Privacy Notice (KVKK)

This privacy notice has been prepared by us in our capacity as data controller, pursuant to Article 10 of Personal Data Protection Law No. 6698 ("KVKK"), to inform people who visit the aurumgalerie.com website (the "Site"), place an order or contact us about the processing of their personal data.

Data controller

Company name: Aurum Galerie LLC
Address: Brachtstraße 30, 40223 Düsseldorf, Germany
Email: hello@aurumgalerie.com

Personal data processed

  • Identity and contact information: first name, last name, email address, phone number, delivery and billing address
  • Customer transaction information: order contents, payment result, delivery, return and withdrawal records
  • Request information: information you send through the contact form or by email
  • Marketing information: if you give permission, your preferences regarding receiving news and promotions by email
  • Transaction security and online data: IP address, browser and device information, cookie records

Your payment card details are processed by payment service providers.

Purposes of processing and legal grounds

  • Receiving your order, completing payment, and carrying out delivery, return and withdrawal procedures (conclusion and performance of a contract, KVKK Art. 5(2)(c))
  • Invoicing and fulfilling retention and reporting obligations arising from consumer and tax legislation (legal obligation, Art. 5(2)(ç))
  • Responding to your contact requests and complaints (legitimate interest, Art. 5(2)(f))
  • Ensuring the security of the Site and of transactions (legitimate interest, Art. 5(2)(f))
  • Establishing, exercising and protecting rights in legal disputes (Art. 5(2)(e))
  • Sending commercial electronic messages and using non-essential cookies (explicit consent, Art. 5(1))

Method of collection

Your personal data is collected electronically, by automated or partly automated means, through the ordering and payment steps, the contact form, email correspondence and cookies.

Transfer

Limited to the purposes above, your personal data may be transferred to shipping companies for the delivery of your order, to payment service providers for collecting payment, to Shopify, our e-commerce platform provider, to persons from whom we obtain accounting and legal advisory services for fulfilling legal obligations, to analytics and advertising service providers with your explicit consent, and to authorized public institutions and organizations where legally required. Because the servers of Shopify and some service providers are located abroad, your data may be transferred abroad in accordance with the conditions set out in Article 9 of the KVKK.

Retention period

Your personal data is retained for as long as necessary for the purpose for which it is processed and for the period required by the relevant legislation; at the end of this period, it is deleted, destroyed or anonymized.

Your rights

Pursuant to Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information about it if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties in Turkey or abroad to whom it has been transferred; to request correction if it has been processed incompletely or incorrectly; to request its deletion or destruction within the framework of the conditions in Article 7 of the KVKK; to request that the correction, deletion and destruction be notified to third parties to whom your data has been transferred; to object to a result against you arising from the analysis of your processed data exclusively through automated systems; and to request compensation for damages if you suffer damage due to unlawful processing.

Applications

You can send your requests in writing to the address above, in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller, or from the email address registered in our system to the email address above. Your application is concluded free of charge as soon as possible depending on the nature of the request, and within 30 days at the latest; if the procedure requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.