KVKK Disclosure Statement
PERSONAL DATA PROTECTION AND PROCESSING POLICY
DİMUEM İÇ VE DIŞ TİCARET A.Ş.
Effective Date: July 31, 2026
Version: 3.0
1. PURPOSE, SCOPE, AND LEGAL BASIS
1.1. Purpose
This Policy has been prepared to determine the fundamental principles and rules regarding the lawful processing, protection, transfer, retention, and erasure of personal data processed by Dimuem İç ve Dış Ticaret A.Ş. (“Company” or “Dimuem”) within the scope of its e-commerce, membership, subscription, online payment, order, delivery, post-sales support, marketing, advertising, campaign, analytics, content, and influencer/UGC operations.
1.2. Scope
This Policy covers all natural persons whose personal data is processed by the Company, including customers, members, prospective customers, subscribers, website visitors, commercial electronic message recipients, influencers, user-generated content (UGC) creators, representatives of suppliers and service providers, as well as employees and job applicants. The dimuem.com website, dimuemworks.online operational dashboard, Shopify infrastructure, payment, e-invoice, logistics, analytics, and advertising systems are within the scope of this Policy.
1.3. Legal Basis
This Policy is based on the Constitution of the Republic of Turkey, the Law No. 6698 on the Protection of Personal Data (“KVKK”), the 2024 amendments to the KVKK, the Regulation on the Erasure, Destruction or Anonymization of Personal Data, the Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform, the Communiqué on the Principles and Procedures for Application to the Data Controller, the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, the Law No. 6563 on the Regulation of Electronic Commerce, Commercial Electronic Message Management System (İYS) legislation, Law No. 5651, and other relevant applicable legislation.
2. DATA CONTROLLER
Under the KVKK, the Data Controller is Dimuem İç ve Dış Ticaret A.Ş.
| Field | Description |
|---|---|
| Trade Name | Dimuem İç ve Dış Ticaret A.Ş. |
| Headquarters Address | Acarlar Mah. 2. Cad. Acarkent Sitesi C251 No: 4 İç Kapı No: 1 Beykoz / İstanbul |
| Phone | +90 538 388 16 14 |
| Website | https://dimuem.com |
| Operational Panel | https://dimuemworks.online |
| KVKK Application Email | kvkk@dimuem.com |
| KEP (Registered Email) | kvkk@dimuem.com |
| Tax ID (VKN) | 2951338795 |
| MERSIS Number | 0295133879500001 |
3. DEFINITIONS
| Term | Definition |
|---|---|
| Explicit Consent | Freely given, specific, and informed consent regarding a specific subject. |
| Anonymization | Rendering personal data impossible to associate with an identified or identifiable natural person, even when matched with other data. |
| Data Subject | The natural person whose personal data is processed. |
| Personal Data | Any information relating to an identified or identifiable natural person. |
| Special Categories of Personal Data | Data listed exhaustively under Article 6 of the KVKK: race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, clothing and dress, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. |
| Data Processor | The natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the data controller. |
| Data Controller | The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system. |
| Periodic Destruction | The process of erasure, destruction, or anonymization executed at recurring intervals specified in the policy upon the disappearance of all processing conditions. |
| UGC | User-Generated Content; visual, video, text, and similar content produced by users or influencers. |
4. BASIC PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA
- Processing in accordance with the law and good faith.
- Being accurate and, where necessary, up to date.
- Processing for specified, explicit, and legitimate purposes.
- Being relevant, limited, and proportionate to the purposes for which they are processed.
- Retention for the period stipulated in the relevant legislation or required for the purpose for which they are processed.
The Company conducts its personal data processing activities in line with the principles of data minimization, purpose limitation, transparency, accountability, and security; it does not collect unnecessary personal data nor use existing data for unstated purposes.
5. DATA SUBJECT CATEGORIES
- Customers, members, subscribers, and prospective customers
- Website visitors
- Commercial electronic message recipients
- Influencers, content creators, and UGC owners
- Authorized representatives and employees of suppliers, business partners, and service providers
- Employees, interns, and job applicants
- Shareholders, board members, and company executives
- Parties to legal proceedings/disputes and their legal representatives
6. CATEGORIES OF PROCESSED PERSONAL DATA
| Data Category | Processed Personal Data |
|---|---|
| Identity | Name, surname; and other identity information required for billing and contracts when transactionally necessary. |
| Contact | Phone number, GSM, email address, delivery/billing address, WhatsApp contact information. |
| Customer Transaction | Membership, account, subscription, order, cart, delivery, return, requests & complaints, and customer support records. |
| Finance | Payment details related to credit card transactions, payment and refund records, billing details. Full credit card data is not stored by the Company; it is processed through the payment institution infrastructure. |
| Transaction Security | IP address, log records, browser and device information, Cookie ID, Session ID, session and security logs. |
| Visual and Audio Records | Photos, videos, and UGC/influencer content. |
| Marketing | Commercial electronic message preferences, consent records, campaign and ad interaction data, segment and analytical findings. |
| Legal Action | Contracts, warning letters and correspondence, records necessary for dispute resolution and judicial/administrative proceedings. |
| Professional Experience & Personnel File | Occupation, title, CV, and employment relationship records, only where strictly necessary for employees, job candidates, interns, or supplier personnel processes. |
7. METHODS OF OBTAINING PERSONAL DATA
Personal data is collected through automated or non-automated methods (provided they are part of a data filing system) via the following channels:
- dimuem.com website, membership, and customer account interfaces
- Contact and order forms
- Email and WhatsApp correspondence
- Cookies and similar tracking technologies
- Contracts, subscription, and commercial electronic communication opt-in workflows
- Data received from logistics, payment, e-invoicing, analytics, advertising, and other service providers
- Social media platforms and content shared directly by the data subject
- dimuemworks.online internal operations panel
8. PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
| Processing Purpose | Primary Legal Basis |
|---|---|
| Membership & customer account creation, identity verification, session management | KVKK Art. 5/2-c (Establishment or performance of a contract); Art. 5/2-f (Legitimate interest) |
| Order processing, payment, delivery, returns, and post-sales support | KVKK Art. 5/2-c (Establishment or performance of a contract); Art. 5/2-ç (Legal obligation) |
| Invoicing, accounting, tax compliance, and maintaining commercial records | KVKK Art. 5/2-a (Expressly provided for by law); Art. 5/2-ç (Legal obligation) |
| Information security, system administration, logging, fraud and abuse prevention | KVKK Art. 5/2-ç (Legal obligation); Art. 5/2-f (Legitimate interest) |
| Requests, complaints, and customer satisfaction management | KVKK Art. 5/2-c (Performance of a contract); Art. 5/2-f (Legitimate interest) |
| Managing legal processes, establishment, exercise, or protection of rights | KVKK Art. 5/2-ç (Legal obligation); Art. 5/2-e (Establishment, exercise, or protection of a right) |
| Analytics, performance measurement, and statistics | Explicit consent for non-essential cookies; Art. 5/2-f (Legitimate interest) for others, respecting fundamental rights and freedoms |
| Marketing, advertising, campaigns, personalization, and commercial electronic communications | Explicit consent and opt-in approval under Law No. 6563 and İYS legislation |
| Management, publication, and contractual processes of Influencer and UGC content | KVKK Art. 5/2-c (Establishment or performance of a contract); Art. 5/2-e (Establishment, exercise, or protection of a right); Explicit consent where necessary |
9. SPECIAL CATEGORIES OF PERSONAL DATA
Regular processing of health data or any other special categories of personal data is not envisaged under the current e-commerce and website workflows. Should special categories of personal data be processed, no action will be taken without at least one of the current conditions specified under Article 6 of the KVKK being met.
The statutory grounds—such as explicit consent, explicit provision in laws, physical impossibility, processing in accordance with the data subject's intention of publicization, establishment/exercise/protection of a right, employment and occupational health/safety obligations, healthcare services conducted by persons under confidentiality obligations, or non-profit organizations' legitimate operations—shall be evaluated on a case-by-case basis. Adequate security measures defined by the Personal Data Protection Board ("Board") are implemented; access rights are restricted, access/transaction logs are maintained, transfer channels are secured, and personnel operate under strict confidentiality obligations.
10. DOMESTIC TRANSFER OF PERSONAL DATA
| Recipient Group | Transfer Purpose | Data Categories | Frequency |
|---|---|---|---|
| iyzico | Payment processing and return procedures | Identity, Contact, Finance / Customer Transaction | Continuous |
| Banks (via iyzico) | Payment collection and refunds | Finance | Continuous |
| Yurtiçi Kargo & other couriers | Order delivery and return logistics | Identity, Contact, Address, Order Details | Continuous |
| BirFatura | Issuance of e-invoices and e-archives | Identity, Contact, Finance, Customer Transaction | Continuous |
| Revenue Administration (GİB) & Tax Offices | Compliance with statutory legal obligations | Identity, Finance, Invoice Details | As required by law |
| Financial Advisor / CPA | Accounting and tax/financial obligations | Identity, Finance, Invoice Details | Periodic |
| İYS (Message Management System) | Commercial electronic communication consent management | Contact and Opt-in Records | Continuous |
| Courts, Prosecutors, Authorized Public Entities | Legal obligations and dispute resolution processes | Variable depending on the scope of request | Upon official request |
11. CROSS-BORDER TRANSFER OF PERSONAL DATA
11.1. General Principles and Transfer Hierarchy
The Company transfers personal data abroad solely in compliance with the conditions specified in Article 9 of the KVKK. Uploading data to a cloud service located abroad, remote access to data by support personnel situated overseas, or processing data via an offshore platform constitutes a cross-border transfer.
- First, the applicable legal basis under Article 5 or Article 6 of the KVKK is identified.
- It is checked whether an adequacy decision rendered by the Board exists for the recipient country, sector within the country, or international organization.
- In the absence of an adequacy decision, one of the appropriate safeguards specified under KVKK Art. 9/4 is established.
- If neither an adequacy decision nor appropriate safeguards are available, data transfers may only be carried out under limited derogations pursuant to KVKK Art. 9/6 for occasional/incidental transfers.
Note: For continuously used services such as Shopify, Vercel, Supabase, Google, and Meta, occasional transfer derogations cannot serve as a permanent legal basis. Furthermore, explicit consent does not automatically eliminate the necessity of establishing appropriate safeguards in regular, systematic transfers.
11.2. Overseas Service Providers and Data Transfer Map
| Service Provider | Purpose | Data Categories | Likely Region | Typical Role |
|---|---|---|---|---|
| Shopify Inc. | E-commerce, customer accounts, orders, and hosting | Identity, Contact, Customer Transaction, Finance, Security | Canada, USA, EU | Data Processor |
| Vercel Inc. | Hosting for dimuemworks.online | Transaction Security, Operational Data | USA and Service Regions | Data Processor |
| Supabase | Internal panel database and authentication | Contact, Visuals, UGC, Transaction Security | Selected EU / Other Regions | Data Processor |
| Google LLC / Affiliates | Analytics and performance measurement | Device, Browser, Cookies, IP, Usage Data | USA and Other Regions | Processor or Controller (by product) |
| Meta Platforms Entities | Advertising, conversion measurement, targeting | Device, Browser, Cookies, IP, Usage Data | Ireland, USA, Other Regions | Processor or Controller (by product) |
11.3. Appropriate Safeguard Methods
- Execution of an international agreement (not qualifying as an international treaty) with foreign public authorities/international bodies and obtaining authorization from the Board.
- Implementation of Binding Corporate Rules (BCR) approved by the Board for group companies operating in a joint economic activity.
- Execution of Standard Contractual Clauses (SCCs) published by the Board using the module matching the parties' capacities, followed by notification to the Personal Data Protection Authority ("Authority").
- Execution of a written undertaking containing provisions ensuring adequate protection and obtaining permission from the Board.
12. STANDARD CONTRACTUAL CLAUSES (SCCs)
12.1. Module Selection
| Module | Data Exporter | Data Importer | Usage Context for Dimuem |
|---|---|---|---|
| Module 1 | Controller | Controller | Scenarios where the recipient (e.g., Google/Meta) independently determines its own processing purposes. |
| Module 2 | Controller | Processor | Standard module for services processing/hosting data on behalf of Dimuem (e.g., Shopify, Vercel, Supabase). |
| Module 3 | Processor | Processor | Exceptional cases where Dimuem processes data on behalf of another controller and transfers it to a sub-processor. |
| Module 4 | Processor | Controller | Exceptional cases where a processor in Turkey transfers data back to an offshore controller. |
12.2. Drafting, Execution, and Notification Rules
- Controller/Processor statuses of the exporter and importer are determined separately based on current terms of service for each provider.
- Mandatory provisions of the Board's published standard clauses cannot be altered; optional fields and annexes must be fully completed.
- Corporate titles, addresses, legal representatives, and signatory authorizations are verified via up-to-date documentation.
- Data subject categories, data categories, processing purpose, transfer frequency, retention periods, presence of special category data, and nature of processing must be explicitly documented.
- Technical and organizational measures (encryption, access control, logging, backups, incident response, sub-processor management, deletion/return, business continuity) must be fully detailed.
- The Turkish text of the SCCs shall prevail; any foreign language translation must fully align with the Turkish text.
- SCCs must be signed by authorized representatives and submitted by the data exporter to the Authority via its electronic notification portal, KEP, or physical delivery within five (5) business days following execution.
- Material changes in parties, addresses, roles, transfer scope, or annexes require re-evaluating the need for new contracts/notifications.
- Termination of the standard contract must be notified to the Authority within five (5) business days.
12.3. Continuous Compliance and Auditing
- Compliance with contractually agreed purposes, data categories, and transfer frequency is audited at least annually.
- Importers' technical/organizational measures, third-party audit reports, certifications, sub-processor lists, and data breach logs are monitored.
- Potential impacts of local legislation and government access requests in the importer's jurisdiction are evaluated; additional encryption or pseudonymization is deployed where necessary.
- If appropriate safeguards cannot be maintained, transfers are suspended or terminated, and data is returned or destroyed.
- Executed SCCs, annexes, signature circulars, translations, submission receipts, and modification logs are retained in an audit-ready state.
12.4. Service-Provider-Specific Implementation Plan
| Service Provider | Preliminary Assessment | Required Action Plan |
|---|---|---|
| Shopify | Dimuem = Controller; Shopify = Primarily Processor | Confirm contracting party and data locations; execute Module 2; complete sub-processor and security annexes. |
| Vercel | Dimuem = Controller; Vercel = Hosting Processor | Execute Module 2; document project logs, access data, server regions, and sub-processor details. |
| Supabase | Dimuem = Controller; Provider = Processor | Execute Module 2; specify data regions, backup, authentication, deletion, and sub-processor requirements. |
| Google Analytics | Role varies by setup/product | Conduct role analysis; select Module 1 or 2; activate analytical cookies only after explicit consent. |
| Meta Pixel / Conversions | Role varies by product and joint processing terms | Select Module 1 or 2 according to active terms; trigger advertising cookies only after explicit consent. |
13. COOKIES AND SIMILAR TECHNOLOGIES
The dimuem.com website utilizes essential, functional, analytical, and advertising/marketing cookies. Essential cookies are strictly required for basic website operation, security, shopping cart functionalities, payments, user authentication, language choices, and cookie preference storage. Analytical and advertising cookies are not executed without the explicit consent of the user. Users are presented with "Accept", "Reject", and "Manage Preferences" choices with equal visual prominence and accessibility; pre-checked consent boxes are strictly avoided. Comprehensive details are made available in the current Cookie Policy.
14. RETENTION PERIODS AND DESTRUCTION
| Data Category | Retention Period | Statutory / Legal Basis |
|---|---|---|
| Orders, Invoices, Commercial Records | 10 Years | Turkish Commercial Code (TTK) Art. 82 and tax legislation |
| Payment and Refund Records | 10 Years | TTK Art. 82 and statutory obligations |
| Membership Data | Duration of membership + max. 10 years following termination | Turkish Code of Obligations (TBK) Art. 146 & protection of rights |
| Marketing Consent & Contact Data | Until consent is withdrawn; log records stored as mandated by law | Law No. 6563 and İYS regulations |
| Traffic and Log Records | 1–2 Years depending on specific statutory duty | Law No. 5651 & Information Security requirements |
| Customer Support Correspondence | 3 Years or duration of legal dispute | Processing purpose & protection of rights |
| Influencer / UGC Data | Term of contract + max. 10 years thereafter | TBK Art. 146 & protection of rights |
| Cookie Data | Lifespan specific to each cookie | Cookie Policy & user preference logs |
When all legal processing conditions cease to exist, personal data is erased, destroyed, or anonymized ex officio or upon the request of the data subject. If the Company is subject to VERBİS registration, it separately fulfills its obligations to prepare a Data Retention and Destruction Policy and conduct periodic destruction. All destruction operations are officially recorded and these logs are stored for at least three (3) years.
15. TECHNICAL AND ORGANIZATIONAL MEASURES
- Restricting Shopify administrator access to personnel accounts based strictly on operational roles.
- Implementing user-level access controls and permission hierarchies within the dimuemworks.online panel.
- Refraining from issuing full administrator privileges to external agencies and third parties unless strictly required.
- Implementing one-time passwords (OTP) via email instead of static passwords for customer account logins.
- Maintaining Shopify admin activity logs, session histories, and order timelines.
- Automated data backup routines across Shopify and Supabase infrastructures.
- Deployment of enterprise firewalls, DDoS protection, and SSL encryption at the Shopify/Cloudflare level.
- Execution of payment workflows through PCI DSS-compliant iyzico infrastructure.
16. OBLIGATION TO INFORM AND CONSENT MANAGEMENT
During personal data collection, data subjects are informed regarding the identity of the data controller, processing purposes, recipient categories and transfer purposes, collection methods, legal grounds, and data subject rights under Article 11 of the KVKK. Fulfilling the obligation to inform is managed separately from requests for explicit consent.
Where explicit consent is required, consent must be specific, informed, freely given, and demonstrable. Access to basic services is never made conditional upon consent for non-essential marketing or analytics activities. Data subjects may withdraw their consent at any time using a method as straightforward as the one used to give it.
17. RIGHTS OF THE DATA SUBJECT
Pursuant to Article 11 of the KVKK, data subjects have the right to:
- Learn whether their personal data is being processed,
- Request information if their personal data has been processed,
- Learn the purpose of the processing and whether data is used in accordance with its purpose,
- Know the third parties to whom personal data is transferred domestically or abroad,
- Request rectification of incomplete or inaccurate data,
- Request erasure or destruction of personal data under the framework of KVKK Article 7,
- Request notification of rectification, erasure, or destruction operations to third parties to whom data has been transferred,
- Object to negative outcomes resulting exclusively from automated data analysis,
- Claim compensation for damages suffered due to unlawful processing of personal data.
18. APPLICATION PROCEDURES TO THE DATA CONTROLLER
Data subjects may submit their requests under Article 11 of the KVKK in accordance with the Communiqué on the Principles and Procedures for Application to the Data Controller. Submissions must contain: name-surname, signature (for physical applications), Turkish ID number (or passport/ID number for foreign nationals), residential/work address for notification, email/phone/fax details, and explicit details of the request.
| Submission Method | Address Details | Special Instructions |
|---|---|---|
| Written Physical Application | Acarlar Mah. 2. Cad. Acarkent Sitesi C251 No: 4 İç Kapı No: 1 Beykoz / İstanbul | The envelope must be marked: "Information Request Under KVKK". |
| KEP (Registered Email) | [KEP address not specified by Company] | The subject line must read: "Information Request Under KVKK". |
| Registered System Email | kvkk@dimuem.com | Sent from an email address registered in the Company’s records; subject: "Information Request Under KVKK". |
| E-mail via Secure Digital Signature / Mobile Signature | kvkk@dimuem.com | Application must enable valid digital signature verification. |
Applications are processed free of charge as quickly as possible and within thirty (30) days at the latest, depending on the nature of the request. If the transaction incurs additional costs, the fee schedule established by the Board may apply. If an application is rejected, answered insufficiently, or not answered in due time, the data subject reserves the right to lodge a complaint with the Personal Data Protection Board within thirty (30) days from learning of the response, and in any event within sixty (60) days from the date of application.
19. PERSONAL DATA BREACH MANAGEMENT
In the event that processed personal data is unlawfully obtained by unauthorized third parties, the Company shall evaluate the incident without delay, take immediate technical and administrative countermeasures, notify affected data subjects via appropriate channels, and notify the Board within 72 hours of becoming aware of the breach pursuant to Board Decision No. 2019/10.
If notification cannot be made within 72 hours due to justified reasons, the reasons for delay shall be submitted alongside the notification. Notifications will include the timing of the breach, affected data/person categories, likely consequences, implemented/proposed remedies, and contact information. All breach events, impacts, and corrective actions shall be formally documented.
20. ROLES AND RESPONSIBILITIES
| Role | Responsibility |
|---|---|
| Board of Directors | Responsible for approving policy, allocating resources, overseeing compliance, and managing revisions. |
| Department / Operations Leads | Execute data minimization, notice requirements, access controls, and retention schedules in respective units. |
| IT / Technical Service Providers | Manage access privileges, security systems, logs, backups, vulnerability assessments, and incident response. |
| Contact Person / KVKK Responsible | Coordinate VERBİS filings, data subject requests, policy updates, staff training, and Authority communications. |
| All Employees & Authorized Users | Adhere to confidentiality duties, refrain from accessing data beyond authorized scope, and report incidents immediately. |
21. PUBLICATION, REVISION, AND ENFORCEMENT
This Policy is published on the Company website and maintained accessible to all data subjects. It is reviewed whenever there are changes in legislation, business operations, utilized technologies, or third-party service providers. The Policy is audited at least once a year; amendments enter into force upon approval by the Board of Directors. This Policy entered into force on July 31, 2026.
ANNEX-1: COMPLIANCE AND IMPLEMENTATION CHECKLIST
- Official KEP (Registered Email) address of the Company.
- Designated email address dedicated strictly to KVKK data subject applications.
- Verification of VERBİS registration status and contact person information.
- Verification of international transfer mechanisms and execution/notification of Standard Contractual Clauses (SCCs) for Shopify, Vercel, Supabase, Google, and Meta.
- Live technical scan and verification of the web cookie inventory.
- Finalization of separate employee/applicant privacy notices and retention schedules (if HR processes are active).
- Implementation of mandatory Two-Factor Authentication (2FA) and a written Data Breach Incident Response Plan.
- Verification of contracting entities and data storage regions from admin consoles for Shopify, Vercel, Supabase, Google, and Meta.
- Role analysis per provider, selection and execution of appropriate SCC modules, and notification to the Authority within 5 business days.
- Recording SCC notification tracking numbers, signature circulars, and authorization proofs into the Cross-Border Transfer Inventory.
- Mandating 2FA across all critical administrative accounts.
- Formalizing the written Data Breach Response Plan and 72-hour notification workflow.
- Verifying live cookie behaviors; blocking analytical and advertising scripts prior to affirmative user opt-in.
- Annual review of VERBİS obligations and contact person records.
ANNEX-2: PRIMARY LEGISLATION AND OFFICIAL GUIDELINES
- Law No. 6698 on the Protection of Personal Data (KVKK).
- Amendments to Articles 6 and 9 of KVKK introduced by Law No. 7499 (enacted June 1, 2024).
- Regulation on Procedures and Principles Regarding the Transfer of Personal Data Abroad.
- Personal Data Protection Authority – Guide on Cross-Border Transfer of Personal Data.
- Personal Data Protection Authority – Guide on the Processing of Special Categories of Personal Data.
- Personal Data Protection Board Decision No. 2019/10 dated Jan 24, 2019 (Personal Data Breach Notification).
- Regulation on the Erasure, Destruction or Anonymization of Personal Data.
- Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform.
- Communiqué on the Principles and Procedures for Application to the Data Controller.
