Privacy Policy

1. Scope of the policy

This policy explains how personal data is processed when you visit the Pielurd store, create an account, place an order, send a support request, or make marketing preferences. The data controller is LATELİER ALBA KOZMETİK SANAYİ VE TİCARET LİMİTED ŞİRKETİ.

2. Categories of data processed

• Identity and contact: name, surname, email, phone, address.
• Customer transaction: orders, returns, payment status, delivery and support records.
• Account and security: membership information, session and transaction security records.
• Marketing preferences: email/SMS opt-in and opt-out records.
• Online usage: IP, device, browser, page interaction, and cookie preferences.
• Legal proceedings and request/complaint records.

Full card information is not directly stored by Pielurd; payment processes are carried out through payment institutions and the Shopify infrastructure.

3. Purposes of processing

• Establishment of order, payment, invoice, delivery, return, and customer support.
• Ensuring membership and account security.
• Fulfillment of legal obligations and management of disputes.
• Prevention of fraud and misuse.
• Improvement of service quality and user experience.
• Analysis, personalization, and marketing when explicit consent or relevant legal conditions exist.

4. Legal grounds

Data is processed based on legal grounds such as the establishment or performance of a contract, legal obligation, establishment/exercise/protection of a right, legitimate interest of the data controller, and explicit consent when necessary. Consent can always be withdrawn for processes based on explicit consent.

5. Data sources

Data can be obtained directly from you; from order, membership, communication, and preference forms; automatically during site usage; and from payment, shipping, technology, and customer service providers.

6. Sharing and transfer

Data may be shared, limited to the purpose and necessary extent, with Shopify, payment institutions, cargo/logistics companies, e-invoice and accounting services, hosting, security, customer support, review, analytical, and advertising service providers; and also with authorized public institutions and legal advisors.

Shopify and some technology service providers may be located abroad or use infrastructure abroad. International transfer processes are managed within the framework of transfer mechanisms in applicable legislation, contractual guarantees, and explicit consent when necessary.

7. Cookies

Mandatory cookies are used for store operation, security, cart, and payment. Analytical, functional, and marketing cookies are kept off by default unless there is a necessary legal condition, and are activated with your preference. Details are in the Cookie Policy and Cookie Preferences panel.

8. Retention

Data is retained for the period required by the processing purpose, contractual relationship, tax/commercial/consumer legislation, and statute of limitations; when the period expires, it is securely deleted, destroyed, or anonymized.

9. Security

Reasonable technical and administrative measures such as access authorization, encryption, logging, updating, and service provider controls are implemented to reduce unauthorized access, loss, and misuse. It should be noted that no transfer method over the Internet provides absolute security.

10. Your rights

You can exercise your rights under the KVKK, including access, rectification, deletion/destruction, knowing third parties to whom data has been transferred, objection to automatic analysis results, and requesting compensation for damages, using the methods on the Data Subject Application page.

11. Changes

This policy may be updated when service, legislation, or data processing processes change. The current version and date are published on this page.