Data Protection Notice (KVKK)

1. Data Controller

Pursuant to Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data will be processed by Dryvatec Su Yalıtım, acting as the data controller, within the scope described below.

Data Controller: Dryvatec Su Yalıtım
Email: info@dryvatec.com.tr
Website: dryvatec.com.tr

2. Personal Data Processed

As Dryvatec Su Yalıtım, the following categories of personal data are processed:

Data Category	Personal Data
Identity Data	First name, last name, Turkish ID number (T.C. Kimlik No, for invoicing)
Contact Data	Email address, phone number, delivery address, billing address
Customer Transaction Data	Order details, payment history, invoice details
Transaction Security Data	IP address, session information, cookie records
Marketing Data	Shopping history, preferences and interests (with explicit consent)

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes, based on the legal grounds set out in Articles 5 and 6 of the KVKK:

• Performance of a contract: Carrying out order processes, delivery of products, issuing invoices
• Legal obligation: Fulfilling legal obligations under tax legislation, compliance with e-commerce legislation
• Legitimate interest: Providing customer service and technical support, ensuring site security, fraud prevention
• Explicit consent: Marketing and promotional activities, newsletter delivery, provision of personalized content

4. Transfer of Personal Data

Your personal data may be transferred to the following parties within the framework of Articles 8 and 9 of the KVKK:

Recipient Party	Purpose of Transfer	Legal Basis
iyzico	Execution of payment transactions	Performance of a contract
MNG Kargo	Delivery of products	Performance of a contract
Odoo (EU)	Customer relationship management, order tracking	Legitimate interest
Google Analytics	Anonymous site usage analysis	Explicit consent
Competent authorities and institutions	Legal requirements	Legal obligation

Transfer abroad: Data is transferred to Odoo's servers located within the European Union as part of customer relationship management. This transfer is carried out within the framework of Article 9 of the KVKK and the provisions on transfers to countries providing an adequate level of protection.

5. Method and Legal Basis of Collecting Personal Data

Your personal data is collected by the following methods:

• Order forms on the website
• Account creation and membership operations
• Via the contact form
• Correspondence by email
• Cookies and automatic tracking technologies

6. Retention Periods of Personal Data

Data Type	Retention Period	Basis
Order and invoice details	10 years	Turkish Commercial Code, Tax Procedure Law
Membership details	Duration of membership + 3 years	Statute of limitations under the Code of Obligations
E-commerce records	3 years	Law No. 6563 on Electronic Commerce
Internet access logs	2 years	Law No. 5651
Marketing data	Until consent is withdrawn	Explicit consent

Personal data whose retention period has expired is deleted, destroyed or anonymized within the scope of periodic destruction cycles.

7. Rights of the Data Subject (KVKK Article 11)

Pursuant to Article 11 of the KVKK, you have the following rights regarding your personal data:

1. To learn whether your personal data is being processed,
2. To request information if your personal data has been processed,
3. To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
4. To know the third parties to whom your personal data is transferred domestically or abroad,
5. To request the correction of your personal data if it has been processed incompletely or inaccurately,
6. To request the deletion or destruction of your personal data within the conditions set out in Article 7 of the KVKK,
7. To request that operations carried out under paragraphs (e) and (f) be notified to third parties to whom your personal data has been transferred,
8. To object to an outcome against you resulting from the analysis of the processed data exclusively through automated systems,
9. To claim compensation for damages in the event that you suffer loss due to the unlawful processing of your personal data.

8. Application Method

To exercise the rights stated above, you may choose one of the following methods:

Your application must include the following information:

• First name, last name and signature (for written applications)
• Turkish ID number (T.C. Kimlik No)
• An address for notification or an email address
• Subject of the request

Applications will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the process requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

9. Changes

This notice may be updated in line with changes in legal regulations and company policies. The current text will always be published on this page.