures are to be completed) we may share your personal data with relevant service providers (e.g. customs brokers). We may also transfer personal data to third persons (e.g. anti-fraud processing companies) in order to ensure safety and convenience of our users and business.

When you use our services, we notify the other parties to the transaction you have made, such as other users and merchants and this might include transfer of a portion of your personal data.

Law enforcement agents and other authorities may request information from us. We will share your information only when there is a legal obligation to do so; or when it is deemed necessary to prevent and/or prosecute a crime.

We may also need to share personal data with third parties for other business purposes (e.g. for audits, corporate governance, or executing our legal rights). We will always comply with the law when doing so.

7. Personal Data Transfers to Other Countries

Due to nature of our services, we might need to transfer some personal data internationally. A big part of our information technology infrastructure (the all infrastructure of iyzico Turkey) is located within Turkey and this means that if you are using our services or reaching out to our website from another country, your personal data will be transferred to Turkey. This transfer takes place within a lawful framework that ensures safety of your personal information. We rely on model contractual clauses issued by the European Commission for transfers between iyzico Europe and iyzico Turkey.

In addition to the transfers between iyzico group companies, other transfers to third parties mentioned above, may require your personal data to be transferred to different countries. However we guarantee that your personal data is only transferred to countries regarded to be providing adequate safeguards or to parties that guarantee to ensure the safety of your personal information.

8. Choices Available to You

You have choices available with respect to our privacy practices. You may always decline to provide personal data requested by iyzico. However, if the information you have declined to provide is mandatory for provision of our services, you may not use our services. For instance, if you decline to enter your credit card number on the checkout form for a merchant who accepts credit card payments via iyzico, we cannot initiate the payment.

As mentioned in the Section 4 above, we use cookies also for better provision of our services. You may reject or delete them via your internet browser's settings. However, doing so may hinder your experience and make you unable to utilize our services.

You may review and modify some of the personal data we have about you in the settings section of our mobile or web application when you log in to your account. If you want to review or modify other pieces of information than available on the website, please contact us using the contact information at the end of this document.

From time to time, we communicate with you. These communications may be for marketing purposes or notifications related to a transaction you have been a party to. You can opt-out of all marketing related communications by following the instructions at the end of messages we send. However, you cannot opt-out of transactional messages, but you may only choose the methods and addresses you receive them to.

9. Your Rights

We want you to know that you have following rights with respect to your personal data, as per the regulations governing use of personal data within EEA or Turkey:

(a) To learn if we process your personal data, the types of data we process, sources we get your personal data from, third parties we transfer your personal data to within the country or internationally, the period for which we keep the personal data or how we determine that period;

(b) To access your personal data and to request the data provided by you to be given to you or another data controller in a structured, commonly used and machine readable format,

(c) To learn the purposes for which your personal data is processed and to query if they are used in a compatible manner with those purposes,

(d) To object to and request restriction of processing of your personal data,

(e) To request rectification of inaccurate and incomplete personal data about you,

(f) To request erasure of your personal data when there is no legal basis for further processing,

(g) To request notification of procedures such as erasure and rectification to other third parties to whom your personal data has been transferred,

(h) To object to any negative consequences arising from automatic analysis of your personal data,

(i) To request indemnification for any damages arising from unlawful processing of your personal data.

You can exercise these rights by contacting us at the addresses provided at the end of this Policy. Your application should include the information you have given to us while registering or making use of our services as well as a photo ID, so that we may identify you.

10. Protection of Personal Data

All personal data collected by iyzico is transmitted and stored in compliance with reasonable security standards as adopted by the industry. The security of payment data is ensured with our PCI DSS Level 1 Compliant infrastructure and all connections where personal data is transmitted are protected with encryption. Even though we take all reasonable measures to protect your information, you are responsible for securing and maintaining your account information, including your password.

11. Miscellaneous

Our services and websites are not directed to children, i.e. people who are not legal adults. We do not collect personal data from children or other individuals who are not legally able to use our services. If we find out that we have collected Personal Data from a child, we will promptly delete it, unless we are legally obligated to retain such data. If you believe that we have mistakenly or unintentionally collected information from a child, please contact us immediately at the addresses below.

We may make changes to this privacy policy in the future. Changes to the privacy policy will become effective on the date it is published to be effective. Users or our clients are obliged to follow any possible updates and inform their customers (or other users they make transactions with) on iyzico's data-processing activities (as well as this privacy policy) before they transfer other persons' information to iyzico.

12. Contact Information

For iyzico Turkey:

Company Title: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.

MERSIS (Central Registration System) Number: 0483034315700019

Address: Maslak Mah. AOS 55. Sok. 42 Maslak A Blok Sitesi No:2/140 Sarıyer İstanbul

E-Mail: [email protected]

Phone: +90 216 599 01 00

For iyzico Europe:

Company Title: Iyzi Payments, UAB

Registration Code: 304782968

Address: Mėsinių g. 5, LT-01133 Vilnius LITHUANIA

E-Mail: [email protected]

Phone: +90 216 599 01 00

Consent Form Regarding Personal Data Processing

1. The purpose of the privacy notice and the role of our company as data controller:

As per Law No. 6698 on the Protection of Personal Data, our company iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico” or “Company”) qualifies as a “data controller” in regard to the personal data personal data of its users. The objective of this this Information and Consent Statement is to inform its users about the personal data processing activities carried out by iyzico in accordance with the aforementioned Law and to obtain their express consent for circumstances set out in Article 3 below.

2. The purpose of the processing of user’s personal data:

The personal data of users is processed within the scope of the conditions and purposes set out in Articles 5 and 6 of the Law, which include: the execution of necessary works and respective work processes by business units in order to allow relevant persons to benefit from services offered by iyzico; the carrying out of works by business units that are necessary for the performance of commercial activities of iyzico and the execution of related work processes; the planning and execution of iyzico’s commercial and/or business strategies; ensuring the legal, technical and commercial safety of iyzico and relevant persons having a professional relation with iyzico; and the planning and execution of activities that are necessary to market and offer the services offered by iyzico by personalising such services according to the liking, habits and needs of relevant persons.

3. Personal data to be processed on the basis of explicit consent of users and the purpose of processing:

In circumstances where the conditions for personal data processing set out in Articles 5/2 and 6/3 of the Law are not met, the explicit consent of user’s must be obtained for iyzico to process personal data.

Accordingly, the personal data of users for the purposes of developing campaigns directed at users, cross-selling, identifying a target audience, implementing activities that enhance user experience through tracking users’ movements, developing the operation of iyzico’s website, user panel and mobile application and personalising them according to the needs of users, executing direct and indirect marketing, customised marketing and re-marketing activities, executing customised segmentation, targeting, re-targeting, analysis and inter-corporate reporting activities, planning and executing the sales and marketing processes offered by iyzico including with the intent of planning and executing user satisfaction activities and user relationship management processes, planning and implementing processes of generating and/or increasing loyalty to the services offered by iyzico may only be processed, submitted to third persons and shared with parties set out in this Information and Consent Statement.

4. The transfer of user’s personal data

The personal data of users may be transferred to Company authorities, our affiliates, business partners, suppliers, shareholders, legally authorised public institutions and organisations and private entities pursuant to the personal data processing conditions and purposes set out in Articles 8 and 9 of the Law which include the following: the execution of necessary works by business units in order to allow relevant persons to benefit from the services offered by iyzico and the execution of relevant work processes; the execution of necessary works by business units to perform commercial activities carried out by iyzico and the execution of related work processes; the planning and implementation of iyzico’s commercial and/or business strategies; ensuring the legal, technical and commercial safety of iyzico and relevant persons having a professional relation with iyzico; and the planning and execution of activities that are necessary to market and offer the services offered by iyzico by personalising such services according to the liking, habits and needs of relevant persons.

5. The method and legal purpose of personal data collection:

The personal data of users is collected either electronically or physically in case of iyzico’s request. Personal data collected for legal reasons stipulated above may be processed and transferred for purposes set out in Articles 5 and 6 of the Law and this Information and Consent Statement.

6. The rights of users as data subjects:

Pursuant to Article 11 of the Law, a data subject is entitled to: (i) learn whether or not his or her personal data have been processed, (ii) request information as to processing where his or her data have been processed, (iii) learn the purpose of personal data processing and whether the personal data is used in accordance with such purpose, (iv) know the third parties in the country or abroad to whom personal data have been transferred, (v) request rectification in case personal data have been processed incompletely or inaccurately and request the notification of the operations in this regard to third parties to whom personal data have been transferred, (vi) despite having been processed in accordance with the provisions of the Law or other related regulations, request the erasure or destruction of such personal data in case the reasons necessitating their processing cease to exist and request notification of the operations in this regard to third parties to whom personal data have been transferred, (vii) object against any result that is to his or her detriment occurring from the analysis of personal data exclusively through automated systems, (viii) request compensation in case the data subject incurs any damage due to the unlawful processing of personal data.

The claims with respect to such rights may be submitted by means of the methods set forth in the iyzico Privacy Policy available at https://www.iyzico.com/gizlilik-politikasi. iyzico will assess and determine such requests within 30 days. iyzico reserves the right to request a reasonable fee on the basis of the rate specified by the Personal Data Protection Board in relation to such requests.

Information Notice Regarding Personal Data Processing

Data Controller: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico”)

Contact Information:

iyzico Turkey:

Legal Title: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.

MERSİS Number: 0483034315700019

Address: Maslak Mah. AOS 55. Sok. 42 Maslak A Blok Sitesi No:2/140 Sarıyer İstanbul

E-mail: [email protected]

Telephone: +90 216 599 01 00

iyzico Europe:

Legal Title: iyzi Payments, UAB

Registry Number: 304782968

Address: Mėsinių g. 5, LT-01133 Vilnius LITHUANIA

E-Mail: [email protected]

Telephone: +90 216 599 01 00

We, as iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico” or “Company”) care about protecting the personal data. In this Information Notice, we would like to inform you about personal data processing by iyzico within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK”).

The Purpose of The Processing of User’s Personal Data:

Users’ (Customers or people visiting our website) personal data shall be processed;

- In the manner prescribed by the rule of law and in good faith

- In connection, limited and proportionately with the processing purposes,

- In an accurate and updated manner,

- For specified, explicit, and legitimate purposes.

As iyzico, we process Users’ personal data in accordance with the Articles 5 and 6 of the KVKK for the following purposes:

i. The execution of necessary works and respective work processes by business units in order to allow relevant persons to benefit from services offered by iyzico,

ii. The carrying out of works by business units that are necessary for the performance of commercial activities of iyzico and the execution of related work processes,

iii. The planning and execution of iyzico’s commercial and/or business strategies,

iv. Ensuring the legal, technical and commercial safety of iyzico and relevant persons having a professional relation with iyzico,

v. The planning and execution of activities that are necessary to market and offer the services offered by iyzico by personalising such services according to the liking, habits and needs of relevant persons.

The Transfer of Users’ Personal Data

Users’ personal data may be transferred to the Company authorities, our affiliates, business partners, suppliers, shareholders, legally authorised public institutions and organisations and private entities pursuant to the personal data processing conditions set out in Articles 8 and 9 of the Law (KVKK) and within the scope of above-mentioned purposes.

The Method and Legal Ground of Personal Data Collection:

The personal data of Users is collected either electronically or physically in case of iyzico’s request. Personal data collected for legal ground stipulated above may be processed and transferred for the purposes specified in this Information Notice and pursuant to the Articles 5 and 6 of the Law.

The Rights of Users As Data Subjects:

Within the scope of Article 11 of Law (KVKK), Users have right to;

i. Learn whether or not his or her personal data have been processed

ii. Request information as to processing where his or her data have been processed,

iii. Learn the purpose of personal data processing and whether the personal data is used in accordance with such purpose,

iv. Know the third parties in the country or abroad to whom personal data have been transferred,

v. Request rectification in case personal data have been processed incompletely or inaccurately and request the notification of the operations in this regard to third parties to whom personal data have been transferred,

vi. Despite having been processed in accordance with the provisions of the Law or other related regulations, request the erasure or destruction of such personal data in case the reasons necessitating their processing cease to exist and request notification of the operations in this regard to third parties to whom personal data have been transferred,

vii. Object against any result that is to his or her detriment occurring from the analysis of personal data exclusively through automated systems,

viii. Request compensation in case the data subject incurs any damage due to the unlawful processing of personal data.

The claims with respect to such rights may be submitted in writing or in accordance with the method stated by Personal Data Protection Board. iyzico will assess and determine such requests within 30 days. iyzico reserves the right to request a reasonable fee on the basis of the rate specified by the Personal Data Protection Board in relation to such requests.

Consent Letter of Commercial Communication

I acknowledge that iyzi Ödeme ve Elekronik Para Hizmetleri A.Ş. to send a commercial electronic message to me by means of all kinds of electronic communication means such as text message (SMS), video and voice message (MMS), e-mail, letter, telephone, call center, automatic search and so on regarding all kinds of products and services to be offered by iyzi Ödeme ve Elekronik Para Hizmetleri A.Ş., by itself and / or by its service providers; the purpose of advertising, campaigns, discounts, gifts, raffles, promotions, advertising, publicity and information, developing special opportunities for my needs, maintaining the connection with me, customer satisfaction research, survey studies, celebration, wishes, approval and marketing studies.

 

 

 

iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. / Mersis No: 0483034315700019 Tel No: 02165990100 Address: Maslak Mah. AOS 55. Sok. 42 Maslak A Blok Sitesi No:2/140 Sarıyer İstanbul – Turkey