Privacy Notice
1. Data controller
Under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is PatiPet Evcil Hayvan Ürünleri Ltd. Şti.. Our full identity and contact details are on the Legal information page.
2. What we process, why, and on what legal basis
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, e-mail, phone, message; technically IP address | Replying to your request | KVKK art. 5/2-c and 5/2-f | Message 2 years; IP 6 months |
| Orders and sales | Name, contact, delivery/billing address, ID/tax number (for invoicing), order content, payment result | Concluding and performing the contract, invoicing, delivery, returns | KVKK art. 5/2-c and 5/2-ç | 10 years (Turkish Commercial Code art. 82, Tax Procedure Law art. 253) |
| Distance contract acceptance record | Acceptance date, IP address, contract version and text hash | Proving that the contract was concluded | KVKK art. 5/2-ç and 5/2-e | 10 years |
| Customer account | Name, e-mail, phone, password hash (the password itself is not stored), address book | Opening and managing the account, order history | KVKK art. 5/2-c | Until the account is closed; order records 10 years |
| Newsletter (double opt-in) | E-mail address, language, subscription and confirmation dates with the IP address truncated (last part removed) at those moments, consent text and version, source form, delivery logs | Sending campaigns, new products and announcements; proving consent | Explicit consent (KVKK art. 5/1) and commercial message consent (Law 6563 art. 6) | Until you withdraw consent; withdrawal record 3 years; unconfirmed sign-ups 7 days |
| Security logs | IP address, browser data, login attempts, error logs | Information security, abuse prevention | KVKK art. 5/2-f (legitimate interest) | 90 days – 1 year (see table below) |
| Call-back ("Call me") and short enquiry forms | Name, phone, (optional) e-mail, preferred call time, message, page the form was sent from; technically IP address and browser data | Calling you back, giving product and price information, answering your pre-sales request | KVKK art. 5/2-c (pre-contractual steps at your request) and 5/2-f (legitimate interest) | Request 2 years; IP/browser 6 months |
| Grooming appointments and adoption applications | Name, phone, e-mail, (for adoption) city, home type, other pets at home and experience, your pet's name, species, size and breed, preferred day and time, your note; technically IP address | Planning the appointment and calling you; assessing the adoption application with our volunteers and arranging a meeting | KVKK art. 5/2-c (pre-contractual steps at your request) | Request 2 years; IP 6 months |
| Requests sent from your account (order cancellation, return/withdrawal, account deletion) | Request type, reason, your note, order number, language, truncated IP address | Handling your request, processing withdrawals and returns, deleting the account and proving this | KVKK art. 5/2-c, 5/2-ç (Law 6502, Distance Contracts Regulation) and 5/2-e | With the related order record (10 years); account deletion requests for the same period as proof |
3. How we collect data
Your data is collected electronically from you through forms, order and account screens on the site, and automatically through server logs and (only with your consent) cookies.
4. Recipients
| Recipient | Country | Purpose |
|---|---|---|
| PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. | Türkiye | Payment processing (card data is entered directly at the payment institution and not stored by us) |
| Contracted carrier (named when your order is shipped) | Türkiye | Delivery (name, phone, delivery address) |
| Accountant, competent public authorities | Türkiye | Legal obligations |
Your personal data is not transferred to third parties other than the recipients listed above. If any of these recipients has servers abroad, the transfer is made under Article 9 of the KVKK (adequacy decision, appropriate safeguards such as the standard contract, or the incidental cases in art. 9/6).
5. Retention periods
The periods below are enforced automatically by the site software.
| Record | Period |
|---|---|
| Login attempts | deleted after 3 months |
| Customer login attempts | deleted after 3 months |
| Administrator activity logs | deleted after 1 year |
| Not-found page logs | deleted after 6 months |
| IP/browser data in contact messages | cleared after 6 months |
| Contact messages, call-back and quote requests | deleted after 2 years |
| IP/browser data in orders | cleared after 2 years |
| IP data in payment records | cleared after 2 years |
| Personal data in unpaid, uninvoiced (abandoned) orders | anonymised after 6 months |
| Order-time measurement records (cookie IDs, IP) | deleted after 1 months |
| E-mail delivery logs | deleted after 1 year |
| Newsletter delivery records | deleted after 1 year |
| Distance contract acceptance records | deleted after 10 years |
| Raw visit statistics records | deleted after 3 months |
6. Special categories of personal data
Our site and forms do not ask for special categories of personal data such as health, biometric, religious or criminal-record data; please do not include such information in forms or messages. Fingerprint, face or palm data you enrol on a smart lock is stored on the lock itself or in the lock's mobile app; it is never sent to this site and is not processed through this site. If you use the lock's mobile app, the app provider's privacy notice also applies.
7. Your rights and how to apply
Under Article 11 of the KVKK you have the right to: (a) learn whether your personal data is processed; (b) request information if it has been processed; (c) learn the purpose of processing and whether it is used accordingly; (ç) know the third parties to whom it is transferred in Türkiye or abroad; (d) request correction of incomplete or inaccurate data; (e) request erasure or destruction under Article 7; (f) request that (d) and (e) be notified to third parties to whom the data was transferred; (g) object to a result against you arising exclusively from automated analysis; (ğ) claim compensation for damage due to unlawful processing.
You may apply in writing (wet-signed letter to the address on our Legal information page), via registered e-mail (KEP), with a secure electronic or mobile signature, or from an e-mail address previously registered with us to merhaba@patipet.com.tr. We reply free of charge within 30 days at the latest (KVKK art. 13). If your application is rejected, the answer is insufficient or not given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application (KVKK art. 14). Visitors from the EU also have the rights under GDPR art. 15–22.