Privacy, Data Protection & Cookies

This English translation is provided for information. The Turkish version of this text is legally binding.

This page explains how your personal data is processed when you visit the www.vitrinonline.com website and the Vitrin Online mobile app, sign up, place an order or contact us, and describes the cookies used on our site. Contents: KVKK Privacy Notice · Cookie Policy · Commercial Electronic Messages Notice and Consent · Payment security

KVKK Privacy Notice

This notice has been prepared by MUHAMMED EMRE AKYOL ("Vitrin Online") as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

1. Data controller

MUHAMMED EMRE AKYOL (Vitrin Online): Tax office / Tax no.: Erenköy / 0450348872; Address: 19 Mayıs Neighbourhood, Dilara Street, Beyaz Saray Apartment Building, No. 11, Flat No. 39, Kadıköy / Istanbul, Türkiye; Email: [email protected]; Registered Electronic Mail (KEP): [email protected]; Telephone: 0545 282 17 86

2. Personal data processed, purposes and legal grounds

When you place an order

• Data: Full name, phone, email, delivery and billing address, order contents and amount, payment method; for corporate invoices, company name, tax office and tax number; Turkish national ID number, only if you choose to provide it for invoicing
• Purpose: Receiving the order, collecting payment, delivery, invoicing, withdrawal/returns and customer support
• Legal basis: Establishment and performance of a contract (Art. 5(2)(c)); compliance with a legal obligation (Art. 5(2)(ç)),e.g. record-keeping under tax legislation and the Distance Contracts Regulation

When you sign up

• Data: Full name, email, phone, password (stored encrypted),saved addresses, order history, wish list
• Purpose: Creating and managing your account
• Legal ground: Conclusion and performance of a contract (Art. 5/2-c)

When you contact us (contact form, email, phone, WhatsApp)

• Data: Full name, contact details, message content and correspondence records
• Purpose: Responding to requests, questions and complaints; preparing corporate quotations
• Legal ground: Conclusion/performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)

When you submit a review/comment

• Data: Full name or display name, review content
• Purpose: Publishing product reviews (after moderation)
• Legal ground: Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)

When you opt in to receive offer messages

• Data: Email address and/or phone number, consent/opt-out records
• Purpose: Sending offers and announcements, keeping consent records
• Legal basis: Explicit consent (Art. 5/1) and prior approval under Article 6 of Law No. 6563; legal obligation for record-keeping (Art. 5/2-ç)

When you visit the site

• Data: IP address, browser and device information, pages visited, cookie identifiers
• Purpose: Secure and proper operation of the site; with your consent, visitor statistics and advertising measurement
• Legal ground: Legitimate interest (Art. 5/2-f) — strictly necessary cookies and security; explicit consent — analytics and marketing cookies

Your personal data is collected partly by automated means through forms on our website and mobile app, the checkout step, and email, phone and WhatsApp correspondence, and by automated means through cookies and server logs. Your card details are entered into the payment field of the PayTR payment infrastructure; they are not seen or stored by Vitrin Online.

3. Parties to whom personal data is transferred

Your data is transferred to the following groups of recipients only to the extent necessary for the purposes above:

• Our e-commerce platform, hosting and email delivery service provider (Qukasoft) — operation of the website, mobile app and order notifications
• Payment institution (PayTR) and banks — payment and refund transactions
• Shipping companies — delivery and return shipments
• Our supplier — preparing and dispatching orders and receiving returns
• Message Management System (İYS) — commercial message consent and opt-out records, if you give consent
• Analytics and advertising service providers (Google, OpenAI) — only if you consent to cookies
• Accounting/financial advisory and legal service providers — legal obligations and legal proceedings
• Authorised public authorities and institutions — requests arising from legislation

These transfers are based on the legal grounds of performance of a contract, legal obligation, legitimate interest and (for analytics/advertising services) explicit consent.

4. Transfers abroad

Analytics and advertising services (Google Analytics, OpenAI advertising pixel) and the content delivery and security service used by our infrastructure provider (Cloudflare) are provided by companies whose servers are located abroad. Analytics and advertising cookies run only if you give consent in the cookie panel; if you do not consent, no cookie data is transferred via these services. Transfers abroad are carried out in accordance with the procedures set out in Article 9 of the KVKK (Turkish Personal Data Protection Law).

5. Retention periods

Your personal data is retained for as long as necessary for the purpose for which it is processed and for the periods prescribed by legislation; at the end of that period it is deleted, destroyed or anonymised. For example: distance-sales transaction records for 3 years (Distance Contracts Regulation, Art. 20),invoice and accounting records for 5 years (Tax Procedure Law, Art. 253),commercial message consent records for 3 years from the end of the consent; membership details for the duration of your membership and, after you delete your account, only for the statutory retention periods; cookie durations are given in the cookie table below.

6. Your rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties to whom it is transferred within Türkiye or abroad; to request correction if it is incomplete or inaccurate; to request its deletion or destruction under KVKK Art. 7; to request that these actions be notified to the third parties to whom the data was transferred; to object to an outcome against you resulting from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.

You may submit your application (Communiqué on the Procedures and Principles of Applications to the Data Controller, Art. 5): in writing to 19 Mayıs Mahallesi, Dilara Sokak, Beyaz Saray Apartmanı, No: 11, İç Kapı No: 39, Kadıköy / İstanbul; by registered electronic mail (KEP) to [email protected]; with a secure electronic signature or mobile signature; or from the email address you previously provided to us and that is registered in our system to [email protected]. Your application must include your full name (your signature for written applications),your Turkish ID number (for foreign nationals, nationality and passport/ID number),your address for notifications, your email/phone details if any, and your request. Your application will be concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee set in the tariff determined by the Personal Data Protection Board may be charged.

Cookie Policy

Cookies are small text files saved to your browser when you visit a website; pixels and browser storage (localStorage/sessionStorage) technologies used for similar purposes are also referred to as "cookies" in this policy. The cookies used on our site were identified by a scan carried out on 08.10.2026.

Cookie types and consent

• Strictly necessary cookies — basket, session, checkout, security and remembering your cookie preference. The site cannot work without them; they do not depend on your consent.
• Platform statistics cookies — first-party cookies and browser storage used by our e-commerce infrastructure provider (Qukasoft) for store statistics. Together with analytics cookies, they run only if you give consent.
• Analytics cookies — visit and page statistics via Google Analytics 4. They run only if you give consent; off by default.
• Marketing / advertising cookies — advertising conversion measurement via the OpenAI advertising pixel and Google advertising features. They run only if you give consent; off by default.

Cookie list

• ecom_lang, ecom_crrntpg, ecom_lstcrtsum — Strictly necessary. Language, navigation and basket functions. Provider: Vitrin Online (Qukasoft platform) — first party. Duration: 1 day.
• ecom_rlc, ecom_rle — Strictly necessary. Security and protection against excessive requests. Provider: Vitrin Online (Qukasoft platform) — first party. Duration: Short-term (session).
• ecomcode, ecom_ecomcode — Strictly necessary. Login, basket and checkout. Provider: Vitrin Online (Qukasoft platform) — first party. Duration: 2–5 days.
• ecom_visprods — Functional. "Recently viewed products" list. Provider: Vitrin Online (Qukasoft platform) — first party. Duration: 30 days.
• ecom_orcode, ecom_rfrsorc, ecom_vldorc — Platform statistics. Records the source of an order (e.g. an offer link). Provider: Vitrin Online (Qukasoft platform) — first party. Duration: Session – 30 days.
• vo_consent (browser storage) — Strictly necessary. Remembers your cookie preference. Provider: Vitrin Online — first party. Duration: 180 days.
• qanalytcs_* (cookie and browser storage) — Platform statistics (consent-based). Store visit statistics. Provider: Qukasoft — first party. Duration: Session – 30 days.
• _ga, _ga_JTZYLPWQN2 — Analytics (consent-based). Distinguishes visitors and sessions. Provider: Google (Google Analytics 4) — first-party cookie, data is sent to Google. Duration: 400 days.
• _gid, _gat_gtag_* — Analytics (consent-based). Visit statistics, request throttling. Provider: Google — first-party cookie. Duration: 1 day / 1 minute.
• __obref, oaiq_cs (session storage) — Marketing (consent-based). Advertising conversion measurement. Provider: OpenAI — first-party cookie/storage. Duration: 365 days / session.
• __cf_bm, _cfuvid — Marketing (consent-based; set when the OpenAI pixel loads). Bot protection. Provider: Cloudflare on OpenAI domains — third party. Duration: 30 minutes / session.

In addition, our infrastructure provider's content delivery service (Cloudflare) may load a script that measures page performance without using cookies.

How to manage your preferences

• On your first visit to the site, you can choose "Accept All", "Reject" or "Preferences" in the panel that opens. Rejecting does not prevent you from using the site or shopping.
• You can withdraw or change your consent at any time via the "Cookie Preferences" link at the bottom of the page or by clicking here. When you withdraw consent, the relevant cookies are deleted; the lawfulness of processing before withdrawal is not affected.
• Your preference is remembered for 180 days; after that you will be asked again.
• You can also delete or block cookies in your browser settings; if you block strictly necessary cookies, functions such as the basket and checkout may not work.

Commercial Electronic Messages: Information and Consent Notice

On whose behalf? Messages are sent on behalf of MUHAMMED EMRE AKYOL (Vitrin Online; Tax office/no.: Erenköy / 0450348872).

Which data, for what purpose? Depending on the channel you consent to, your email address and/or mobile phone number, together with your consent and refusal records (date, time, channel),are processed in order to send messages about offers, discounts, new products and announcements relating to our workwear, safety shoes and occupational safety products, and to keep your consent records in compliance with legislation.

How is it collected, and what is the legal basis? It is collected electronically via the registration form, checkout or newsletter forms. Messages are sent based on your prior consent under Article 6 of Law No. 6563 and your explicit consent under KVKK Art. 5/1; keeping consent and refusal records and reporting them to the Message Management System (İYS) is our legal obligation.

Who is it shared with? It is shared with our infrastructure provider (Qukasoft),whose services we use to send messages, and with the Commercial Electronic Message Management System (İleti Yönetim Sistemi, İYS) for managing consent and opt-out records.

Consent is not mandatory. Not giving consent does not affect your membership or your ability to shop. Information messages about your orders, delivery, returns and invoices do not require consent and contain no promotional content.

Consent text: "I consent to receiving commercial electronic messages from MUHAMMED EMRE AKYOL (Vitrin Online) about products, offers, discounts and announcements via the channels I have selected (email and/or SMS). I understand that I can withdraw my consent at any time, without giving a reason and free of charge."

How can you withdraw your consent? Use the unsubscribe link or opt-out instructions in any message, write to [email protected], or use the Commercial Electronic Message Management System (İYS) at www.iys.org.tr. For your rights under Article 11 of the KVKK, please see the privacy notice (KVKK - Turkish Personal Data Protection Law No. 6698) above.

Payment security

Card payments are processed via the PayTR payment infrastructure. Your card number and security code are entered in the PayTR payment area and are neither seen nor stored by Vitrin Online. Data transmission on our website is encrypted with SSL/TLS. We take reasonable technical and organisational measures to protect your personal data in accordance with Article 12 of the KVKK. We will never ask you for card details or passwords by email, SMS, phone or WhatsApp.

Links to other websites and changes to this policy

Our website may contain links to other websites (e.g. our social media accounts or the payment page); the owners of those websites are responsible for their privacy practices. We may update this policy in line with changes in legislation or in our practices; the current version is always published on this page.

Data controller: MUHAMMED EMRE AKYOL (Vitrin Online) · Version 1.1 · Last updated: 08.10.2026 (platform analytics now subject to consent)