Privacy notice (KVKK)

Your personal data is processed by [not yet provided] ("Olur") as data controller, in accordance with KVKK (Law No. 6698 on the Protection of Personal Data) and related legislation.

• Address: [not yet provided]
• Email: [not yet provided]
• KEP (registered email) address: —
• MERSİS no.: [not yet provided]

• Identity: name and surname; your Turkish identity number (T.C. kimlik no.) if you choose to give it for the invoice (if you do not, the general number the legislation provides is used on the invoice).
• Contact: email address, phone number, billing and delivery addresses.
• Customer transactions: quotes, cart, orders, order messages, claims and photos you attach to claims, language preference.
• Finance: billing details (individual or business; for business accounts the company name, tax office and tax number), payment and refund records. Your card details are neither seen nor stored by us.
• Files you upload: the 3D model files you upload for an order and their names; the photo you upload for the photo to 3D model service.
• Transaction security: the IP address and browser you signed in from, tamper-evident records of security-relevant actions (including IP address), and a one-way hash of your password (the password itself is never stored).

When you get a price without an account, the file you upload is processed only while the price is calculated and is not kept; so that the same file is not recalculated, its fingerprint and slicing result are kept without any link to you. To prevent abuse, your IP address is used, one-way hashed, for 60 seconds.

Only upload photos to the photo to 3D model service that you have the right to use; do not upload photos showing other people's faces or information identifying them without their permission.

• Formation or performance of a contract (KVKK Art. 5(2)(c)): creating and running your account, preparing quotes, taking, making and delivering your order, taking payment and making refunds, reviewing your claims, sending order emails, generating 3D models from photos.
• Compliance with a legal obligation (Art. 5(2)(ç)): issuing invoices, keeping commercial books and records, keeping the records required by consumer legislation, and answering lawful requests from competent authorities.
• Establishing, exercising or defending a right (Art. 5(2)(e)): handling disputes and complaints.
• Legitimate interest (Art. 5(2)(f)): keeping accounts and systems secure, preventing misuse and fraud, keeping security records, and scanning uploaded files for malware.

We do not process personal data for marketing and do not send commercial electronic messages; our emails concern only your account and your orders.

Your personal data is collected electronically and by automated means through the forms on the site (registration, checkout, claims, custom quotes), the files you upload, and the cookies and server records strictly necessary for the site to work.

Your personal data is shared only to the extent needed for the purposes above, with:

• PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. — for card payments: name, email, phone, billing address, IP address, order number and order items.
• The courier — for delivery: recipient name, delivery address and phone.
• The e-invoice / e-archive service provider and our accountant — for invoicing: billing details and order amounts.
• The email delivery service provider — for the order and account emails sent to you: your email address and the email content.
• The server and file storage service provider — to host the system.
• fal.ai (USA) — only when you use the photo to 3D model service: the photo you upload.
• Competent public authorities — where legally entitled, on their request.

When you use the photo to 3D model service, the photo you upload is transferred to the infrastructure of fal.ai, based in the United States of America, to generate the model. Before transfer the photo is re-encoded and location (GPS), device and other embedded data (EXIF/XMP) are removed. The transfer is made in accordance with Article 9 of KVKK.

Your personal data is kept for as long as the purpose of processing requires and for the retention periods set by the relevant legislation; for example, commercial books and records are kept for ten years under Article 82 of the Turkish Commercial Code. When the period ends, the data is erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

A sign-in lasts at most 24 hours and ends after 4 hours without activity. Email confirmation links are valid for 24 hours, password reset links for 2 hours and invitation links for 72 hours.

By applying to the data controller, you have the right to:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether it is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom it is transferred,
• ask for it to be corrected if it is incomplete or inaccurate,
• ask for it to be erased or destroyed under the conditions in KVKK Article 7,
• ask for any correction, erasure or destruction to be notified to the third parties to whom it was transferred,
• object to a result to your detriment arising from analysis of the data exclusively by automated systems,
• claim compensation for damage suffered through unlawful processing.

In line with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can send your application, with information identifying you:

• in writing to [not yet provided],
• by KEP to —,
• or from the email address registered in our system to [not yet provided].

Your application is answered free of charge within 30 days at the latest (KVKK Article 13). If your application is refused, the answer is inadequate or no answer is given in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

If you order from the European Union, you can also use your rights under the General Data Protection Regulation (GDPR) — access, rectification, erasure, restriction of processing, data portability and objection — through the contact channels above, and complain to the data protection authority of your country.