PRIVACY NOTICE ON THE PROTECTION OF PERSONAL DATA

PENGE MAĞAZACILIK PERAKENDE TİCARET A.Ş.

PRIVACY NOTICE WITHIN THE SCOPE OF PERSONAL DATA PROTECTION


Dear Customers, Members, and Visitors,

This Information Notice has been prepared to inform you, in accordance with the Law No. 6698 on the Protection of Personal Data (“Law” or “KVKK”) and relevant legislation, about how your personal data is processed by PENGE MAĞAZACILIK PERAKENDE TİCARET ANONİM ŞİRKETİ (“Penge” or the “Company”) located at Cumhuriyet Mahallesi Yeni Yol 1 Sk. Now Bomonti Apt. No: 2/12 Şişli/Istanbul, acting as the data controller.

Personal Data We Process and the Purposes of Processing

Customers Who Shop in Our Stores:

We process personal data such as identity, contact, customer transaction, legal transaction, and financial information. This is done to fulfill the sales agreement, issue invoices, and, if applicable, deliver your e-invoice via email. If you pay by credit/debit card, your card data will be processed and transferred to the relevant payment institution.

Store Visitors:

We process your audio and video data collected via security cameras placed in our stores to ensure the safety of customers, employees, and third parties, and to fulfill our legal obligations before judicial or official authorities.

Additionally, when using our “Live Sales via Video Call” feature, audio, photo, and video recordings of the store environment where our sales consultant is located will be processed.

Website/Mobile App Visitors:

Cookies in compliance with legal regulations are used to enhance your shopping experience and provide targeted promotions. You can manage your cookie preferences through your browser settings. We also process your IP address and browsing data to ensure IT security and regulatory compliance.

Members:

To create your membership and fulfill the membership agreement, we process personal data such as identity (name, surname), contact (email, phone), and transaction security (log records). If you save your address via our platform, it is also processed. Additionally, we process your order history, order number, shipping details, and payment method.

Customers Who Shop Online:

If you shop online via our website or mobile app, either as a member or guest, we process your identity, contact, customer transaction (e.g. product info, price, order date), legal transaction, and financial data for sales fulfillment and after-sales services.

If payment is made by card, the card information is processed and transferred to the relevant payment provider.

If you send a product to a third party, we process the recipient’s name, address, and phone number solely for delivery purposes. You are responsible for informing the recipient, as the data will not be used for marketing.

If someone sends a product to you, we process your identity and contact details for delivery purposes.

If you use the “Live Sales via Video Call” feature, your audio and visual data will be processed with your explicit consent. Your device’s camera, microphone, and related features may be accessed during the session as permitted by your operating system.

Customers Who Give Commercial Communication Consent:

By granting consent via SMS code, website, or mobile app, you agree to receive marketing communications about promotions, campaigns, and satisfaction surveys. We process your name, phone number, email, and log records and may share them with service providers only for this purpose.

You may withdraw your consent at any time through the notification preferences section of your profile or via the İleti Yönetim Sistemi.

Customers Who Contact Penge:

If you contact us through the contact form, email, call center, or social media, we process your name, social media account (if applicable), contact info, order details (if shared), and complaint/request details. We also record call center conversations for customer satisfaction purposes and as evidence in case of disputes.

Method and Legal Basis of Personal Data Collection

Your personal data is collected through automated systems (e.g., store security cameras, online shopping records), semi-automated entries by store personnel, or non-automated methods (e.g., hard copy documents).

Additionally, we may receive your data via social media, phone, or customer service, or from authorities for legal reasons.

The legal bases include:

  • Explicit consent (KVKK Art. 5/1), e.g., for marketing communications.
  • Legal obligation (Art. 5/2(a)), e.g., to comply with tax regulations.
  • Contract performance (Art. 5/2(c)), e.g., for fulfilling membership or sales agreements.
  • Compliance with legal duties (Art. 5/2(ç)), e.g., for issuing invoices or maintaining security.
  • Establishing or defending a legal claim (Art. 5/2(e)), e.g., for handling disputes.
  • Legitimate interest (Art. 5/2(f)), e.g., improving operational processes without harming your rights.

Once the processing purposes or legal retention periods expire, your personal data will be deleted, destroyed, or anonymized in accordance with Article 7/1 of the Law.

Data Transfers and Purposes

Your personal data may be shared with:

  • Business partners and suppliers for logistics, marketing, complaint resolution, and operational purposes;
  • Partner stores using shared POS systems;
  • Banks and payment institutions (for card transactions);
  • Public authorities and judicial bodies if legally required.

If you provide consent, your data may be shared within Karaca Group for marketing and data unification purposes.
For internal administrative needs, data may be shared with other companies in the Karaca Group without violating your fundamental rights.

Your Rights as a Data Subject

Under Article 11 of the Law, you have the right to:

  1. a) Learn whether your data is being processed,
  2. b) Request information on such processing,
  3. c) Learn the purpose and if it’s being used appropriately,
  4. d) Learn third-party recipients in Türkiye or abroad,
  5. e) Request correction of incomplete/inaccurate data,
  6. f) Request deletion/destruction under Article 7,
  7. g) Request notification to third parties regarding corrections/deletion,
  8. h) Object to outcomes resulting from automated processing,
  9. i) Request compensation for damages due to unlawful processing.

You can submit your requests under these rights by writing to our address:

Cumhuriyet Mah. Yeni Yol 1 Sk. Now Bomonti Apt. No: 2/12 Şişli/Istanbul,

or by emailing us at kvkk@flyingtiger.com.tr or penge@hs03.kep.tr (registered e-mail).

We assure you that your data is protected with the utmost care. Thank you for your trust.