AMARA
Personal Data Protection and Privacy Notice
Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), Amara Earth Art (Ecem Köroğlu Güler), acting as data controller, attaches the utmost importance to processing your personal data lawfully and to ensuring its security and confidentiality. This Privacy Notice has been prepared to fulfil the data controller's disclosure obligation under Article 10 of the KVKK, and sets out the scope in which your personal data is processed, the legal grounds relied upon, the purposes of use, to whom and under what conditions it may be transferred, and your rights under the KVKK. All personal data obtained by Amara Earth Art is processed in accordance with the Constitution, Law No. 6698, the relevant secondary legislation and decisions of the Personal Data Protection Board; lawfully and fairly, accurately and where necessary kept up to date, for specified, explicit and legitimate purposes, in a manner connected with, limited to and proportionate to the purposes of processing, and retained for the period foreseen in the relevant legislation or required for the purpose of processing. This disclosure obligation is presented to you actively at the moment of data collection (membership, order, contact forms, etc.), not merely through a passive link at the bottom of our website; digital records (log entries) evidencing that it has been read are securely retained as part of our burden of proof.
1. About the Data Controller
Pursuant to Law No. 6698, Amara Earth Art (Ecem Köroğlu Güler) (referred to as "Amara Earth Art" or the "Data Controller"), acting as data controller, may process your personal data within the scope explained below; record, retain, update, classify and where necessary rearrange it, and where permitted by the Law, disclose or transfer it to third parties located in Turkey, limited to the purpose of processing. As data controller, Amara Earth Art takes the protection of fundamental rights and freedoms as its basis when processing personal data, and carries out work to prevent unlawful processing of and access to personal data by taking all necessary technical and administrative measures. In its relationships with third parties acting as data processors (infrastructure providers, courier companies, etc.), Amara Earth Art reserves the right and obligation to audit periodically whether technical and administrative data security measures have been taken.
2. Personal Data Processed, Purposes and Legal Grounds
In line with the principles of specificity and proportionality, Amara Earth Art does not process your personal data for general or vague purposes; each data category is matched with a specific purpose and legal ground: • Identity Data (name, surname, national ID number): processed for creating orders, issuing invoices and fulfilling tax obligations, on the grounds of KVKK Art. 5/2-c (conclusion or performance of a contract) and Art. 5/2-ç (compliance with a legal obligation). • Contact Data (telephone number, e-mail address, delivery and billing addresses): processed for delivering products, providing mandatory order-status information and carrying out after-sales support, on the ground of KVKK Art. 5/2-c (performance of a contract). • Customer Transaction Data (order, return, exchange, request and complaint records): processed for providing customer services, resolving disputes and establishing a right, on the grounds of KVKK Art. 5/2-c and Art. 5/2-e. • Transaction Security Data (IP address, log records): processed for fulfilling obligations under Law No. 5651 and ensuring information security, on the grounds of KVKK Art. 5/2-ç and Art. 5/2-f. Processing Subject to Explicit Consent: Amara Earth Art draws a clear line between its disclosure obligation and explicit consent mechanisms. Your purchase of services or membership transactions are never conditional upon giving consent to the processing listed below. • Marketing and Profiling: sending commercial electronic messages, campaign notifications, personalised advertising and the use of marketing cookies are carried out solely on the basis of your explicit consent under KVKK Art. 5/1. • Storage of Credit Card Details: card details used during payment are not stored by Amara Earth Art. Saving your card details for convenience in future purchases constitutes a change of purpose independent of the initial transaction and is carried out only within the scope of the explicit consent you give specifically for that processing.
3. Transfer of Your Personal Data
Your personal data processed by Amara Earth Art may be transferred to third parties within the framework of Articles 8 and 9 of the KVKK and other relevant legislation, to the extent required by the purposes of processing and by taking the necessary technical and administrative security measures. Your personal data is transferred: • to authorised public institutions and organisations where expressly provided for by law (KVKK Art. 5/2-a, ç), • to financial advisors and banks for the fulfilment of tax and financial obligations (KVKK Art. 5/2-ç), • to courier and logistics companies, limited solely to this purpose, in order to carry out delivery processes (KVKK Art. 5/2-c), • to lawyers and law firms for the conduct of legal proceedings (KVKK Art. 5/2-e).
4. Methods of Collection and Data Accuracy
Your personal data is collected by wholly or partly automated means through our website, mobile devices, order and membership forms, customer support requests, cookies and log records. Within the scope of the principle of being accurate and, where necessary, up to date set out in Article 4 of the KVKK and our data security obligations, technical mechanisms are operated to verify the accuracy of the contact details you enter manually (e-mail, telephone number), in order to prevent them from belonging to the wrong person and to prevent invoice/order information from being sent to the wrong recipient. While the user is responsible for the accuracy of the data entered into the system, Amara Earth Art fulfils its active duty of care.
5. Data Retention and Destruction
Your personal data is retained for the maximum period necessary for the purpose of processing or for the statutory retention periods foreseen in the relevant legislation. Upon termination of the contractual or membership relationship, personal data outside our legal retention obligations is deleted, destroyed or anonymised immediately, either on our own initiative or upon your request, in accordance with Amara Earth Art's Personal Data Retention and Destruction Policy. Destruction processes at the end of the service relationship are recorded and documented.
6. Your Rights under Article 11 of the KVKK
Pursuant to Article 11 of the KVKK, as a data subject whose personal data is processed you have the right to: • learn whether your personal data is processed, • request information if it has been processed, • learn the purpose of processing and whether the data is used in accordance with that purpose, • learn the third parties in Turkey or abroad to whom your personal data is transferred, • request rectification if it has been processed incompletely or inaccurately, • request erasure or destruction of your personal data where the conditions set out in the KVKK are met, • request that rectification, erasure or destruction be notified to third parties to whom the data has been transferred, • object to a result against you arising from analysis of the processed data exclusively by automated systems, • claim compensation if you suffer damage due to unlawful processing of your personal data. Under Article 13 of the KVKK, you may submit your requests in writing, together with information and documents verifying your identity, or in accordance with the other application procedures determined by the Personal Data Protection Board. Applications must be made in Turkish and may be sent to the data controller at info@amarasociety.com. Applications must include your name and surname, a signature for written applications, your national ID number (or nationality, passport number or identity number for foreign nationals), your address for notification, your e-mail address (if any), telephone or fax number, and the subject of your request. Duly submitted applications are concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. If the process requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Authority may be charged.