KVKK Clarification Text

COMPREHENSIVE PERSONAL DATA PROTECTION (KVKK) AND PRIVACY DISCLOSURE TEXT

As NetMilli, in line with the requirements of the digital age and international information security standards, we demonstrate the highest level of sensitivity to the privacy, security, and legal processing of the personal data of our guests and customers. This Comprehensive Disclosure Text has been prepared by us in our capacity as the data controller, in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfillment of the Disclosure Obligation, while observing global transparency principles (GDPR and KVKK standards).

DATA CONTROLLER AND CONTACT INFORMATION

  • Trade Name (Data Controller): Resul Ertuğrul (NetMilli)
  • Tax Office and No: Küçükçekmece Tax Office / 3740011366
  • Headquarters Address: Fatih Mah. Prof. Dr. Aziz Sancar Cad. No: 82 Inner Door No: 27 Küçükçekmece / Istanbul
  • Phone / Corporate WhatsApp: 0541 209 08 32
  • E-mail Address: info@netmilli.com
  • Registered Electronic Mail (KEP) Address (Official Notifications): resul.ertugrul@hs09.kep.tr

ARTICLE 1 – CATEGORIES OF PROCESSED PERSONAL DATA Within the scope of your visits, purchases, and communication activities conducted through our platform (www.netmilli.com), your processed data is categorized in accordance with international standards as follows:

  • Identity Data: First name, last name, Turkish ID Number (only within the limits of legal e-invoice issuance obligations and tax ID number (VKN) information for corporate purchases).
  • Contact Data: E-mail address, mobile phone number, billing and delivery address.
  • Customer Transaction and Order Data: Order numbers of purchased products, cart information, cancellation/return records, cargo tracking codes, and shopping history.
  • Financial Data: Payment methods, IBAN number (only during wire transfer/EFT payments or refund processes). Note: Your credit card information is never stored on our servers; it is transmitted directly and encrypted to the payment institution (e.g., PayTR) which holds an international PCI-DSS security certificate.
  • Transaction Security and Cyber Data: Website access logs, IP addresses, browser information, device operating system information, MAC addresses, and cookie activities (within the scope of the obligations of Law No. 5651).
  • Communication and Audio-Visual Data: Written, audio, or visual support requests submitted via our corporate WhatsApp line, e-mail, or contact forms (e.g., damage assessment photos).

ARTICLE 2 – PURPOSES OF PROCESSING PERSONAL DATA Your collected personal data is processed in accordance with the principles specified in Article 4 of the KVKK, namely "being in compliance with the law and rules of good faith, being accurate and, where necessary, up-to-date, and being processed for specific, explicit, and legitimate purposes," for the following purposes:

  • Contractual Performance and Operations: Formation of the Distance Sales Contract and Preliminary Information Form, receiving the order, packaging, delivery to the cargo company, and real-time tracking of logistics processes.
  • Financial Management: Issuance of E-Archive/E-Invoices, payment verification processes (Fraud control), and accounting for potential refund payments.
  • Legal Compliance: Full and complete fulfillment of our legal notification and data retention obligations under the Law on the Protection of the Consumer No. 6502, the Law on the Regulation of Electronic Commerce No. 6563, and the Tax Procedure Law.
  • Customer Experience and Support: Managing request, complaint, and return processes, providing technical support, and personalizing and improving the user experience.
  • Marketing and Communication (Only with Explicit Consent): Sending special campaigns, discounts, newsletters, and new product notifications to you upon your approval (via the Message Management System - İYS).

ARTICLE 3 – METHODS OF COLLECTING PERSONAL DATA AND LEGAL GROUNDS Your personal data is collected electronically through automatic or partially automatic methods via our website, mobile interface, cookies, our cloud infrastructures (Shopify, Cloudflare, etc.), payment intermediary institutions, and our direct corporate communication channels (E-mail, WhatsApp). Your data is processed based on the following legal grounds set out in Article 5/2 of the KVKK:

  • KVKK Art. 5/2(c): "Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract" (The main legal basis for order and shipping processes).
  • KVKK Art. 5/2(ç): "It is mandatory for the data controller to fulfill its legal obligation" (Legislation on invoicing, taxes, and consumer rights).
  • KVKK Art. 5/2(e): "Data processing is mandatory for the establishment, exercise, or protection of a right" (Evidence retention for potential disputes).
  • KVKK Art. 5/2(f): "It is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject" (Cybersecurity and fraud prevention).

ARTICLE 4 – TRANSFER OF PERSONAL DATA (DOMESTIC AND INTERNATIONAL) Due to our use of global e-commerce infrastructures and operational requirements, your data is transferred under high security walls with a "need-to-know" principle (KVKK Art. 8 and Art. 9):

  • Domestic Transfer: To cargo companies for the delivery of your products, to BRSA-licensed payment institutions for secure collection (e.g., PayTR), to accounting/e-transformation integrators for legal e-invoice issuance, and to authorized public institutions when necessary (Ministry of Trade, General Directorate of Security, Courts).
  • International Transfer: Our e-commerce platform operates on the Shopify infrastructure, which adheres to global standards. Due to the need to ensure system security (e.g., Cloudflare CDN) and the global nature of our e-mail servers, IP logs and order information may be transferred to secure cloud servers in countries with adequate protection (based in the EU, USA) in accordance with KVKK Art. 9, based on your explicit consent or legal necessity.

ARTICLE 5 – DATA SECURITY AND RETENTION PERIODS Our systems are protected by 256-bit SSL encryption technologies. The most up-to-date firewalls and security patches are actively used against unauthorized access, data leaks, and cyberattacks. Your personal data is stored in encrypted environments for the retention periods specified in the relevant legal legislation (e.g., 10 years for commercial records as per the Turkish Commercial Code and the Tax Procedure Law). Data for which the legal retention period has expired or the processing purpose has ceased is anonymized or irreversibly deleted from the systems in accordance with our periodic destruction policy.

ARTICLE 6 – LEGAL RIGHTS OF THE DATA SUBJECT As a data subject, you have the following rights under Article 11 of the KVKK:

  1. To learn whether your personal data is being processed,
  2. To request information, documents, and transcripts if it has been processed,
  3. To learn the purpose of processing and whether they are used in accordance with their purpose,
  4. To know the 3rd parties (institutions/organizations) to whom your personal data is transferred domestically or abroad,
  5. To request the correction of your data if it is processed incompletely or incorrectly,
  6. To request the deletion or destruction of your data if the reasons requiring its processing have ceased (Right to be Forgotten),
  7. To request that the correction or deletion processes be notified to the third parties to whom your data has been transferred,
  8. To object to the emergence of a result against you by analyzing the processed data exclusively through automated systems (artificial intelligence / algorithms),
  9. To demand compensation for damages if you suffer damages due to the unlawful processing of your personal data through legal channels.

ARTICLE 7 – APPLICATION PROCEDURE AND COMMUNICATION

To exercise your rights under Article 11 of the KVKK, you may submit your applications to us via one of the following methods in accordance with the "Communiqué on the Procedures and Principles of Application to the Data Controller":

  • Via E-mail: By sending an e-mail to info@netmilli.com from the e-mail address registered in our system,
  • Via KEP: By sending to our resul.ertugrul@hs09.kep.tr KEP address with a secure electronic signature or mobile signature,
  • Via Written Mail: By sending a wet-signed petition via registered mail with return receipt to our headquarters address at Fatih Mah. Prof. Dr. Aziz Sancar Cad. No: 82 Inner Door No: 27 Küçükçekmece / Istanbul.

Your applications will be finalized free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request.