This English version is provided for information. In case of any discrepancy, the Turkish version prevails.
This notice is provided by REGAS CRAFT Deri Ürünleri (“REGAS CRAFT”) as data controller under article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Obligation to Inform. It covers visitors to our site, members, customers, newsletter subscribers, people who contact us and people named as delivery recipients.
1. Data controller
- Legal name: REGAS CRAFT Deri Ürünleri
- Brand / trading name: REGAS CRAFT
- Address: Esentepe Mah. Antalya Sk. No: 6/A, Melikgazi / Kayseri
- Phone: +90 505 818 86 88
- Email: info@regascraft.com
- Registered e-mail (KEP): [to be set in settings]
- MERSIS number: [to be set in settings]
- Tax office / tax number: [to be set in settings] / [to be set in settings]
- Website: https://regascraft.com
2. Categories of personal data
| Category | Data |
|---|---|
| Identity | First and last name; national ID number where required by law for individual invoices |
| Contact | Email address, phone number, delivery and billing address |
| Customer transactions | Orders, basket and favourites; return, exchange and request records; personalisation texts; gift notes; order notes; product reviews; contact form messages |
| Finance | Payment amount, method, instalments, payment institution transaction reference, IBAN provided for refunds. Card number, expiry date and security code are not processed by REGAS CRAFT; they are collected directly by the payment institution. |
| Legal transactions and compliance | Invoice details; for company buyers, company name, tax office and number; pre-contract information, contract and consent records; correspondence |
| Transaction security | IP address, session ID, access and activity logs, browser/device data, one-way password hash |
| Marketing | Consent and opt-out records for marketing messages, newsletter subscription, campaign and coupon use, referral source; with your consent, usage data collected by analytics and advertising cookies |
We do not process special categories of personal data (health, religion, ethnicity, etc.). Please do not include such data in personalisation texts, order notes or messages. Our site is not intended for anyone under 18.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Conclusion and performance of a contract (KVKK art. 5/2-c) |
| Taking orders, collecting payment, delivery and order notifications (email/SMS) | Conclusion and performance of a contract (art. 5/2-c) |
| Withdrawal, returns, exchanges and defective goods | Performance of a contract (art. 5/2-c), legal obligation (art. 5/2-ç) |
| Invoicing, tax and accounting records | Legal obligation (art. 5/2-ç) |
| Keeping pre-contract information, distance contract, withdrawal and delivery records | Legal obligation (art. 5/2-ç) |
| Customer service, answering requests and complaints | Performance of a contract (art. 5/2-c), legitimate interest (art. 5/2-f) |
| Information security, preventing misuse and fraud, keeping access logs | Legal obligation (art. 5/2-ç), legitimate interest (art. 5/2-f) |
| Responding to authorities and protecting our rights in disputes | Legal obligation (art. 5/2-ç), establishment, exercise or defence of a right (art. 5/2-e) |
| Publishing product reviews on the site | Data made public by you (art. 5/2-d), legitimate interest (art. 5/2-f) |
| Sending newsletters, campaigns and other marketing messages | Explicit consent (art. 5/1) and approval under article 6 of Law No. 6563 |
| Analytics, ad measurement and remarketing (cookies) | Explicit consent (art. 5/1) |
| Improving the site and services (anonymous statistics) | Legitimate interest (art. 5/2-f) |
We ask for your explicit consent only for marketing messages, analytics/marketing cookies and related transfers abroad; not giving consent does not prevent you from ordering or creating an account.
4. How we collect data
Through the account, checkout, contact, newsletter and return forms, the My Account page, cookies and similar technologies (Cookie Policy), email, phone and messaging channels, and transaction results from payment institutions and carriers (payment approval, delivery status) — electronically, by automated or partly automated means.
5. Recipients
| Recipient group | Purpose | Data shared |
|---|---|---|
| Couriers and logistics companies | Delivery, returns and tracking | Name, address, phone, order number |
| Payment institution ([to be set in settings]) and banks | Payment, instalments, refunds, fraud prevention | Name, email, phone, address, basket total, IP address |
| E-invoice service provider and the Revenue Administration | Issuing and delivering invoices | Identity, contact, invoice and order data |
| SMS and email delivery providers | Order notifications; marketing messages if you consented | Name, phone, email, message content |
| Commercial Message Management System (İYS) | Recording consents and opt-outs | Phone, email, consent status |
| Hosting, server, backup and IT support providers | Running the site and storing data securely (as data processors) | Data processed on the site |
| Analytics and advertising providers | Measurement and advertising, only with cookie consent | Cookie IDs, page interactions, device data |
| Accountants and legal advisers | Legal obligations, protecting rights | Relevant records |
| Authorised public bodies, courts, consumer arbitration committees | Legal obligations and requests | Data requested |
Transfers rely on the legal bases in article 8 of the KVKK as listed above and are limited to the purpose.
6. Transfers abroad
Some of our providers may have servers abroad: email infrastructure, content delivery and security services, and — if enabled on the site and only with your consent — analytics and advertising tools such as Google Analytics, Google Ads and Google Tag Manager (Google), the Meta Pixel (Meta), Microsoft Clarity (Microsoft), the TikTok Pixel (TikTok) and Yandex Metrica (Yandex).
Transfers abroad comply with article 9 of the KVKK as amended by Law No. 7499 and the Regulation on Transfers of Personal Data Abroad: they rely on an adequacy decision for the destination country where one exists, otherwise on appropriate safeguards such as the standard contracts announced by the Board. Where no appropriate safeguard can be provided, transfers are made only occasionally and on the basis of your explicit consent after you have been informed of the possible risks. Your consent to analytics and marketing cookies also covers the transfer to these tools’ servers abroad; those countries may not offer the same level of protection and remedies as Türkiye. You can withdraw your consent at any time via “Cookie preferences”.
7. Retention
| Data | Period |
|---|---|
| Order, invoice and accounting records | 10 years (Tax Procedure Law, Turkish Commercial Code) |
| Pre-contract information, distance contract, withdrawal and delivery records | At least 3 years (Distance Contracts Regulation art. 20); 10 years where they are commercial documents |
| Marketing consent and opt-out records | 3 years from the date the consent ends |
| Customer account | For as long as you are a member; after closure, only records we must keep by law |
| Customer service and contact form correspondence | 3 years after the request is closed |
| Transaction security and access logs | 2 years |
| Guest baskets | 60 days |
| Product reviews | While published; removed on request |
| Cookies and browser storage | As stated in the Cookie Policy |
When the period ends, data is deleted, destroyed or anonymised in the next periodic destruction run (within six months at the latest) under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Records needed to protect rights in possible disputes may be kept for the relevant limitation periods.
8. Your rights
Under article 11 of the KVKK you may apply to REGAS CRAFT to:
- learn whether your personal data is processed,
- request information if it is,
- learn the purpose of processing and whether data is used accordingly,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction under the conditions of article 7,
- request that correction, deletion or destruction be notified to recipients,
- object to a result against you arising exclusively from automated analysis,
- claim compensation for damage caused by unlawful processing.
You may withdraw your explicit consent at any time with effect for the future.
9. How to apply
In line with the Communiqué on Applications to the Data Controller, you may send your request:
- as a signed letter to Esentepe Mah. Antalya Sk. No: 6/A, Melikgazi / Kayseri,
- by registered e-mail (KEP) to [to be set in settings],
- with a secure electronic or mobile signature, or from the email address registered with us, to info@regascraft.com.
Your application must include your name, signature (for written applications), national ID number (for foreigners, nationality and passport/ID number), address for notifications, email and phone if any, and your request. Requests are concluded free of charge as soon as possible and within 30 days at the latest; if the action involves an additional cost, the fee set by the Board may be charged.
If your request is rejected, you find the answer insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application (KVKK art. 14).
10. Changes
This notice is updated as the law or our processing changes. The current version is always published on this page.
Last updated: 31 October 2026 · Version 2
