Legal
KVKK Privacy Notice
This is an English translation provided for information. The binding version of this document is the Turkish original.
As KobiZeka™ Teknoloji Yazılım Eticaret ve Danışmanlık Hizmetleri (“YupCase”), acting as data controller under Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”), we hereby inform you which of your personal data we process through yupcase.com, for what purposes and on what legal grounds, to whom we transfer them, and of your rights.
1. Data controller
| Trade name | KobiZeka™ Teknoloji Yazılım Eticaret ve Danışmanlık Hizmetleri |
|---|---|
| Brand / website | YupCase · yupcase.com |
| Head office address | Kırmızıtoprak Mahallesi, Porsuk Bulvarı, Nilay Sokak, Emin Apartmanı No: 11/B, Odunpazarı, 26020 Eskişehir |
| Production and returns address | Beylikdüzü OSB, 13. Cd. Laleli İş Merkezi D:22 Kat:1, 34520 Beylikdüzü/İstanbul |
| Tax office / tax no. | Eskişehir V.D. / 9490302446 |
| Telephone | +90 531 626 96 30 |
| destek@yupcase.com |
2. Personal data processed, purposes and legal grounds
| When | Which data | Purpose | Legal ground (KVKK Art. 5) |
|---|---|---|---|
| When you place an order | Full name, mobile phone number, email, province, district, full address; order contents and the name/number you have printed on the case | Receiving the order, producing and delivering the product, invoicing, order and shipping notifications | Establishment and performance of the contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| When you make a payment | Payment result and payment transaction number. Your card details are transmitted only to the payment institution and are not stored by us. | Taking payment, refund transactions | Performance of the contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| When you prepare a case with “Design your own” | The combined design image made up of the photo you upload and the text you write (the original photo file is not sent to our server; information such as the location in the photo is not carried over to the design image) | Producing the case, visual check before printing | Establishment and performance of the contract (Art. 5/2-c) |
| When you write a review of a case you have received | Star rating, review text, photos you add (saved again with photo information, including location, removed), the name to be shown on the site (your first name and the initial of your surname, e.g. “Ayşe Y.”; or, if you prefer, only “YupCase customer”), which case and phone model the review was written for; IP address and browser information at the time of the review | Publishing the review, after it has been checked, as a “Verified buyer” review on the relevant case's page on the site; showing that it belongs to a real buyer and preventing misuse | Explicit consent (Art. 5/1): the consent checkbox on the review form; legitimate interest (Art. 5/2-f) for the IP address and browser information |
| During ordering and payment | IP address, browser information, time of the transaction | Preventing fraud and misuse, transaction security, evidence in the event of a dispute | Legitimate interest (Art. 5/2-f); establishment and protection of a right (Art. 5/2-e) |
| When you chat with live support | The messages you write; your name or phone number if you write them (including "leave your phone number" while we are offline); the link between the chat and your visit in the on-site visit statistics (which step you are at, the phone you have selected, your cart); the first part of your IP address | Answering your question, helping you with your order, getting back to you | Establishment of the contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| In the “Leave a message” form | Name, email or phone number, subject, message content | Responding to your request | Legitimate interest (Art. 5/2-f); establishment of the contract (Art. 5/2-c) |
| When you turn on notifications (bell button) | The notification subscription address provided by your browser, device type (Android / iPhone / computer) and browser information; whether a notification sent has reached your device and whether it has been opened. No name, phone number or email is collected. | Sending new designs, campaigns and announcements as notifications | Explicit consent (Art. 5/1): the browser's permission window; can be withdrawn at any time via the bell button or your browser settings |
| When you arrive via a dealer's (shop's) QR code | Dealer code (in the yc_bayi cookie in your browser); which dealer the order was placed through; for a dealer order whose payment has been received, the association of your mobile phone number with that dealer; if you have chosen collection from the shop, the collection shop and the time the package was handed to you | Applying the dealer discount, calculating the dealer's commission (including subsequent orders you place with the same phone number), handing the package to you at the shop | Establishment and performance of the contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| When you apply to become a dealer (shop owners) | Shop name and type, full name of the authorised person, mobile phone number, email, province, district, address, application note; if you become a dealer, IBAN for commission payments; IP address and browser information at the time of application; a hash of the password for logging in to the dealer panel (the password itself is not stored) and the time of the last login | Evaluating the application, establishing and conducting the dealership relationship, calculating and paying commission, security of the dealer panel account | Establishment and performance of the contract (Art. 5/2-c); legal obligation (Art. 5/2-ç); legitimate interest (Art. 5/2-f) |
| When tracking an order | Order number and mobile phone number | Verifying that the order belongs to you | Performance of the contract (Art. 5/2-c) |
| While using the site | Session cookie, IP address and server access logs | Secure operation of the site, form security, limiting repeated attempts | Legitimate interest (Art. 5/2-f) |
| While browsing the site (on-site visit statistics) | A random visitor ID created in your browser and the number of visits; pages opened and the shopping steps on the home page, the phone model selected, the number of cases in the cart and their amount, the design added to the cart, time spent on the page; source of the visit (referring site, campaign tag); device type, browser, operating system, screen size and device language; approximate location derived from the IP address (country/city; only the first part of the IP address is stored); if an order was placed, which order the visit turned into | Improving the site and the shopping steps, being able to help visitors in good time, measuring the effectiveness of promotional channels, showing the number of people currently on the site (without identifying anyone) | Legitimate interest (Art. 5/2-f) |
| If you give consent in the cookie banner | Cookie IDs, pages visited and on-site interactions, source of the visit and campaign information, device and browser information, approximate location derived from the IP address (country/city); when an order is completed, the order number, amount and products (excluding name, contact and address information) | Measuring site usage and purchases, measuring advertising performance, audience targeting and personalisation in Google ads (Google Analytics, Google signals) | Explicit consent (Art. 5/1) |
| If you do not give consent | Limited measurement signals that do not identify you, sent without using cookies (page view, time, browser type) | Aggregate visit statistics (Google Consent Mode) | Legitimate interest (Art. 5/2-f) |
Your personal data are not processed for advertising or profiling purposes, except as stated above subject to your cookie consent; no promotional emails or SMS messages are sent to you.
3. Method of collection
Your data are collected electronically, directly from you, through the order, payment, order tracking, review, contact and dealer application forms on the site and through live support; IP addresses and access logs are collected automatically by the server, and the on-site visit statistics automatically from the information that your browser sends only to our server while you browse the site. The visit statistics are not shared with third parties; location is determined from the location database on our server (your IP address is not sent to anyone for this purpose).
4. Parties to whom data are transferred
- Payment institution: iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) — name, email, phone number, address, IP address and card details, for taking payment, 3D Secure verification and fraud checks.
- Shipping: The shipping intermediary service (Basit Kargo) and the selected courier company — name, phone number, email and address, for delivery.
- Hosting and email service providers: The servers on which the site and emails run.
- Certified public accountant and e-invoice service provider: Issuing invoices and statutory bookkeeping obligations.
- Dealers: For orders placed via a dealer's QR code or linked to that dealer, only the order number, date, number of cases and amount, for calculating commission. Your phone number, email and address are not shared with the dealer. If you choose "Collect from the shop", the dealer additionally sees your first name and the initial of your surname (e.g. "Ayşe Y.") so that the package can be handed to you; your order is sent by courier to that shop's address.
- Authorised public institutions and organisations: Where requested as required by legislation.
- Google LLC (Google Analytics, Google ads): If you give consent, site usage, purchase and advertising measurement data; if you do not give consent, only cookieless measurement signals that do not identify you. No name, phone number, email, address or order tracking key is sent.
Because the fonts on the site are loaded from the Google Fonts service, your IP address and browser information are transmitted to Google LLC servers when you open a page. If you choose to write to our WhatsApp line, your messages are transmitted via the WhatsApp (Meta) infrastructure. If you turn on notifications, the notification signal is transmitted via your browser's notification service (Google, Apple, Mozilla or Microsoft); the text of the notification is not sent to these services, and your device retrieves it directly from our site. Google Analytics data are processed abroad (USA) by Google LLC; this transfer is based on the explicit consent you give in the cookie banner, and you can withdraw your consent at any time via the “Cookie preferences” link at the bottom of the page.
5. Retention periods
- Order, invoice and payment records: for the period prescribed by tax and commercial legislation (10 years).
- Messages sent through the “Leave a message” form: 2 years from the conclusion of the request.
- Live support conversations: 2 years from the last message.
- “Design your own” images: those that do not turn into an order, after 30 days; those that turn into an order, together with the order records.
- Dealer applications: rejected applications, 1 year; in a dealership relationship, the information for the duration of the relationship, and commission and payment records for 10 years after the relationship ends.
- The link between a customer and a dealer (phone number and dealer): for the duration of the dealership relationship; deleted when the relationship ends.
- Notification subscription: until you turn off notifications or your browser ends the subscription; deleted thereafter.
- Reviews and their photos: for as long as they remain published or until you withdraw your explicit consent and request their deletion; unpublished (rejected) reviews are deleted after 1 year. The IP address and browser information recorded at the time of the review are deleted after 2 years.
- Security and access logs: up to 2 years.
- On-site visit statistics: 60 days (for a visit that turned into an order, the link to the order is also deleted at the end of this period).
- Session cookie: when you close your browser or after 2 hours of inactivity.
- Google Analytics: cookies, 2 years; statistical data are kept in the Google Analytics account for a maximum of 14 months.
When the period expires, your data are deleted, destroyed or anonymised.
6. Your rights (KVKK Art. 11)
You have the right to learn whether your personal data are processed; to request information if they have been processed; to learn the purpose of the processing and whether they are used in accordance with that purpose; to know the third parties to whom they are transferred domestically or abroad; to request their rectification if they are incomplete or inaccurately processed, and their erasure or destruction within the framework of the conditions set out in Article 7 of the KVKK, and to request that these operations be notified to the third parties to whom they have been transferred; to object to any result to your detriment arising from their analysis exclusively by automated systems; and to claim compensation if you suffer damage as a result of unlawful processing.
7. Application
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests in writing to Kırmızıtoprak Mahallesi, Porsuk Bulvarı, Nilay Sokak, Emin Apartmanı No: 11/B, Odunpazarı, 26020 Eskişehir or by email from your email address registered in our system to destek@yupcase.com. Your application will be concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee schedule determined by the Personal Data Protection Board may be applied.