CUSTOMER LOYALTY MEMBERSHIP PRIVACY NOTICE
We kindly ask you to read the Privacy Notice below in order to review in detail the purposes for which we process your personal data and your rights in this regard.
a) Identity of the Data Controller
Pursuant to the Personal Data Protection Law No. 6698 (“KVKK”) and the European Union General Data Protection Regulation (“GDPR”), your personal data will be processed by BESTSELLER BİRLEŞİKTEKSTİL TOPTAN VE PERAKENDE TİC. LTD. ŞTİ. (the “Company”), acting as the data controller, and in the event that such data is updated, it will continue to be processed for the same purposes.
b) Purposes of Processing Personal Data, Collection Methods and Legal Grounds
Within the scope of your Loyalty Club membership, for the purposes of creating and managing your membership and enabling you to benefit from club advantages, your identity information (name, surname), contact information (e-mail address), and demographic information (date of birth, gender), which are provided by you through the membership form and user profile and collected through non-automated means;
are processed on the legal basis that processing is directly related to the establishment or performance of a contract pursuant to Article 5(2)(c) of the KVKK and Article 6(1)(b) of the GDPR, and will be retained for a period of 3 years following the termination of your membership.
For the purposes of sending commercial electronic communications (SMS, e-mail, phone calls, etc.) regarding campaigns, promotions, benefits and opportunities specific to the Loyalty Club membership; conducting customer satisfaction surveys; sending event invitations; and providing personalized campaigns and content by taking into account your gender, date of birth, purchase history and areas of interest;
your contact information (e-mail address, telephone number) and your demographic and behavioral data provided by you;
are processed based on your explicit consent pursuant to Article 5(1) of the KVKK and Article 6(1)(a) of the GDPR and will be retained for a period of 3 years following the withdrawal of your consent.
For the purpose of facilitating shopping processes and providing you with personalized benefits within the scope of the Loyalty Club membership, your identity information (if available, tax identification number) and contact information (telephone number, address) provided through your user profile;
are processed pursuant to Article 5(2)(f) of the KVKK and Article 6(1)(f) of the GDPR on the basis of the legitimate interests of the data controller and will be retained for a period of 3 years following the termination of your membership.
The date of birth information processed for the purpose of verifying users’ age eligibility;
is additionally processed pursuant to Article 5(2)(ç) of the KVKK and Article 6(1)(c) of the GDPR for the purpose of fulfilling legal obligations and will be retained for a period of 3 years following the termination of your membership.
For the purpose of enabling purchases without the need to re-enter membership information, your Identity Information (Tax Identification Number) and Contact Information (Telephone Number, Address), which are collected through non-automated means based on the information you provide by completing the electronic form available in the Personal Information and Delivery Addresses sections of the User Profile;
will be processed pursuant to Article 5(2)(f) of the KVKK and Article 6(1)(f) of the GDPR on the legal basis that “processing is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject,” and will be retained for a period of 3 years following the closure of your user account.
For the purpose of verifying the legal age eligibility of users to carry out transactions, your Identity Information (Date of Birth), collected through non-automated means based on the information you provide by completing the electronic form available in the Personal Information section of the User Profile;
will be processed pursuant to Article 5(2)(ç) of the KVKK and Article 6(1)(c) of the GDPR on the legal basis that “processing is necessary for the data controller to fulfill its legal obligations” and will be retained for a period of 3 years following the closure of your user account.
c) To Whom and For What Purposes Your Processed Personal Data May Be Transferred
Your personal data may be transferred to third parties located domestically or abroad.
Your Identity Information (Name, Surname, Tax Identification Number) and Contact Information (Telephone Number, E-mail Address, Address);
in the event of an order being placed, may be shared with the Company's Operations and Support Units and with our domestic suppliers for the purposes of carrying out packaging, shipping, other operational processes and business development processes, based on Article 6(1)(b) of the GDPR and Article 5(2)(c) of the KVKK, namely “being necessary for the performance of a contract”;
with our shareholder company located abroad due to the website infrastructure being provided by the shareholder company, based on Article 6(1)(f) of the GDPR and Article 5(2)(f) of the KVKK, namely “processing being necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject”;
and with our supplier located abroad due to the website being hosted on cloud servers located outside Türkiye, based on Article 6(1)(a) of the GDPR and Article 5(1) of the KVKK, namely “your explicit consent”.
In addition, your Contact Information (Telephone Number, E-mail Address);
may be shared with our domestic suppliers for the purposes of ensuring İYS integration and compliance with the Regulation on Commercial Communication and Commercial Electronic Messages numbered 29417, based on Article 6(1)(c) of the GDPR and Article 5(2)(ç) of the KVKK, namely “processing being necessary for the data controller to fulfill its legal obligation”;
and with our suppliers located abroad due to the servers of the service provider carrying out advertising notification activities being located abroad, based on Article 6(1)(f) of the GDPR and Article 5(2)(f) of the KVKK, namely “processing being necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject”.
d) Information Regarding Your Rights Under the KVKK and GDPR as a Personal Data Subject
As a personal data subject, you may exercise your rights under Article 11 of the KVKK (Communiqué on the Procedures and Principles of Application to the Data Controller) and Chapter III of the GDPR as follows:
Access Your Data: If you are a registered user, you may access your personal data through the relevant section of your online account.
Correct Your Data: You may correct incomplete or inaccurate information through your account.
Delete Your Data: You may request the deletion of your personal data that is no longer necessary or lacks a legal basis.
Restriction of Processing: You may request the temporary suspension or restriction of the processing of your data.
Withdraw Your Consent: You may withdraw your consent to the processing of your data at any time.
Stop Sharing for Advertising Purposes: You may restrict information sharing with third parties through your device and browser settings or submit your request to us.
Data Portability: You may request the transfer of your personal data to another institution.
Object to Processing: You have the right to object to processing carried out on the basis of legitimate interests.
To exercise these rights, you may submit your requests in writing by post to:
Yıldız Çiçeği Sokak No:10 Etiler-Beşiktaş, 34337 İSTANBUL / TÜRKİYE
or send them via e-mail to: