Privacy Notice

Last updated: 5 October 2026

1. Data controller

Özlem Kaya (sole proprietor), operating under the CharmaCitta brand, is the controller for personal data used in the store’s customer relations and sales activities.

Address: Fetih Mah. Tahralı Sk. Esin Sitesi A2 Blok No: 2 İç Kapı No: 13 Ataşehir / Istanbul, Türkiye
Contact: charmacitta@gmail.com

This notice explains personal data processing. Reading it, visiting the site or placing an order does not by itself provide marketing permission or explicit consent.

2. Information, purposes and legal grounds

• Contact and support: the name, email address, message and relevant order details you provide through the form or email are used to answer questions and handle enquiries and returns. Under Türkiye’s Personal Data Protection Law, contractual enquiries rely on Article 5(2)(c), rights-related requests on 5(2)(e), and other customer correspondence on legitimate interests under 5(2)(f), subject to protection of fundamental rights.
• Orders, delivery and invoices: recipient, contact, billing/delivery address, product, quantity, price and transaction records supplied during a transaction are processed to enter into and perform the sale under 5(2)(c), and to meet mandatory recordkeeping and invoicing duties under 5(2)(ç).
• Accounts and technical information: if you use an account, account/order links are processed; visits may generate session, device/browser, access and security records in Shopify infrastructure. These support service operation, sessions, carts and prevention of misuse. Relevant grounds are service performance and security interests that do not override fundamental rights, under 5(2)(c) and 5(2)(f).

Optional marketing or another purpose requiring consent cannot be made compulsory solely through this notice. Do not send card numbers, CVV codes, passwords or identity documents in support messages.

3. Collection and service providers

Information is collected through web forms, email, account/order interactions, technical logs and cookies. Shopify supplies the store, form, cart and account infrastructure. Email correspondence uses Google’s Gmail service. Relevant contact, transaction or technical information is shared with these services to carry out the corresponding function.

When a shipment is prepared, the necessary recipient and address details are shared with its carrier. When a payment is made, information necessary for the transaction is shared with the payment service used. Records may be disclosed to authorised public bodies and authorised parties carrying out legal duties where required by law. Disclosure is limited to the relevant purpose.

4. Cookies and choices

Shopify infrastructure may use cookies for carts, sessions, language/region preferences and security, as well as platform reporting and usage-analysis technologies. Cookies vary with the features used and the session. See the Shopify Cookie Policy for provider information.

You can view, delete or block cookies through your browser settings; this may affect some store functions. Where a cookie preference control is offered on the site, you can also manage choices there. Viewing this page alone is not explicit consent where consent is required.

5. Infrastructure outside Türkiye

Shopify and Google also operate infrastructure outside Türkiye. Contact, transaction and technical information processed through these providers may therefore be processed abroad. Read the providers’ explanations in Shopify’s privacy notice and the Google Privacy Policy.

These links describe provider practices. This notice is not, by itself, a transfer authorisation or agreement under Turkish law. You may request information about recipients and transfers of your data using the contact details above.

6. Retention

Correspondence is retained as needed to handle requests, transaction records to perform contracts, and mandatory records for applicable legal retention duties. Records needed to protect rights in a dispute may be retained for that process. Applicable deletion, destruction or anonymisation rules apply when the processing reason ends.

7. Your rights and requests

Under Article 11 of Turkish law, you may ask whether your data is processed and why; request information and details of recipients in Türkiye or abroad; and request correction of incomplete or inaccurate data and deletion or destruction when legal conditions are met. You may request notification of these actions to recipients, object to an adverse result based exclusively on automated analysis, and seek compensation for harm caused by unlawful processing.

Send a request to charmacitta@gmail.com or in writing to the address above. Statutory application procedures apply; proportionate information may be needed to verify identity. Do not attach sensitive documents unsolicited. Requests are answered as soon as appropriate to their nature and no later than 30 days.