Privacy policy

PRIVACY POLICY AND PERSONAL DATA PROTECTION NOTICE

(KVKK Aydınlatma Metni)

Last updated: September 24, 2026

This Privacy Policy explains how Dragee D'Argent processes your personal data when you visit osh.jewelry (the "Website"), create an account, place an order, subscribe to our newsletter or contact us (together, the "Services").

It is published to fulfil our obligation to inform you under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for the Obligation to Inform. If you are located in the European Union, Section 13 also applies.

1. DATA CONTROLLER

Your personal data is processed by:


Data controller (Veri Sorumlusu)	O SH DİZAYN TAKI PAZARLAMA [full registered title], operating under the brand Dragee D'Argent ("we", "us", "our")
Address	Örnek Mah. Semerkant Cad. No: 13 A, 34381 Ataşehir, İstanbul, Türkiye
MERSIS No. / Tax No.	0632135940800001
E-mail	hello@osh.jewelry

VERBİS registration	431443-5

2. WHAT PERSONAL DATA WE PROCESS

Category	Examples
Identity	Name, surname; [T.C. ID number only where legally required for invoicing above the statutory threshold]
Contact	Delivery and billing address, e-mail, phone number
Customer transaction	Order details, order history, returns and withdrawal requests, invoices, wishlist and cart contents
Financial	Payment confirmation, last 4 digits of card, refund details. We do not see or store your full card number. Card data is processed directly by our payment provider.
Account	Username, password (stored in encrypted form)
Customer communication	Messages, e-mails and complaints you send us; reviews and photos you post
Marketing	Newsletter preferences, consent records, campaign interactions (only with your consent)
Transaction security / device	IP address, browser and device information, log records, cookie data (see Section 7)

We do not intentionally collect special categories of personal data (such as health, religion or biometric data) under Article 6 of KVKK. Please do not send us such data.

3. HOW WE COLLECT YOUR DATA

We collect personal data by automated and partly automated means:

directly from you, through order forms, account registration, newsletter sign-up, e-mail, social media messages and customer support;
automatically, through cookies and similar technologies on the Website (Section 7);
from service providers that act on our behalf, such as our e-commerce platform (Shopify), payment provider and courier.

4. PURPOSES AND LEGAL BASES

We process your personal data only for the purposes below, and only on the legal bases listed in Article 5 of KVKK:

Purpose	Legal basis (KVKK Art. 5)
Setting up and performing your purchase contract: processing orders and payments, delivery, returns, withdrawal and refunds	Necessary for the establishment or performance of a contract (Art. 5/2-c)
Creating and managing your customer account	Performance of a contract (Art. 5/2-c)
Issuing invoices, keeping accounting and commercial records, meeting consumer-law, tax and e-commerce obligations, answering requests from authorities	Compliance with a legal obligation (Art. 5/2-ç); expressly provided by law (Art. 5/2-a)
Handling customer requests, complaints and defect claims	Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f)
Website security, fraud prevention, keeping log records	Legal obligation (Art. 5/2-ç); legitimate interest (Art. 5/2-f)
Establishing, exercising or defending legal claims	Art. 5/2-e
Essential (strictly necessary) cookies	Legitimate interest / performance of the service (Art. 5/2-c, f)
Analytics, advertising and marketing cookies and pixels	Your explicit consent (Art. 5/1)
Sending newsletters and commercial electronic messages (e-mail, SMS, calls)	Your explicit consent and commercial electronic message consent under Law No. 6563, recorded in the Message Management System (İYS)
Publishing your reviews and photos	Data made public by you (Art. 5/2-d); explicit consent where you are identifiable in photos

Using the Website does not mean you consent to processing that requires explicit consent. Where we rely on consent, we ask for it separately, you may refuse without affecting your purchase, and you may withdraw it at any time.

5. WHO WE SHARE YOUR DATA WITH

We share personal data only to the extent necessary for the purposes above, within the conditions of Articles 8 and 9 of KVKK:

Recipient	Purpose
Shopify (e-commerce platform and hosting)	Operating the Website, storing order and account data
Payment provider [e.g. iyzico / PayTR] and banks	Processing payments and refunds
Courier companies [e.g. Yurtiçi / Aras / MNG / DHL]	Delivery and return pick-up
Accountant and e-invoice provider	Invoicing and legal bookkeeping
E-mail marketing provider [e.g. Shopify Email / Klaviyo]	Sending newsletters (only with your consent)
Analytics and advertising providers [e.g. Google, Meta]	Measuring traffic and showing ads (only with your cookie consent)
Legal and professional advisers	Establishing or defending legal claims
Authorized public authorities and courts	When legally required (e.g. Ministry of Trade, tax authorities, judicial authorities)

We do not sell your personal data.

6. TRANSFERS ABROAD

Some of our service providers (in particular Shopify and certain analytics, advertising and e-mail tools) store or process data on servers outside Türkiye, including in Canada, the United States, Ireland and other EU countries.

Such transfers are made in accordance with Article 9 of KVKK (as amended by Law No. 7499, in force since 1 June 2024), on the basis of:

an adequacy decision of the Personal Data Protection Board, where one exists; or
appropriate safeguards, in particular the standard contracts published by the Board, signed with the recipient and notified to the Personal Data Protection Authority within 5 business days; or
where none of these is available, only for occasional and non-repetitive transfers under Article 9/6 (for example, with your explicit consent after being informed of the possible risks, or where necessary for performing your contract).

7. COOKIES

We use cookies and similar technologies on the Website.

Strictly necessary cookies (shopping cart, checkout, security, login) are needed for the Website to work and are used without consent.
Analytics, personalization and advertising cookies and pixels (e.g. [Google Analytics, Meta Pixel, Shopify Audiences]) are used only if you accept them through our cookie banner. You may change your choice at any time via [Cookie Settings link].

The Personal Data Protection Authority's Cookie Guide is followed. A full list of cookies, their providers and retention periods is available in our Cookie Policy [LINK]. More information on Shopify cookies: https://www.shopify.com/legal/cookies.

8. HOW LONG WE KEEP YOUR DATA

We keep personal data only as long as required for the purpose or by law, after which we delete, destroy or anonymize it under the Regulation on the Erasure, Destruction or Anonymization of Personal Data. Checks are carried out periodically, at intervals not exceeding 6 months.

Data	Retention period
Invoices, accounting and commercial records	10 years (Turkish Commercial Code Art. 82); 5 years (Tax Procedure Law)
Distance sales contract, pre-information and order records	3 years (Distance Contracts Regulation) and for the duration of any dispute
Customer account data	Until you close your account, then up to 5 years for possible legal claims
Commercial electronic message consent records	3 years after consent ends (Regulation on Commercial Communication)
Customer support communications	[2] years after the request is closed
Log and traffic records	[1–2] years
Cookies	As set out in the Cookie Policy

9. DATA SECURITY

We take appropriate technical and administrative measures under Article 12 of KVKK to prevent unlawful processing of and access to your data. These include encrypted (SSL/TLS) connections, restricted access, strong passwords and working only with reputable service providers bound by confidentiality. If a data breach occurs, we will notify the Personal Data Protection Board within 72 hours and inform affected persons as soon as possible.

10. YOUR RIGHTS (KVKK ARTICLE 11)

You have the right to:

(a) learn whether your personal data is processed;
(b) request information about the processing if it is;
(c) learn the purpose of processing and whether data is used for that purpose;
(ç) know the third parties, in Türkiye or abroad, to whom data is transferred;
(d) request correction of incomplete or inaccurate data;
(e) request deletion or destruction of your data under Article 7 of KVKK;
(f) request that corrections, deletions or destructions be notified to third parties to whom the data was transferred;
(g) object to a result against you arising exclusively from automated analysis;
(ğ) claim compensation if you suffer damage from unlawful processing.

You may also withdraw any consent you have given, at any time, with effect for the future.

How to apply: send your request in Turkish or English:

in writing, signed, to our address in Section 1; or
via KEP, secure e-signature or mobile signature to [KEP address]; or
by e-mail to hello@drageedargent.com from the e-mail address registered with us.

Your application should include your name, surname, address or e-mail, and your request. We may ask for information to verify your identity. We will respond free of charge within 30 days at the latest. If the response requires additional cost, a fee may be charged under the Board's tariff.

Complaint: if your request is rejected, our answer is unsatisfactory, or we do not respond in time, you may file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our response, and in any case within 60 days of your application (www.kvkk.gov.tr).

11. MARKETING COMMUNICATIONS

We send newsletters and campaign messages only if you have opted in. You may unsubscribe at any time, free of charge, by using the link in each message, by contacting us, or via the İYS platform (www.iys.org.tr). We will still send you messages about your orders, returns and account, as these are necessary to perform your contract.

12. CHILDREN

The Services are intended for persons 18 years of age or older. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

13. VISITORS FROM THE EUROPEAN UNION (GDPR)

If you are in the EU/EEA and we offer our products to you, the EU General Data Protection Regulation (GDPR) may also apply. In that case, the legal bases in Section 4 correspond to GDPR Article 6(1)(a) consent, (b) contract, (c) legal obligation and (f) legitimate interests. In addition to the rights above, you have the rights to data portability, to restriction of processing, and to lodge a complaint with the data protection authority of your country of residence. Transfers from the EU are made on the basis of adequacy decisions or the European Commission's Standard Contractual Clauses. [EU representative under GDPR Art. 27, if appointed: [name / address].]

14. THIRD-PARTY WEBSITES AND PUBLIC CONTENT

The Website may link to third-party websites and social media platforms (e.g. Instagram). Their own privacy policies apply. Reviews and content you choose to publish on the Website are visible to others; please do not include personal information you do not want to be public.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in law or in our practices. The current version is always available on this page with its "Last updated" date. Where a change affects processing based on your consent, we will ask for your consent again.