Privacy Notice
This Privacy Notice explains how The Goatz collects, uses, stores, transfers and protects personal data relating to visitors, customers, prospective customers and users of the website thegoatz.co.
This Privacy Notice applies to both domestic and international users of the Website, including customers located in Turkey and customers located outside Turkey. The Seller and data controller is established in the Republic of Turkey.
This Privacy Notice has been prepared in accordance with the Turkish Personal Data Protection Law No. 6698, also known as KVKK, and, where applicable, with international privacy rules such as the European Union General Data Protection Regulation, the United Kingdom General Data Protection Regulation and other mandatory privacy laws that may apply depending on the user’s country of residence.
Nothing in this Privacy Notice limits any mandatory privacy or consumer protection rights that cannot legally be waived under the laws of the user’s country of residence or the country of delivery.
1. Data Controller
Data Controller: Seçil TÜREDİ
Brand / Website: The Goatz / thegoatz.co
Tax Office: Çanakkale Tax Office
Tax Identification Number: 53659508922
MERSIS Number: Not applicable / not available
Registered Address: Medrese Sokak, No: 1, Office: 2
Fevzipaşa Mahallesi
17100 Çanakkale
Turkey
Email: [email protected]
Phone: +90 544 569 89 85
Registered Electronic Mail Address: [email protected]
2. Scope of This Notice
This Privacy Notice applies to personal data processed through the Website, online orders, customer communication, payment processes, shipping and delivery processes, return and refund processes, customs processes for international orders, marketing communications, customer support, legal compliance and security activities.
This Privacy Notice does not replace the Cookie Policy. Information about cookies, analytics technologies, advertising technologies and preference management is provided separately in the Cookie Policy and, where required, through the cookie consent tool on the Website.
3. Categories of Personal Data We Process
Identity data may include name, surname, customer account information, invoice information and, where necessary for legal or customs processes, identity-related information provided by the customer.
Contact data may include email address, phone number, billing address, delivery address and communication preferences.
Order and transaction data may include ordered products, product preferences, customization choices, order number, invoice details, payment status, delivery status, return and refund records, customer requests and correspondence regarding the order.
Payment data may include payment method, payment status, transaction reference, billing details and limited payment information required to confirm the transaction. Full card numbers and sensitive payment credentials are generally processed by secure third-party payment service providers and are not intentionally stored by the Seller.
Delivery, shipping and customs data may include recipient name, delivery address, phone number, email address, shipment tracking number, customs documentation information, customs declarations, delivery country, carrier records and information required by logistics companies, customs brokers or public authorities.
Customer communication data may include messages sent through email, contact forms, social media, customer support channels, return requests, complaint records and any information voluntarily shared by the customer.
Marketing data may include newsletter subscription status, marketing consent records, communication preferences, campaign interaction data and unsubscribe records.
Technical and usage data may include IP address, device information, browser type, operating system, log records, Website usage information, session information, cookie identifiers, analytics data and security records.
Legal and compliance data may include records required for tax, accounting, consumer law, commercial law, customs, dispute resolution, fraud prevention and regulatory compliance.
4. Special Categories of Personal Data
The Website is not designed to collect special categories of personal data such as health data, biometric data, genetic data, religious belief, political opinion, criminal conviction data or similar sensitive information.
Users should not share special categories of personal data through order notes, contact forms, gift notes, customization requests or customer support messages unless strictly necessary. If such information is voluntarily provided by the user, it may be processed only to the extent necessary to handle the relevant request, comply with legal obligations, establish, exercise or defend legal claims, or where explicit consent is required and obtained under applicable law.
5. Sources of Personal Data
Most personal data is collected directly from the user when the user visits the Website, creates an order, fills in checkout information, contacts the Seller, subscribes to communications, requests a return, files a complaint or otherwise interacts with the Website.
Some personal data may be received from third-party service providers such as payment service providers, cargo and logistics companies, customs brokers, marketplace or technology service providers, fraud prevention tools, analytics providers, email service providers and customer support tools.
Technical data may be collected automatically through cookies, server logs, analytics tools and similar technologies, subject to the Cookie Policy and applicable consent requirements.
6. Purposes of Processing Personal Data
Personal data may be processed to operate the Website and provide its basic functions.
Personal data may be processed to receive, confirm, process and deliver orders.
Personal data may be processed to prepare invoices, accounting records, export records and legally required transaction documents.
Personal data may be processed to process payments, confirm payment status, prevent fraud and manage refunds.
Personal data may be processed to ship products, provide delivery tracking, manage delivery issues and complete domestic or international logistics processes.
For international orders, personal data may be processed to prepare customs documents, share necessary information with carriers, logistics providers, customs brokers and competent public authorities, and complete export or import-related processes.
Personal data may be processed to manage returns, exchanges, withdrawal requests, defective product claims, damaged shipment claims, complaints and customer support requests.
Personal data may be processed to communicate with users about orders, products, policies, legal notices, service updates, support requests and customer satisfaction.
Personal data may be processed to send marketing communications, newsletters, campaigns and promotional messages where the user has given consent or where such communication is otherwise permitted by applicable law.
Personal data may be processed to improve the Website, understand customer preferences, measure Website performance, improve products and enhance user experience.
Personal data may be processed to ensure information security, prevent fraud, detect unauthorized access, protect the Website and maintain transaction security.
Personal data may be processed to comply with tax, accounting, commercial, customs, consumer protection, data protection and other legal obligations.
Personal data may be processed to establish, exercise or defend legal rights and to respond to requests from courts, public authorities, regulatory authorities or enforcement authorities.
7. Legal Bases for Processing
Under Turkish data protection law, personal data may be processed where processing is necessary for the establishment or performance of a contract, especially for receiving orders, processing payment, delivering products, managing returns and providing customer support.
Personal data may be processed where processing is necessary for the data controller to comply with legal obligations, including tax, accounting, invoice, customs, consumer protection, commercial recordkeeping and regulatory obligations.
Personal data may be processed where processing is necessary for the establishment, exercise or protection of a right, including dispute resolution, complaint handling, debt collection, fraud prevention and legal defense.
Personal data may be processed where processing is necessary for the legitimate interests of the Seller, provided that such processing does not harm the fundamental rights and freedoms of the data subject. This may include Website security, fraud prevention, service improvement, customer satisfaction analysis and business continuity.
Personal data may be processed based on explicit consent where consent is required by applicable law, including certain marketing communications, optional cookies, advertising technologies or international transfers where no other lawful transfer mechanism is available.
For users located in the European Economic Area or the United Kingdom, the corresponding legal bases may include performance of a contract, compliance with legal obligations, legitimate interests and consent under applicable GDPR or UK GDPR rules.
8. Marketing Communications
The Seller may send marketing emails, newsletters, campaign announcements, product updates and promotional messages only where the user has provided consent or where such communication is otherwise permitted by applicable law.
Users may withdraw marketing consent or unsubscribe from marketing communications at any time by using the unsubscribe link in the relevant message or by contacting [email protected].
Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal and does not prevent the Seller from sending transactional or legally required communications about orders, payments, delivery, returns, policy updates or security matters.
9. Cookies and Similar Technologies
The Website may use strictly necessary cookies to operate the Website, remember shopping cart content, provide security, enable checkout and maintain basic Website functions.
The Website may also use analytics, performance, functionality, advertising or targeting cookies where permitted by applicable law and, where required, based on user consent.
Users can manage cookie preferences through the cookie preference tool on the Website where available. Users may also control cookies through browser settings. Disabling certain cookies may affect Website functionality.
Detailed information about cookies, cookie categories, purposes, retention periods, third-party cookies and preference management is provided in the Cookie Policy.
10. Sharing of Personal Data
Personal data may be shared with payment service providers for payment processing, fraud prevention, refund processing and transaction security.
Personal data may be shared with cargo companies, logistics providers, delivery partners and shipment tracking service providers for delivery, return and shipment management.
For international orders, personal data may be shared with customs brokers, customs authorities, public authorities, cargo companies, logistics providers and other parties necessary to complete export, import, customs clearance, delivery or return processes.
Personal data may be shared with accountants, financial advisors, legal advisors, auditors, tax consultants and other professional service providers where necessary for legal, financial, accounting or compliance purposes.
Personal data may be shared with technology service providers, hosting providers, email service providers, customer support tools, analytics providers, security providers and other infrastructure service providers used to operate the Website and provide services.
Personal data may be shared with courts, enforcement offices, public institutions, regulatory authorities, law enforcement authorities and other competent authorities where required by law or where necessary to establish, exercise or defend legal rights.
The Seller does not sell personal data in the ordinary meaning of selling customer lists for money. If any activity is considered a sale, sharing or targeted advertising under a specific privacy law, the user may exercise applicable opt-out rights as described in this Privacy Notice.
11. International Transfers of Personal Data
Because the Seller is established in Turkey and sells to customers in Turkey and abroad, personal data may be transferred to, stored in or accessed from Turkey and other countries depending on the user’s location, the delivery country and the service providers used.
For international orders, personal data may be transferred from Turkey to the delivery country or to other countries where carriers, logistics providers, customs brokers, payment providers, technology providers or other necessary service providers are located.
For users located outside Turkey, personal data provided through the Website may be transferred to Turkey because the Seller is established in Turkey and order management, customer support, invoicing, return handling and legal compliance are carried out from Turkey.
International transfers may be carried out where necessary for the performance of the contract with the user, for the establishment, exercise or defense of legal rights, for compliance with legal obligations, based on explicit consent where required, or by using appropriate safeguards such as standard contractual clauses, standard contracts, binding corporate rules, adequacy mechanisms or other lawful transfer tools available under applicable data protection laws.
Where Turkish data protection law requires a specific mechanism for transferring personal data abroad, the Seller will use an applicable lawful mechanism such as adequacy decisions, appropriate safeguards, standard contracts, binding corporate rules, explicit consent or statutory exceptions, as applicable to the relevant transfer.
12. Retention of Personal Data
Personal data is retained only for as long as necessary for the purposes for which it is processed and for the periods required or permitted by applicable law.
Order, invoice, accounting, tax, customs and commercial records may be retained for the statutory retention periods required under applicable legislation.
Customer support, complaint, return and dispute records may be retained for the period necessary to handle the request and to establish, exercise or defend legal rights.
Marketing consent records may be retained for as long as necessary to prove consent, manage preferences and comply with legal obligations.
Technical logs and security records may be retained for periods necessary for security, fraud prevention, troubleshooting and legal compliance.
When the retention period expires or when processing is no longer necessary, personal data will be deleted, destroyed or anonymized in accordance with applicable law, unless further retention is required for legal reasons.
13. Data Security
The Seller takes reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, disclosure or destruction.
These measures may include access controls, secure payment infrastructure, data minimization, service provider controls, confidentiality measures, secure communication tools, backup measures and transaction security controls.
No online service can be guaranteed to be completely secure. Users are responsible for keeping their own account, device, email and password information secure.
14. Rights of Users Located in Turkey
Under Turkish personal data protection law, data subjects may have the right to learn whether their personal data is processed, request information if their personal data has been processed, learn the purpose of processing and whether the data is used in accordance with that purpose, know the third parties to whom personal data is transferred domestically or abroad, request correction of incomplete or inaccurate data, request deletion or destruction under the conditions set out by law, request notification of correction, deletion or destruction to third parties to whom the data has been transferred, object to unfavorable results arising from analysis exclusively by automated systems, and request compensation for damages in case of unlawful processing.
Users located in Turkey may submit requests regarding these rights by contacting [email protected] or [email protected]. The request should include information sufficient to verify the identity of the requester and clearly describe the requested action.
15. Rights of Users Located in the European Economic Area or the United Kingdom
Where the GDPR or UK GDPR applies, users may have the right to access personal data, request rectification, request erasure, request restriction of processing, object to processing, request data portability, withdraw consent where processing is based on consent, and lodge a complaint with a competent supervisory authority.
Where processing is based on legitimate interests, users may object to such processing based on their particular situation. Where personal data is processed for direct marketing, users may object to direct marketing at any time.
Users may exercise these rights by contacting [email protected]. The Seller may request information necessary to verify the identity of the requester before responding.
16. Rights of Users Located in Other Countries
Users located in other countries may have additional privacy rights under their local laws. These may include the right to access, correct, delete, restrict, object to processing, withdraw consent, request portability, opt out of certain disclosures, opt out of targeted advertising or complain to a competent authority, depending on the applicable law.
For California residents, where the California Consumer Privacy Act as amended by the California Privacy Rights Act applies, users may have rights to know, access, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information and not be discriminated against for exercising privacy rights.
The Seller does not knowingly sell personal data for money. If any processing activity is considered a sale or sharing under applicable California privacy law, California residents may contact [email protected] to exercise applicable opt-out rights.
For users located in jurisdictions with privacy laws similar to the GDPR, the Seller will assess and respond to rights requests in accordance with applicable mandatory law.
17. How to Submit a Privacy Request
Users may submit privacy requests by contacting [email protected] or [email protected].
The request should include the user’s full name, contact information, country of residence, relationship with the Website, order number if applicable, and a clear description of the requested action.
The Seller may request additional information to verify the identity of the requester and to prevent unauthorized access to personal data.
The Seller will respond to requests within the period required by applicable law. If a request is complex, repeated, unfounded, excessive or requires additional verification, the response period or the way the request is handled may vary as permitted by applicable law.
18. Children’s Privacy
The Website is not intended for children and is not designed to knowingly collect personal data from children.
If a parent or guardian believes that a child has provided personal data through the Website without appropriate consent, they may contact [email protected] to request deletion or appropriate action.
19. Automated Decision-Making
The Seller does not intentionally make decisions that produce legal or similarly significant effects based solely on automated processing of personal data.
Fraud prevention, payment security, analytics or Website security tools may use automated signals to help detect suspicious activity, protect transactions and maintain service security.
20. Third-Party Links and Services
The Website may contain links to third-party websites, payment pages, cargo tracking pages, social media platforms or other external services.
The Seller is not responsible for the privacy practices, security measures or content of third-party websites and services. Users should review the privacy notices of third-party services before providing personal data to them.
21. Updates to This Privacy Notice
The Seller may update this Privacy Notice from time to time due to legal, technical or operational changes.
The updated version will be published on the Website. Where required by applicable law, users may be notified through appropriate channels or asked to provide renewed consent.
22. Contact
For questions, requests or complaints regarding this Privacy Notice or the processing of personal data, users may contact the Seller through the following channels.
Email: [email protected]
Phone: +90 544 569 89 85
Registered Electronic Mail Address: [email protected]
Address: Medrese Sokak, No: 1, Office: 2
Fevzipaşa Mahallesi
17100 Çanakkale Turkey