Version: privacy-2026-10-v3. This notice is prepared under Art. 10 of Turkish Law No. 6698 (KVKK) and follows GDPR transparency principles. Legal review is required before launch.
In short
- We process data that identifies you only for membership, shopping, security and legal obligations.
- Your forum posts may concern health or sexual life. We process them only with your separate explicit consent, store them encrypted and never link them to your shopping history.
- We do not sell your data. We use no tracking cookies for advertising or analytics.
- You can download your data, delete your account and withdraw consents from your account: Privacy settings.
1. Data controller
| Field | Details |
|---|---|
| Company name | |
| MERSİS no | |
| Trade registry no | |
| Address | |
| Registered e-mail (KEP) | |
| Privacy requests e-mail | |
| VERBİS registry no | |
| Contact person |
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email, nickname, password (stored only as an irreversible hash) | Membership, email verification, secure sign-in, password reset | Contract (KVKK 5/2-c) |
| Self-declaration of being over 18 and a woman | Community eligibility | Contract (KVKK 5/2-c) |
| Forum posts, comments, poll votes | Providing the community | Explicit consent for content that may concern health or sexual life (KVKK 6); contract for the rest (5/2-c) |
| Two-step verification secret and recovery codes | Account security (mandatory for staff) | Contract and legitimate interest (5/2-c, f) |
| Order, delivery and contact details | Sales, delivery, invoicing, accounting and tax duties | Contract and legal obligation (5/2-c, ç); expressly provided by law (5/2-a) |
| Favourites | Wishlist feature | Contract (5/2-c) |
| Session records: keyed hash of IP and browser, coarse device label | Information security, abuse prevention, "sign out other devices" | Legitimate interest (5/2-f) |
| Audit logs | Accountability and security; logs hold no personal content | Legitimate interest (5/2-f) |
| Report notes | Community moderation | Legitimate interest and legal obligation (5/2-ç, f) |
| Cookie choices and consent records | Proof of consent | Legal obligation and legitimate interest (5/2-ç, f) |
| Newsletter subscription (email, double opt-in record) | Commercial electronic messages | Explicit consent and İYS registration (Law No. 6563) |
Where we rely on legitimate interest, we weigh it against your rights and freedoms. You may object under Art. 11.
3. How we collect data
- From you: registration, sign-in, forum, orders, newsletter and contact forms.
- Automatically: session, security and cookie-choice records created when you use the site.
- From service providers: the payment provider tells us the payment status of an order. We never see or store your card number.
Collection is electronic and partly or fully automated. We make no decisions with legal effect about you solely by automated means.
4. Special categories of personal data
What you share in the forum may concern your health or sexual life. This is special-category data (KVKK Art. 6) and is handled as follows:
- Processed only on your separate explicit consent, independent of other consents. Giving it is not a condition for shopping.
- Stored encrypted, hidden from search engines and never linked to your shopping history. Forum activity and purchases are never combined in a query, screen or export.
- Anonymous posts hide your nickname from other members; only authorized moderators can see the account, for community safety.
- You can withdraw consent at any time from your account. Withdrawal does not affect earlier processing; forum access closes and you can request deletion of your content.
5. Transfers
We do not sell your data or share it for marketing. Transfers are limited to what the service needs and go to these recipient groups:
| Recipient group | Purpose | Abroad |
|---|---|---|
| Hosting and infrastructure provider | Running the site and database, backups | |
| Email delivery provider | Verification, password reset and order emails | |
| Bot protection: Cloudflare Turnstile | Blocking automated abuse on sign-up and post forms | Yes |
| Payment institution: Shopier | Taking and confirming payment | |
| Public authorities and courts | Meeting legal obligations | No |
| Accountant, lawyer, auditor | Accounting, tax and legal advice | No |
These providers act on our instructions (processors) or as separate controllers under their own regulation (for example the payment institution).
Transfers abroad
When data must leave Türkiye, one of the KVKK Art. 9 routes applies: an adequacy decision, appropriate safeguards (standard contract, binding corporate rules or undertaking) or, only exceptionally, an incidental transfer. Special-category forum content is not transferred abroad without your separate explicit consent.
6. Retention and destruction
We keep data for as long as the purpose requires or the law prescribes. Afterwards it is deleted, destroyed or anonymized.
| Data | Retention |
|---|---|
| Membership data | For the life of the account; at most 30 days after closure |
| Forum content | Until you delete it; deleted content is permanently destroyed after 90 days |
| Report notes | 1 year after resolution |
| Session records | Until the session ends (at most 30 days for members, 12 hours for staff) |
| One-time verification links and codes | Deleted on expiry (24 hours, 30 minutes or 5 minutes) |
| Two-step verification secret and recovery codes | Until you turn it off or delete the account |
| Order and invoice records | Period required by law |
| Cookie choice and consent records | |
| Audit logs | |
| Newsletter subscription | While subscribed; on unsubscribe the address is erased and only a one-way suppression record remains. Unconfirmed sign-ups are purged after 48 hours |
7. Data security
Under KVKK Art. 12 we apply appropriate technical and organizational measures: encrypted storage of email addresses and forum content, passwords kept only as irreversible hashes, least-privilege access, audit logging, two-step verification (mandatory for staff) and bot protection. If personal data is unlawfully obtained by others, we notify the Personal Data Protection Board and affected people within the legal time limit.
8. Cookies
Cookies other than strictly necessary ones are used only according to your choice. See the cookie policy.
9. Commercial electronic messages
Newsletters and campaigns are sent only with your explicit consent and after double opt-in. Every message carries a one-click unsubscribe link. You can also manage consent through İYS. See the marketing communications notice.
10. Age limit
The site is for people over 18. We close accounts we find belong to someone under 18 and delete their data.
11. Your rights (KVKK Art. 11)
As a data subject you may:
- Learn whether your personal data is processed,
- Request information about it if processed,
- Learn the purpose of processing and whether it is used accordingly,
- Know the third parties it is transferred to, in Türkiye or abroad,
- Request correction if incomplete or inaccurate,
- Request deletion or destruction under the conditions in the Law,
- Request that correction, deletion and destruction be notified to recipients,
- Object to a result against you arising from analysis solely by automated systems,
- Claim compensation for damage caused by unlawful processing.
How to apply
- Fast route: from Privacy settings you can download your data, delete your account and withdraw consents.
- Written request: state your identity and request clearly and apply in writing, by KEP, or from your registered email address to the data controller; contact details are in section 1 above. Requests signed with a secure electronic signature are also accepted.
We answer within 30 days at the latest. If the process needs extra cost, the Board's tariff fee may be charged. If your request is rejected, you find the answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your request.
12. Changes to this notice
We update this notice when the law or the service changes. The version number appears at the top of this page. We announce important changes by email or in-site notice, and ask for fresh consent where processing relies on it.