PERSONAL DATA PRIVACY

INFORMATION ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

INFORMATION TEXT ("INFORMATION TEXT")

Version 0.0.1
Date: 05/12/2023

MAFİLO / MERGO is the owner of the website and all pages and mobile applications under the domain www.mergo.co ("Website"). The company is the data controller regarding personal data of Website customers and users according to the Personal Data Protection Law No. 6698 ("KVKK"). The company attaches great importance to the confidentiality and protection of your personal data as a data controller. The purpose of this Information Text is to inform visitors and users of the Website about the processing of personal data in accordance with the lighting obligation regulated in Article 10 of KVKK.

This Information Text may be updated when necessary for the introduction of new services or the fulfillment of existing legal requirements. Website users should regularly check for updates.

"Company" and "we" refer to MAFILO TEKSTİL SANAYİ VE DIŞ TİCARET LİMİTED ŞİRKETİ, located at Cumhuriyet Caddesi 189/8, 34373 Istanbul, Turkey.

"Data Subject" refers to the real person whose personal data is processed.

"Products" refer to the products offered for sale on the Website.

Principles We Follow While Processing Personal Data
The Company complies with the fundamental principles specified in KVKK when processing personal data. These fundamental principles are as follows:

Compliance with the law and integrity rules,
Accuracy and up-to-date when necessary,
Processing for specific, explicit, and legitimate purposes,
Being relevant, limited, and proportionate to the purposes for which they are processed,
Retaining for as long as necessary, as stipulated by relevant legislation or for the intended purpose.

Legal Basis for Processing Personal Data
The company processes personal data only when it is legally permissible and if at least one of the following conditions is met:

Explicit consent of the data subject: The data subject’s consent must be informed, voluntary, and specific to a particular matter. Personal data is processed in accordance with the explicit consent and for the purposes stated within that consent.
Clearly stipulated by law: Personal data may be processed in cases permitted by law, limited to the reasons and categories specified in the relevant law.
Inability to obtain explicit consent due to physical impossibility: In case of a physical impossibility, if obtaining explicit consent is not possible, the processing of personal data is permitted if necessary to protect the life or physical integrity of the person or another person.
Directly related to the establishment or performance of a contract: If personal data processing is necessary for the establishment or performance of a contract, it may be processed.
Fulfillment of the Company’s legal obligation: If personal data processing is necessary for the company to fulfill its legal obligations, personal data may be processed.
Public disclosure by the data subject: If the data subject has publicly disclosed their personal data, it can be processed for the purpose of the disclosure.
Necessary for the establishment, use, or protection of a right: If personal data processing is necessary for the establishment, use, or protection of a right, it may be processed.
Legitimate interests of the company: Personal data may be processed for the legitimate interests of the company, provided that it does not harm the fundamental rights and freedoms of the data subject.

What Personal Data is Processed?
Below is detailed information on the personal data we process and the legal basis for processing.

Personal Data	Legal Basis	Scope
Customer’s name, surname, title, T.C. ID number, tax number, address	(i) Performance of sales contract, (ii) Tax laws	Recorded when a customer purchases a product on the Website for invoicing purposes.
Customer’s name, surname, and address	Sales Contract Performance	Recorded for the delivery of the purchased product.
Customer’s name, surname, title, email address	Sales Contract Performance	Recorded to manage customer satisfaction processes such as complaints, delivery delays, and product returns.
Customer invoices	(i) Tax laws, (ii) Establishment or protection of a right	Invoices are kept until the expiration of tax statute of limitations and for resolving legal disputes.
Customer contracts	Establishment or protection of a right	Kept until the expiration of legal statute of limitations for resolving legal disputes.
IP address	Legitimate interest	Processed to identify IP addresses violating Website security and prevent future illegal use.
Email address	Explicit consent	Processed if you consent to receiving promotional emails, newsletters, and campaign information.

Methods of Personal Data Collection
Personal data is collected through the following means:

When you register on the Website,
When you make a purchase on the Website, whether registered or not,
During the execution of the product return process,
When you make a written complaint or request related to your order.

Transfer of Personal Data to Third Parties
Depending on the processing conditions above, some personal data may need to be shared with third-party companies and firms providing services to us.

Payments for purchases made on the Website are processed through the third-party payment system, iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.). Personal data such as identity information, order details, and amount are transferred to iyzico. The Company does not have access to your credit card information (e.g., card number, expiration date).
Server (hosting) services are provided by third-party firms that process personal data as data processors. We sign data processing agreements with these firms in compliance with KVKK.
Third-party service providers are involved in the design and maintenance of the Website. These companies may have access to personal data. We sign data processing agreements with them in accordance with KVKK.
Email addresses are shared with the electronic communication service provider if the user consents to receiving commercial emails, newsletters, and promotional content.

Security of Personal Data
The Company takes the necessary technical and administrative measures in compliance with Article 12 of KVKK to prevent unlawful processing, unauthorized access, and to ensure the protection of personal data.

Retention of Personal Data
Personal data will be deleted, destroyed, or anonymized once the reasons for processing are no longer applicable.

Rights of the Data Subject
The rights of data subjects, as stipulated in Article 11 of KVKK, include:

Learning whether their personal data is processed,
Requesting information about personal data processed,
Understanding the purpose of processing personal data and whether it is used appropriately,
Knowing third parties to whom personal data is transferred, both within and outside the country,
Requesting the correction of incomplete or inaccurate data,
Requesting the deletion or destruction of personal data once processing purposes are no longer valid,
Objecting to decisions based solely on automated processing, including profiling,
Requesting compensation for damages caused by the unlawful processing of personal data.

Data subjects may submit their requests regarding these rights by sending them in writing, via registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the email address previously notified and registered in the Company’s system.

Requests will be addressed within 30 days free of charge. If the process requires a fee, the charge will be in accordance with the fee schedule determined by the Personal Data Protection Authority.

Contact Information
For any questions regarding your personal data, you can contact the Company using the following contact details:

Mersis No: 0610-0361-4090-0011
Address: Cumhuriyet Caddesi 189/8, 34373 Şişli Istanbul, Turkey
Email: mergo@mergo.co
Phone: +90-212-296-8347

Country/region

Language

PERSONAL DATA PRIVACY