Draft 0.1 · 31 August 2026
This is a product-development draft, not legal advice or a publication-ready contract. Before any real transaction, Turkish counsel and a mali müşavir must approve it against the final company, marketplace, tax, KVKK and consumer-law model.
The verified legal name, MERSİS/tax number, registered address, KEP, telephone, support email, VERBİS status and dispute contact details are intentionally not invented here. Production must not launch until they are completed.
The verified company name, address, MERSİS/tax details and request channel of the data controller under Law No. 6698 must appear here before launch. A generic unnamed controller is not sufficient notice.
Depending on the service, Vendora may process identity/contact, account/security, delivery/address, order/product, payment references, returns, seller applications, agreement acceptance records, device/IP and technical logs, support communications and legally required financial records.
Vendora should not store card numbers or security codes; it should receive only transaction and reconciliation records from the payment provider.
Data is processed for account and contract performance, payment and delivery, product verification, returns and support, fraud/system security, statutory accounting/retention, and the establishment or protection of legal claims under the applicable KVKK processing conditions.
Marketing, non-essential cookies or an international transfer requiring explicit consent must use a separate, freely given and specific choice—not bundled acceptance of this notice.
Only necessary data may be shared with verified recipient groups such as payment, carrier/logistics, hosting/security, email/support providers, the mali müşavir and competent authorities, for stated purposes and legal grounds.
If an international transfer occurs, the real recipient, country, category and Article 9 mechanism must be documented. The notice must not claim transfers that do not occur.
Data may be collected through forms, account/checkout activity, seller/support communications, provider callbacks/webhooks and security logs, automatically or as part of a filing system.
Each category is retained only for its purpose and mandatory period. A final inventory and retention schedule must be approved with counsel and the mali müşavir before launch.
Article 11 rights include learning whether data is processed, requesting information, learning purposes and recipients, correction, deletion or destruction where conditions apply, notification of those operations to recipients, objecting to adverse automated analysis and seeking compensation for unlawful processing.
The application procedure, verified controller contact/KEP and identity-verification method must be added before publication.
Risk-appropriate access control, encryption, logging, backup, vendor management and incident response are applied. This notice must track real data flows, and notice must remain separate from explicit consent.