KVKK Privacy Notice & Cookies

Scope

TONYUKUK YAZILIM BİLİŞİM İTHALAT İHRACAT VE SANAYİ TİCARET LİMİTED ŞİRKETİ, at SARIYER / İSTANBUL, is the data controller. This notice covers data processed during site visits, accounts and social sign-in, favourites, ordering, payment, delivery, support, returns, technical storage, and commercial electronic communications. Any consent required for a separate activity is presented separately from this notice.

Personal data processed

• Identity and contact data: name, surname, telephone, email, delivery address, and billing address.
• Account data: user number, preferred language, social sign-in provider, and provider account identifier.
• Order and customer-transaction data: cart, favourites and recently viewed products, order items and amounts, payment method/status, delivery, cancellation, return, support, and dispute records.
• Financial data: invoice/accounting details, payment references, and limited card metadata returned by the payment institution, such as the first six/last four digits and card type. The full card number and security code are processed by the payment institution and are not stored in the seller's systems.
• Security data: IP address, estimated country, session identifiers, device/browser, timestamps, errors, and security records.
• Marketing data: channel preferences, approval/refusal records, and communication history.

Purposes and legal grounds

• Account, cart, order, payment, delivery, return, and support processing under Article 5/2-c of Law No. 6698 where directly necessary to enter into or perform a contract.
• Invoices, accounting, e-commerce records, consumer-law duties, and authority requests under Article 5/2-ç where necessary to comply with a legal obligation.
• Security, abuse/fraud prevention, service improvement, and legal claims under Article 5/2-e or 5/2-f where applicable and without prejudicing fundamental rights.
• Commercial messages under the approval or exception rules in Law No. 6563 and, where no other personal-data condition applies, separately obtained explicit consent.

Collection method

Personal data is collected electronically by automated or partly automated means through site forms, account and order activity, support channels, cookies, and service providers.

Recipients, transfers, and retention

Necessary data may be disclosed, for the stated purpose only, to payment institutions and banks for payment/refunds; carriers for delivery; accounting providers and authorities for financial duties; hosting, database, email, and security suppliers; the selected social sign-in provider; advisers, courts, and competent authorities for requests or disputes.

Actual international transfers and the safeguard used under Article 9 of Law No. 6698: [PLACEHOLDER: ACTUAL INTERNATIONAL DATA TRANSFERS AND ARTICLE 9 SAFEGUARDS, OR STATE THAT NO TRANSFER OCCURS]. A foreign supplier is used only where a valid adequacy decision, appropriate safeguard, or statutory exception applies.

Order, contract, and e-commerce records are retained for at least three years; accounting documents for the applicable tax/commercial period; account, support, security, and approval/refusal data only for the purpose, legal duty, and relevant limitation periods. Expired data is deleted, destroyed, or anonymised unless another lawful ground applies.

Data-subject rights

Requests concerning Article 11 rights may be submitted through the site's contact form or contact@nevlight.com, together with information sufficient to verify identity and the request. They are resolved as soon as possible and no later than 30 days, normally free of charge. Statutory complaint rights before the Turkish Personal Data Protection Board remain available.

Account and data deletion

To request deletion of an account created through Facebook or another method and its associated personal data, email contact@nevlight.com with the subject “Account and Data Deletion Request.”

• Include the email address associated with the account and, if applicable, the sign-in method used.
• Additional information may be requested to verify account ownership.
• After verification, the account, social sign-in links, and data no longer required are deleted or anonymised.
• Order, payment, invoice, and dispute records that must legally be retained remain only for the mandatory retention period and are then deleted or anonymised.
• Confirmation is sent to the email address used for the request when deletion is complete.

Strictly necessary cookies we use

• Language preference: remembers the selected site language for up to one year.
• Guest cart: preserves products added without signing in for up to 30 days.
• Account session: securely maintains a signed-in session for up to six months.
• Social sign-in security: verifies a sign-in request and is deleted after approximately 10 minutes.
• Guest receipt access: securely opens a guest order's success page for up to two hours.

Browser local storage

• Checkout draft: keeps the name, email, telephone, city, and address only on the user's device until checkout, a cart change, or browser-data removal.
• Recently viewed and favourite products: keeps product identifiers on the device for personalisation and synchronisation until browser data is cleared.

Optional cookies

We do not use cookies to directly identify visitors or for advertising, retargeting, or personal profiling. We use only strictly necessary cookies for authorization and essential site functions, plus Google Analytics cookies for aggregate visit statistics.

Third-party necessary cookies

When payment or social sign-in is used, the relevant provider may set session cookies that are necessary to secure and complete that transaction. These cookies are not placed when the corresponding feature is not used.

Commercial electronic communications

Unless a legal exception applies, campaign and marketing messages are sent by email, SMS, or telephone only after prior approval for that channel. Contact details, channel preferences, consent and refusal records, and communication history may be processed for this purpose.

Commercial communication preferences

Approval can be withdrawn at any time through the free refusal method in a message, the site's contact form, contact@nevlight.com, or the Turkish Message Management System (IYS). Messages are stopped within the statutory period after refusal.