Privacy Notice (KVKK Disclosure)
This notice is prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the related Communiqué on Fulfilling the Disclosure Obligation. It explains for which purposes and on which legal basis the personal data of karincalisans.com visitors and customers is processed, and to whom it is transferred.
1. Identity of the Data Controller
Your personal data is processed by the following legal entity acting as data controller:
- Company: Karinca Digital Ltd
- Company No: 17132515 (Companies House, England and Wales)
- Registered Address: Office 18167, 182–184 High Street North, East Ham, London, United Kingdom, E6 2JA
- Email: info@karincalisans.com
- Website: karincalisans.com
Although our company is not established in Türkiye, it offers goods and services to persons located in Türkiye and is therefore subject to the KVKK. We undertake to fulfil the obligations described in this notice.
2. Categories of Personal Data Processed
| Category | Data processed |
|---|---|
| Identity | First name, surname |
| Contact | Email address, phone number |
| Customer transactions | Order history, order notes, delivered product/licence details, coupon and Karınca Points activity, favourites, product reviews |
| Financial | Payment amount, currency, payment status, refund records; for business invoices the company name, tax number and tax office. Card details are never stored on our systems — card data is sent directly to a PCI-DSS compliant payment provider. |
| Transaction security | IP address recorded at sign-up, failed login counters, rate-limiting records, irreversible hash of your password, licence key viewing records |
| Marketing | Newsletter subscription and confirmation record, commercial electronic message consent (date, IP, consent text version), cookie preference |
We do not collect special categories of personal data (such as health or biometric data) and do not offer services to persons under 18.
3. Purposes of Processing and Legal Grounds
Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK:
| Purpose | Legal ground (KVKK art. 5) |
|---|---|
| Taking orders, collecting payment, delivering licences, order tracking and customer support | Necessary for the conclusion or performance of a contract (art. 5/2-c) |
| Creating and managing your membership account | Performance of a contract (art. 5/2-c) |
| Issuing invoices, keeping financial records and complying with statutory retention periods | Expressly provided for by law and compliance with a legal obligation (art. 5/2-a and 5/2-ç) |
| Handling consumer requests, complaints, cancellations and refunds | Legal obligation (art. 5/2-ç) |
| Account security, prevention of unauthorised access and fraud, keeping system records | Legitimate interest (art. 5/2-f) |
| Improving our services and statistical analysis of site usage | Explicit consent (for analytics cookies) or legitimate interest (art. 5/1, 5/2-f) |
| Sending commercial electronic messages containing campaigns, discounts and reminders | Explicit consent (art. 5/1) and consent obtained under art. 6 of Law No. 6563 |
| Establishment, exercise or protection of a right (evidence in a dispute) | Legitimate interest / establishment of a right (art. 5/2-e and 5/2-f) |
Where processing is based on explicit consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
4. Method of Collection
Your personal data is collected electronically and by automated means through order and membership forms, our contact channels, product review and newsletter forms, and cookies used on the site.
5. Transfers, Including Transfers Abroad
In order to provide our services, your personal data is transferred to the service providers listed below, strictly limited to the relevant purpose. Some of these providers are established outside Türkiye; such transfers therefore constitute transfers abroad under Article 9 of the KVKK.
| Recipient / Service | Data transferred | Purpose | Country |
|---|---|---|---|
| Server and hosting provider | All data processed on the site (hosting) | Running the application and database | Germany |
| Stripe | Name, email, payment amount and card data (card data goes directly to Stripe and never reaches us) | Secure collection of payment | USA / Ireland |
| Airwallex | Name, email, payment amount and card data (directly to the provider) | Collection via alternative payment method | Singapore / Hong Kong / EU |
| Zoho Mail (SMTP) | Name, email address, order and delivery details | Sending order confirmations, licence delivery and service emails | EU (Netherlands/Ireland) |
| Brevo | Email address, name | Sending newsletters and campaign emails | EU (France) |
| Google (Analytics, Ads) | Cookie identifier, device/browser information, browsing data | Measuring site usage and advertising performance — only if you give cookie consent | USA / EU |
For transfers abroad, work is under way to put in place the legal mechanisms required by Article 9 of the KVKK (standard contracts, undertakings or other applicable safeguards). In addition, data may be shared to the extent required by applicable legislation in order to respond to lawful requests from competent public authorities.
6. Retention Periods
Your personal data is retained for as long as the processing purpose requires and for the limitation and retention periods set out in applicable legislation. For the detailed table, see our Data Retention and Destruction Policy. Data whose retention period has expired is erased on our own initiative through periodic destruction, without waiting for a request from you.
7. Your Rights as a Data Subject (KVKK art. 11)
As a person whose personal data is processed, you may apply to the data controller to exercise the following rights:
- To learn whether your personal data is being processed,
- To request information if your personal data has been processed,
- To learn the purpose of processing and whether the data is used in accordance with that purpose,
- To know the third parties in Türkiye or abroad to whom your personal data is transferred,
- To request rectification if your personal data is incomplete or inaccurate,
- To request erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
- To request that rectification, erasure and destruction operations be notified to the third parties to whom your data has been transferred,
- To object to a result against you arising from analysis of your data solely by automated systems,
- To claim compensation for damage suffered due to unlawful processing of your personal data.
If you are a member, you can update your name and phone number directly on the Account Details page and permanently delete your account together with the associated personal data from the same page.
8. How to Apply
To exercise your rights, your application must be submitted in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. For accepted application channels and the information your application must contain, see our Data Subject Request Form. Your application will be concluded free of charge within 30 days at the latest.
9. Changes
This notice may be reviewed in line with legislative changes and updates to our services. The current version is always published on this page.
Last updated: 3 August 2026