KVKK Disclosure Notice

This is an informational translation. The Turkish version is legally binding.

(Personal Data Protection Law — Türkiye equivalent of a GDPR Privacy Notice)

Last updated: 28 April 2026 · Effective: 28 April 2026

This Disclosure Notice has been prepared by TEKNORA PAZARLAMA VE DIŞ TİCARET LİMİTED ŞİRKETİ ("Company" / "Data Controller") in its capacity as Data Controller, pursuant to Article 10 of the Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on Procedures and Principles for Fulfilling the Obligation to Inform. Its purpose is to explain transparently for what purpose, on what legal basis and for how long your personal data are processed, and to inform you of your rights.

1. Identity of the Data Controller

2. Categories of Personal Data Processed

• Identity: Name/surname; Turkish ID number or tax number when required for invoicing.
• Contact: Email address, phone, delivery and billing address.
• Customer transaction: Order, invoice, payment, return, request and complaint records.
• Transaction security: IP address, log records, device/browser data, session information.
• Marketing: Cookie/pixel data subject to your consent, communication preferences, segment information.
• Legal proceedings: Correspondence with public authorities, litigation and enforcement file data.

3. Purposes of Processing

• Establishing the distance sales contract, supplying the order, delivery and after-sales support
• Invoicing, payment processing, tax/accounting and financial advisory obligations
• Customer communication, request and complaint management, member/support panel services
• Information security, fraud prevention, fulfilment of log-retention obligations
• Marketing, campaign and segmentation activities within the scope of commercial electronic message consent
• Compliance with obligations arising from the Electronic Commerce Law No. 6563, Consumer Protection Law No. 6502, Tax Procedure Law No. 213 and other applicable legislation

4. Legal Basis (KVKK Articles 5/2 and 6)

• Necessary for the establishment or performance of a contract
• Fulfilment of a legal obligation (tax, e-commerce, consumer legislation)
• Establishment, exercise or protection of a right
• Legitimate interest of the Data Controller — without prejudice to fundamental rights and freedoms
• Explicit consent of the data subject for marketing purposes and where explicit consent is otherwise required

5. Recipients of Data (KVKK Articles 8 and 9)

• Courier companies — for delivery purposes
• Payment institutions and banks, and PCI-DSS-certified payment providers (PayTR, etc.) — payment processing
• Financial advisor / accounting firm — statutory record-keeping obligations
• IT suppliers (hosting, email, CRM) — infrastructure services
• Authorised public authorities and judicial bodies — on legally mandated request
• Overseas providers — only within the framework of explicit consent or KVKK Art. 9 exceptions, with adequate technical safeguards

6. Collection Method

Your personal data are collected via website forms, membership and order processes, email and telephone communications, customer support panels, cookie/pixel technologies and in-person interactions, through automatic or partially automatic means.

7. Retention Periods

At the end of the retention period, data are deleted, destroyed or anonymised.

8. Your Rights (KVKK Article 11)

You have the right to:

• Learn whether your personal data are being processed
• Request information about the processing if data are being processed
• Learn the purpose of processing and whether data are used in accordance with that purpose
• Know the third parties to whom data are transferred domestically or overseas
• Request correction of incomplete or inaccurately processed data
• Request deletion or destruction of data under the conditions in KVKK Article 7
• Request that correction and deletion operations be notified to the third parties to whom data were transferred
• Object to results arising against you from analysis conducted exclusively through automated systems
• Claim compensation for damages resulting from unlawful processing

9. How to Apply

To exercise your rights under the Communiqué on Procedures and Principles for Applications to the Data Controller:

• In writing: wet-signature petition delivered to the company address above
• By email: from your registered email address to info@nuki.com.tr
• Via qualified electronic signature, mobile signature or registered electronic mail (KEP)

Requests will be concluded free of charge within a maximum of 30 days depending on their nature. If you find the response unsatisfactory, you retain the right to lodge a complaint with the Personal Data Protection Authority (KVKK Board) under Article 14 of KVKK.

10. Updates

This Disclosure Notice may be revised in line with changes in legislation or business processes. The current version is always published on this page.