Website Privacy Notice Regarding the Processing of Personal Data

This Privacy Notice has been prepared by Gasell Ofis Mobilyaları Sanayi ve Ticaret Limited Şirketi, as the data controller in accordance with Law No. 6698 on the Protection of Personal Data ("PDPL"), to inform you about the methods of collection, purposes of processing, and legal grounds for the processing of personal data obtained from Data Subjects and/or third parties in relation to the www.shop.gasell.com website.

1. Definitions and Abbreviations

Company: Gasell Ofis Mobilyaları Sanayi ve Ticaret Limited Şirketi
Address: İkitelli OSB Mahallesi, Masko Mobilyacılar San. Sit. 8/A Blok No:19, Başakşehir / Istanbul
Personal Data: Any information relating to an identified or identifiable person
Processing of Personal Data: Collection, recording, storage, modification, disclosure and other operations of data
Data Subject: Natural person whose personal data is processed
Data Processor: Person or organization that processes personal data on behalf of the data controller
Data Controller: Person who determines the purposes and means of processing personal data

2. Personal Data Being Processed

Personal Data Categories	Personal Data We Collect
Identity Data	Name and surname, Turkish ID Number, date of birth and gender information
Contact Data	Address, phone number and email address
Financial Data	Credit card and bank account information, card number, expiration date and CVV code
Cookie Information	Browser information, IP address, visit duration, habits and location information

3. General Principles Regarding the Processing of Personal Data

Your personal data is processed in accordance with the following principles pursuant to Article 4 of PDPL:

Processing in accordance with law and rules of good faith: Processed in compliance with laws and ethical rules.

Being accurate and kept up to date when necessary: The accuracy and currency of your data is ensured.

Processing for specific, explicit and legitimate purposes: Processing purposes are clearly defined and announced.

Being relevant, limited and proportionate to the purposes for which they are processed: Processed only for the purpose and to the necessary extent.

Being retained for the period stipulated by relevant legislation or necessary for the purpose for which they are processed: Data is stored for the period in accordance with legal requirements.

4. Methods of Collection and Legal Grounds for Processing Personal Data

Your personal data is collected by the Company through various channels and processed in accordance with the following legal grounds pursuant to Articles 5 and 6 of PDPL:

Explicit provision in laws: Your data may be processed due to legal regulations.

Impossibility of obtaining consent due to factual impossibility: In emergencies, data may be processed to protect the life of the person or another person.

Establishment or performance of a contract: Data belonging to parties to a contract is processed to fulfill contract requirements.

Fulfillment of legal obligation of the data controller: Data is processed to fulfill legal obligations.

The relevant person has made the data public: Data made public may be processed for the purpose of publicity.

Data processing is mandatory for the establishment, exercise or protection of a right: Necessary data is processed for the protection of legal rights.

Legitimate interest of the data controller: Data may be processed in line with the Company's legitimate interests, provided that fundamental rights are not violated.

Your personal data is collected through various channels such as www.shop.gasell.com, email, call center, store, camera and mobile application, and processed for the purposes specified in this Privacy Notice.

5. Transfer of Personal Data, Transfer Purposes and Periods

Your personal data may be transferred domestically or abroad to the parties specified below in accordance with Articles 8 and 9 of PDPL for the purposes specified in this Privacy Notice.

Personal Data Categories	Institutions to Which Transfer is Made	Transfer Purposes	Retention Period
Identity Data	Cargo companies, banks, company stakeholders, authorized persons, subsidiaries and affiliates, official institutions, suppliers	Product/service provision, delivery, customer management, campaign notification, dispute resolution	5 years from the end of relationship
Contact Data	Cargo companies, company stakeholders, authorized persons, subsidiaries, official institutions, suppliers	Healthy delivery of product/service, customer management, campaign notification	5 years from the end of relationship
Financial Data	Banks, internal departments, company stakeholders, authorized persons	Provision of financial transactions	5 years from the end of relationship
Marketing Data	Analysis, advertising, research and infrastructure companies	To offer campaigns according to user behavior	5 years
Cookies and IP Address	Analysis, advertising, research and infrastructure companies	To offer campaigns and recommend products according to user behavior	See Privacy and Cookie Policy

6. Security of Your Personal Data

To protect your personal data, the Company takes measures in accordance with relevant privacy and data security laws and regulations. Technical and administrative measures are implemented to protect your data against unauthorized access, loss, alteration and disclosure. Only authorized persons can access your data, and this data is deleted, destroyed or anonymized in accordance with the Personal Data Protection and Destruction Policy when the purpose of processing ends.

7. Rights and Obligations of the Data Subject

7.1. Data Subjects:

Are responsible for ensuring that their personal data is accurate, complete and up to date.
When data belonging to other persons is shared, the relevant persons must be informed about this text and their consent must be obtained.

7.2. Rights of Data Subjects:

Learning whether personal data is being processed and requesting information.
Learning the purpose of processing personal data and whether it is used in accordance with its purpose.
Requesting correction if personal data is incompletely or incorrectly processed.
Requesting deletion or destruction of data when the purpose of data processing ceases to exist.
Objecting to data processed in line with the legitimate interests of the data controller.
Requesting compensation for damages suffered due to unlawful processing of personal data.

You can submit your requests regarding your rights to our Company via notary, mail or email with an application including your identity and address information.