KVKK Privacy Notice
Last updated: 2 November 2026
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It explains who processes the personal data of people who visit, register with, order from, contact, request a trade quotation through or use the dealer panel of the bronzehome.com website (the “Site”); why and on what legal basis we do so; who we share it with; how long we keep it; and how you can exercise your rights under the KVKK.
Language: This English version is provided for convenience. The Turkish version is the authoritative text, and it prevails in the event of any inconsistency.
1. Data controller
Your personal data is processed by the following business as data controller (referred to in this notice as “Bronze Home”, “we” or “us”):
- Business name: Bronze Home Accessories - Mustafa Balıkcı (sole proprietorship)
- Address: Çakmakçılar Yokuşu Sokak, Büyük Valide Han, 2. Kemer No: 31/17, Mercan Mahallesi, Fatih, İstanbul 34116, Türkiye
- Telephone: +90 532 768 37 77
- Email: info@bronzehome.com
- Website: https://bronzehome.com
2. The personal data we process
Depending on how you use the Site, we may process the following categories of personal data. We only ask for what each step genuinely needs.
- Identity: your name; and, for individual orders, your Turkish ID number (T.C. Kimlik No), which is needed to issue an e-Archive invoice.
- Contact details: email address, telephone number, delivery address and, where different, billing address.
- Order and transaction data: what you ordered, the amount and currency; the payment method chosen and the outcome of the payment; for bank transfers, the sender's name and payment reference shown on our bank statement; invoice details; gift-wrapping and invoice delivery preferences; bespoke order requests (for example, an inscription or name to be engraved, dimensions or finish); order status and tracking details; and records of cancellations, returns and complaints.
- Account data: the email address for your account, a hash of your password (never the password itself) and the products saved to your favourites. You can also check out as a guest without creating an account.
- Security data: the IP address and browser details recorded with your order; and the strictly necessary session cookie (FSESSID) that keeps your session running.
- Marketing data: if, and only if, you tick the box to subscribe to our newsletter, your email address and a record of your consent.
- Enquiries and complaints: messages you send us through the contact form, by email, by telephone or on WhatsApp, and our replies.
- Trade enquiries: the company name, sector, country, website, name, job title, email address, telephone number, message and any optional file you provide through the quotation form on our “Professionals” page.
- Dealer data: company details, tax details and dealer panel account details of our approved dealers; and the customer records and quotations dealers create in the panel.
Card details: Your card number, expiry date and security code never reach Bronze Home. They are entered and processed directly on the secure payment pages of our payment providers, iyzico or Stripe.
Special category data: We do not ask for special categories of personal data, such as information about health, religion or ethnic origin. Please do not include such information in forms, messages or attachments.
Other people's data: If you give us someone else's name, address and telephone number as the recipient of an order (for example, when sending a gift), or include another person's name in a bespoke order, please let them know and point them to this notice.
3. How we collect personal data
We collect personal data electronically, by wholly or partly automated means, through:
- forms on the Site: account registration, checkout, the contact form, bespoke order requests, the trade quotation form, newsletter sign-up and the dealer panel;
- your communications with us by email, telephone and WhatsApp;
- the operation of the Site itself: the strictly necessary session cookie, and the IP address and browser details recorded when you place an order;
- our payment providers, who tell us the outcome of a payment, and our couriers, who tell us the status of a delivery;
- other people acting for you: a customer who enters you as the recipient of an order, or a dealer who adds you as a customer in the dealer panel.
4. Purposes and legal bases: summary of our data inventory
The table below summarises, for each category of data, why we process it, the legal basis we rely on under Article 5 of the KVKK, and how long we keep it.
| Data category | Purpose | Legal basis (KVKK Art. 5) | Retention |
|---|---|---|---|
| Identity (name) | Entering into and performing the sales contract, delivery, invoicing, customer service | Necessary for entering into or performing a contract (Art. 5(2)(c)); legal obligation as regards invoicing (Art. 5(2)(ç)) | For as long as the contractual relationship and purpose continue; data on invoices and in accounting records for 10 years |
| Identity (Turkish ID number) | Issuing e-Archive invoices for individual orders | Expressly provided for by law (Art. 5(2)(a)) and legal obligation (Art. 5(2)(ç)) | 10 years, together with invoice and accounting records |
| Contact details (email, telephone, delivery and billing address) | Delivering orders, sending order status and tracking updates, customer service, invoicing | Necessary for entering into or performing a contract (Art. 5(2)(c)); legal obligation as regards the billing address (Art. 5(2)(ç)) | For as long as the contractual relationship and purpose continue; data on invoices for 10 years |
| Order and transaction data (order, payment outcome, invoice, bespoke requests, gift wrapping, cancellations and returns) | Taking, preparing and delivering orders, monitoring payment, invoicing and accounting, handling cancellations and returns, resolving complaints | Necessary for entering into or performing a contract (Art. 5(2)(c)); legal obligation (Art. 5(2)(ç)); establishing, exercising or defending legal claims (Art. 5(2)(e)) | Invoice and accounting records for 10 years; other data deleted or anonymised once no longer needed |
| Account data (account email, password hash, favourites) | Creating and managing your account, showing your order history and favourites | Necessary for entering into or performing a contract (Art. 5(2)(c)) | For as long as your account is open; deleted or anonymised when it is closed (except invoice and accounting records) |
| Security data (IP address, browser details, session cookie) | Keeping the Site and orders secure, preventing misuse, maintaining your session (basket, sign-in, language and currency choice) | Legitimate interests (Art. 5(2)(f)); necessary for performing a contract as regards the session (Art. 5(2)(c)) | Session cookie for the duration of the session; IP address and browser details kept with the order record and deleted once no longer needed |
| Marketing data (newsletter email address, consent record) | Sending our newsletter by email | Explicit consent (Art. 5(1)) | Until you withdraw your consent |
| Enquiries and complaints (your messages) | Answering your questions, customer service, resolving complaints | Necessary for performing a contract, where the enquiry concerns an order (Art. 5(2)(c)); legitimate interests (Art. 5(2)(f)); establishing, exercising or defending legal claims (Art. 5(2)(e)) | Deleted once the matter is closed and the data is no longer needed |
| Trade enquiries (company and contact details, message, attachment) | Preparing and sending a quotation, establishing a business relationship | Necessary for entering into a contract (Art. 5(2)(c)); legitimate interests (Art. 5(2)(f)) | For the quotation process and any resulting business relationship; deleted once no longer needed if no contract follows |
| Dealer data (company, tax and panel account details, quotations) | Managing the dealer relationship, providing dealer prices, preparing quotations, invoicing | Necessary for entering into or performing a contract (Art. 5(2)(c)); legal obligation (Art. 5(2)(ç)) | For the duration of the dealer relationship; invoice and accounting records for 10 years |
Explicit consent: Our newsletter is the only processing activity based on your explicit consent. Subscribing is never a condition of ordering or opening an account, and you can withdraw your consent at any time. Withdrawal does not affect processing carried out before that point.
Customer records in the dealer panel: Where dealers enter details of their own customers or prepare quotations for them in the panel, it is the dealer's responsibility to inform those people and to have a valid legal basis. Bronze Home processes these records solely to operate the dealer panel.
5. Who we share personal data with, and why
We share personal data in line with Articles 8 and 9 of the KVKK, and only as far as the purposes below require. We do not sell your personal data or share it with third parties for advertising.
| Recipients | Data shared | Purpose | Location |
|---|---|---|---|
| Our contracted couriers and delivery companies | Recipient's name, delivery address and telephone number; shipment details; the amount to be collected for cash-on-delivery orders | Delivering orders, tracking, collecting cash-on-delivery payments | Türkiye; for international orders, the country of delivery |
| Customs and other relevant authorities in the country of delivery | Recipient's name, address and contact details; contents and value of the shipment | Customs clearance for international orders (duties and taxes are paid by Bronze Home) | The country of delivery |
| iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) | Identity, contact and order details needed to process the payment | Taking credit and debit card payments, 3D Secure authentication, instalments | Türkiye |
| Stripe | Identity, contact and order details needed to process the payment | Taking payments by international card, Apple Pay or Google Pay only | Outside Türkiye |
| Our hosting provider | Data held in the Site's database | Hosting the Site and its data | Türkiye |
| Our accountant (financial adviser) | Data contained in invoice and accounting records | Meeting our accounting and tax obligations | Türkiye |
| Competent public authorities (for example, the tax authorities and the courts) | The data requested, or required by law | Meeting legal obligations and responding to lawful requests from the authorities | Türkiye |
Payment providers process payment transactions and card details under the regulations that apply to them, and provide their own privacy notices on their pages.
6. Transfers outside Türkiye
Personal data is transferred abroad in the cases below. These transfers are made in accordance with the conditions and procedures set out in Article 9 of the KVKK:
- Stripe: only if you choose to pay by international card, Apple Pay or Google Pay (options offered to our international customers), the data needed to process that payment is transferred to Stripe. No data is sent to Stripe when you pay through iyzico, by bank transfer or cash on delivery.
- International deliveries: where the delivery address is outside Türkiye, the recipient's details are passed to the courier and to the customs authorities of the destination country so that the parcel can be cleared and delivered. This transfer is necessary to perform the sales contract with you and is occasional, occurring order by order (KVKK Art. 9(6)(b)).
Separately, some services you choose to use connect you directly with providers based outside Türkiye. When you click “show map” on our Contact page, Google Maps loads and your browser connects to Google. When you tap the WhatsApp button, you are taken to WhatsApp (Meta), and any conversation you have with us there is processed on WhatsApp's systems. These services are governed by their own privacy terms.
7. Retention and deletion
We keep personal data for as long as is necessary for the purpose for which it was collected and for any period required by law:
- Invoice and accounting records are kept for 10 years, as required by Turkish tax and commercial law.
- Newsletter consent data is processed until you withdraw your consent.
- All other personal data is deleted, destroyed or anonymised once the purpose for processing it has ended, in line with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
8. Your rights under Article 11 of the KVKK
By applying to us as data controller, you have the right to:
- find out whether your personal data is being processed;
- request information about that processing, if it is;
- find out the purpose of the processing and whether your data is being used for that purpose;
- know the third parties, in Türkiye or abroad, to whom your data has been transferred;
- ask for incomplete or inaccurate data to be corrected;
- ask for your data to be deleted or destroyed under the conditions set out in Article 7 of the KVKK;
- ask for any correction, deletion or destruction to be notified to the third parties to whom your data has been transferred;
- object to an outcome that is to your detriment and results solely from the analysis of your data by automated systems;
- claim compensation if you suffer loss because your data has been processed unlawfully.
Visitors from the European Economic Area or the United Kingdom will find information about their rights under the GDPR in our Privacy Policy.
9. How to make a request
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send us your request:
- in writing: as a signed letter, delivered by hand or by post to Çakmakçılar Yokuşu Sokak, Büyük Valide Han, 2. Kemer No: 31/17, Mercan Mahallesi, Fatih, İstanbul 34116, Türkiye; or
- by email: to info@bronzehome.com, either from an email address you have previously given us and which is registered in our system, or signed with a secure electronic signature or mobile signature.
Your request should include your full name; your signature (for written requests); your Turkish ID number if you are a Turkish citizen or, if not, your nationality and passport number or national identity number (if you have one); your residential or business address for correspondence; your email address and telephone number, if any; and what you are asking for. You may attach any supporting documents. We may ask for further information to verify your identity.
We will deal with your request as quickly as possible and within 30 days at the latest, free of charge. If responding involves an additional cost, we may charge the fee set by the Personal Data Protection Board. If your request is refused, you find our response inadequate, or we do not respond in time, you may complain to the Personal Data Protection Board within 30 days of learning of our response, and in any event within 60 days of the date of your request.
10. Related policies and changes
Our general approach to personal data and the security measures we take are described in our Privacy Policy, and the cookies we use are listed in our Cookie Policy. We may update this notice to reflect changes in the law or in how we process personal data. The current version is always published on the Site, and the “Last updated” date at the top shows when it last changed.
