Privacy Policy and KVKK Privacy Notice

1. Data controller

The data controller under Personal Data Protection Law No. 6698 ("KVKK") is Appazar Teknoloji Yazılım ve Ticaret Limited Şirketi.

Address: 19 Mayıs Mahallesi Halaskargazi Caddesi No: 216 Kat: 3 Daire: 3 Şişli/İstanbul — MERSİS: 0071106477000001 — Contact: info@shopega.com — Phone: +90 850 308 0491

Marketplace and collection methods

The sales contract is concluded with the relevant seller. Sellers act as independent controllers for the information they receive to fulfil orders; Shopega retains its own controller obligations.

Data is collected electronically through account, checkout, seller application and support forms, communication channels, cookies and automatic technical logs. Physical deliveries require contact and delivery details; seller verification involves business, representative, document and banking information. Marketing consent is not a condition of purchase.

2. Personal data processed

When you create an account: your full name, email address and an irreversible hash of your password.

When you make a purchase: your full name, email address, country, order and invoice records.

We do not see or store payment card details; payments are processed through a licensed payment institution.

Automatically: your IP address and browser information for security, debugging and rate limiting.

3. Purposes and legal grounds

Formation and performance of a contract (KVKK Article 5/2-c): orders, delivery, invoicing and support.

Legal obligations (KVKK Article 5/2-ç): retention obligations under tax and commercial legislation.

Legitimate interests (KVKK Article 5/2-f): fraud prevention, system security and service improvement.

Explicit consent (KVKK Article 5/1): for newsletter and marketing emails only; you may withdraw it at any time.

4. Data transfers

Data is shared with our hosting, email and payment service providers only to the extent necessary to provide the service.

Data may be transferred to authorized public institutions in response to requests arising from legislation.

Where data is transferred abroad, the conditions in KVKK Article 9 apply.

Infrastructure and recipients

Necessary order information is shared with the seller; physical delivery details with logistics providers. Accounting and legal service providers receive information where required for their services.

The current preproduction application and database infrastructure is in the Netherlands. Error monitoring uses Sentry's Germany region. Planned migration to Turkey is not a completed migration. Cross-border transfer conditions require separate assessment under KVKK Article 9; this notice is not transfer authorization or explicit consent.

Establishment, exercise or protection of rights (Article 5/2-e) is also a basis for retaining dispute and consent evidence.

5. Retention periods

Order and invoice records are retained for the period required by applicable legislation, generally 10 years.

Account data is retained while your account is open and for statutory retention periods after closure.

Platform newsletter addresses are erased on withdrawal. Launch addresses are also erased after the one-time announcement, or after 365 days if the launch has not happened. A separate keyed-digest consent record is retained for three years after consent ends; backup copies expire within 30 days. Merchant-operated newsletters are governed by the relevant seller’s notice.

6. Your rights

Your rights under KVKK Article 11 include information, correction, erasure where statutory conditions apply, objection to adverse results of exclusively automated analysis, and compensation for unlawful processing.

You can send requests to info@shopega.com. Applications are concluded within 30 days at the latest.

Requests and further rights

You may apply from your registered email address to info@shopega.com, via registered electronic mail (KEP) to appazarteknoloji@hs09.kep.tr, or in writing to the company address with identity verification. You may request information on processing, purposes, use and domestic/foreign recipients; correction, deletion or destruction where statutory conditions apply; notification of these actions to recipients; object to adverse results of exclusively automated analysis; and seek compensation for unlawful processing.

7. Cookies

Essential cookies maintain your session, including an HttpOnly cookie for login information.

Analytics and marketing cookies are off by default and are enabled only if you give explicit consent in the cookie preference center.

You can change or withdraw your preferences at any time using the Cookies link at the bottom of the page.