Privacy Policy and Data Protection Notice
Under Turkish Personal Data Protection Law No. 6698 (KVKK), this page sets out which of your personal data we process and why, who we share it with, how long we keep it, and how to exercise your rights.
Last updated ·
Data controller
- Registered trade title
- Patara Antalya Mücevherat Tasarım Sanayi ve Ticaret Limited Şirketi
- Brand
- Patara Jewels
- Registered address
- Göksu Mah. Farabi Cad. No: 12AA, Kepez / Antalya, Türkiye
- MERSİS number
- 0723100794700001
- Tax office and number
- Antalya Kurumlar Vergi Dairesi — 7231007947
- Telephone
- 0530 305 53 07
- [email protected]
- Website
- patarajewels.com
Requests under Article 13 KVKK may be delivered to the address above in person or by post, signed by hand, or sent to [email protected] with a secure electronic signature or mobile signature. Your request is answered free of charge as quickly as its nature allows and within thirty days at the latest; where answering it carries a cost of its own, the tariff set by the Personal Data Protection Board may be charged.
If the company holds a VERBİS registration or a registered electronic mail (KEP) address, they belong in this section. Neither appears in the documents provided to us.
The personal data we process
This site supports both online payment and ordering by phone or WhatsApp. When you pay online your card details go straight to the bank and are not stored in our systems; see "Card details" below. What we process is limited to the following.
- Account data — only if you create an account
- Email address, first and last name, and optionally a phone number. Your password is stored irreversibly hashed; it is never seen or stored in readable form at any point.
- Wishlist
- The identifiers of the pieces you save, held against your account. Created only for signed-in members.
- Contact form
- When you fill in and send the form: your name, email address, subject and message. This reaches us as email and is what allows us to reply.
- Order and delivery data — only if you place an order
- Your name, delivery and billing address, city, district, postal code, telephone number and email address, together with the contents and total of your order. These are needed to create the order, hand it to the courier and issue the legally required documents.
- Card details — not stored
- Your card number, expiry date and security code (CVV) go from the payment page straight to the bank's systems. They are never written to our database, never appear in our logs and never travel beyond the payment request itself; the security code in particular is never retained in any form, masked or otherwise, as the card schemes require. After a payment the only trace of the card we hold is the bank's own masked card number (for example 5521 01** **** 9928).
- Payment records
- The transaction id, authorisation code and reference number (Rrn) the bank issues, the amount, the 3D Secure verification result, and the IP address sent to the bank with the transaction. These are kept as proof of payment and for refunds, cancellations and reconciliation.
- Security and technical logs
- Records of requests to our servers, including IP address, timestamp and browser information. Kept for debugging and to prevent abuse.
- Measurement data — only with your consent
- The pages you view, the pieces and product listings you look at, your searches on the site, the colour and size you select on a piece, saving a piece to your wishlist, registering and signing in, sending the contact form, and your clicks on the WhatsApp or telephone order buttons. These records carry only that the action happened and which piece it concerned; the name, email address and message you type into the registration or contact forms are not passed to the measurement providers. None of this is collected unless you have consented to analytics or marketing.
Purposes and legal grounds
- Providing the account and wishlist
- Ground: necessary for the conclusion and performance of a contract (Art. 5/2-c KVKK). An account is not required; the catalogue and product pages work fully without one.
- Taking your order, processing payment and delivery
- Legal basis: necessary for the conclusion and performance of a contract (Article 5/2-c KVKK). Your card details are passed to the bank for this purpose alone; the payment records are kept under our legal obligation (Article 5/2-ç).
- Answering your questions and requests
- Ground: legitimate interest (Art. 5/2-f KVKK) and contact initiated at your request. Submitting the contact form is what begins this processing.
- Information and transaction security
- Ground: legal obligation of the controller and legitimate interest (Art. 5/2-ç and 5/2-f KVKK).
- Measuring and improving use of the site
- Ground: explicit consent (Art. 5/1 KVKK). Processing stops when you withdraw consent.
- Advertising measurement and targeting
- Ground: explicit consent (Art. 5/1 KVKK). Processing and transfer abroad stop when you withdraw consent.
Who we share data with
We do not sell your personal data and we do not rent it to third parties for marketing. Data is shared only with the service providers necessary to run the service, within the limits below.
- Resend, Inc. (USA)
- Delivering the message you send through the contact form to us as email. Involved only when you submit the form.
- Google Ireland Ltd. / Google LLC (Ireland, USA)
- Measuring use of the site and attributing advertising. Only if you gave the relevant consent.
- Meta Platforms Ireland Ltd. (Ireland, USA)
- Advertising measurement. If you consented to marketing, your click on the WhatsApp order button is reported to Meta both from your browser and from our server; the server-side report uses your IP address, browser information and Meta's own cookies. Without consent, no report is sent.
- Türkiye Vakıflar Bankası T.A.O. (Türkiye)
- Taking online payment. Your card number, expiry date, the amount and your IP address are sent to the bank; 3D Secure verification happens on your own card issuer's screen. This transfer stays within Türkiye.
- LOOMİS Özel Kargo ve Güvenlik (Türkiye)
- Delivering your order. Name, delivery address and telephone number are passed on. This transfer stays within Türkiye.
- Cloudflare, Inc. and Adobe Inc.
- Delivery of imagery and typefaces. These parties see your IP address, as with any internet request; they do not process your content data.
- Competent public authorities
- Only where there is a legal obligation or a duly made request, and limited to its scope.
Google, Meta and Resend hold data on servers outside Türkiye; these constitute transfers abroad under Article 9 KVKK and, for the measurement tools, rest on your explicit consent. If you use the contact form the transfer is necessary to deliver your message; if you would rather it did not take place, contact us directly by email or phone.
Retention periods
- Account and wishlist
- For as long as your account remains open. Records are deleted when you ask for your account to be removed.
- Contact form messages
- In our email archive for a reasonable period after the exchange concludes. Deleted on request.
- Order, invoice and payment records
- Ten years, under the Turkish Commercial Code and the Tax Procedure Law. This is a legal obligation: a deletion request cannot be met for these records before the period expires.
- Technical logs
- Short term, for as long as the security and debugging purpose requires.
- Measurement data
- The relevant provider's own retention periods apply. The lifetimes of the cookies in your browser are listed in the table on the Cookie Policy page.
Your rights under Article 11 KVKK
- To learn whether your personal data is being processed,
- To request information if it has been processed,
- To learn the purpose of processing and whether the data is used accordingly,
- To know the third parties, in Türkiye or abroad, to whom the data is transferred,
- To request correction where the data is incomplete or inaccurate,
- To request erasure or destruction within the conditions set out in the law,
- To request that correction, erasure and destruction be notified to the third parties to whom the data was transferred,
- To object to a result reached to your detriment through analysis by exclusively automated means,
- To claim compensation for damage suffered as a result of unlawful processing.
Requests can be sent to us using the contact details above. Depending on its nature, your request will be concluded free of charge as soon as possible and in any event within thirty days; where the process incurs an additional cost, the fee set in the Board's tariff may be charged.
You do not need to make a request to withdraw cookie consent: the “Cookie Preferences” link at the bottom of every page withdraws it in one click.
Security and changes
We apply technical and administrative measures against unauthorised access: the site and the admin panel are served over an encrypted connection, your session is held in a cookie that JavaScript cannot read, and passwords are stored irreversibly hashed. Even so, no transmission over the internet can be absolutely secure.
We update this notice as our processing changes. The current version is always published on this page and the date above is revised.
For questions about this notice, or to make a data protection request, contact us.
Get in touch →