Privacy Policy (KVKK + GDPR)

1. Data Controller

Salim Kızılay (sole proprietorship) — Address: Reşadiye Mahallesi, Yunus Emre 6. Sokak, M. Tüfekçi Apt. 9/12, Çorlu, Tekirdağ · Email: info@salimkizilay.com · KEP: N/A (sole proprietorship, KEP not mandatory)

2. Categories of Personal Data Processed

This site is published statically; it collects no personal data from you during your visit and offers no form, account or session functionality.

Apart from server access logs kept by the hosting provider for security and service continuity (IP address, browser information, request time), no personal data is processed by us.

Special categories of personal data under KVKK Art.6 / GDPR Art.9 (health, biometric, racial or ethnic origin, political opinion, philosophical or religious belief, trade union membership, sex life, criminal conviction) are NOT processed in this service.

3. Purposes of Processing and Legal Bases

Keeping server access logs for security and service continuity (legitimate interest) — KVKK Art.5/2-(f); GDPR Art.6/1-(f).

Compliance with legal obligations and retention of revenue records — KVKK Art.5/2-(ç); GDPR Art.6/1-(c).

No commercial electronic messages are sent through this site and no data is collected for that purpose.

Privacy by Design (GDPR Art. 25)

salimkizilay.com integrates privacy protection into the product design phase: data minimization, purpose limitation, privacy-by-default settings, and automatic anonymization/deletion at the end of retention periods are applied by default.

4. Transfer and Cross-Border Transfer

Data may be shared with the following service providers for the purpose of delivering the service. Where servers outside Türkiye are used, transfers are made under the safeguards of KVKK Art.9 and GDPR Chapter V.

• Cloudflare (hosting/CDN, US) — EU Standard Contractual Clauses (SCCs) 2021/914 Module 2 (Controller-to-Processor)

5. Retention Periods

No personal data is stored by us through this site.

Server access / traffic logs kept by the hosting provider: 6 months.

Invoice and transaction records relating to product purchases are kept by the relevant platform and are subject to that platform's policies. Revenue records reaching us are retained for 10 years under Turkish Tax Procedure Law Art.253.

6. Your Rights

You may exercise your rights under KVKK Art.11 and the GDPR (access, rectification, erasure, restriction of processing, portability, objection) via info@salimkizilay.com . Requests are resolved within 30 days at the latest.

Right to lodge a complaint: in Türkiye, with the Personal Data Protection Authority (https://www.kvkk.gov.tr); in the EU, with the data protection authority of your member state of residence.

7. Security

Sensitive data is protected with at-rest encryption; access rights are limited on a least-privilege basis. Regular backups and restore testing are performed.

8. Cookies

Cookie usage is described in the separate Cookie Policy.

9. Children's Data

The service is not directed at persons under 18; we do not knowingly collect data from them.

11. Data Breach Notification

When a suspected data breach is detected, an internal assessment begins within 24 hours. If personal data of affected users is confirmed to be at risk, a notification is sent to the KVKK Board and/or the relevant EU member state data protection authority within 72 hours.

For high-risk breaches, affected users are directly informed within 7 days.

12. EU Representative and VERBİS Registration

GDPR Art.27 EU representative: not currently designated; we are assessing the exemption threshold given that active EU-targeted data processing is not performed. If a representative is appointed, this section will be updated.

VERBİS (Data Controllers Registry) registration: we are evaluating the annual thresholds set by the KVKK Board for sole proprietorships. If registration becomes mandatory, we will register and update this section accordingly.