1. Data Controller
Your personal data is processed by the following company in its capacity as the data controller:
- Title: German Spare Parts Warehouse Tourism and Trade Limited Company
- MERSIS No: 0055224484300001
- Tax Office / No: Kozyatağı VD – 0552244843
- Trade Registry No: 1081931
- Address: İçerenköy Mah. Şakirbey Sok. No:2/26, Ataşehir / Istanbul 34000
- KEP: [email protected]
- Email: [email protected]
- Phone: 0538 292 72 19
- Website: almanparcadeposu.com
In the text, the terms "Company," "we," or "APD" refer to this data controller.
2. Your Processed Personal Data, Categories, Purposes of Processing, and Legal Grounds
| Data Category | Processed Personal Data | Purpose of Processing | Legal Ground (KVKK) |
|---|---|---|---|
| Identity | First and last name; (only when an invoice is requested) T.C. identity number | Establishment and execution of the order/sales contract; issuing invoices | Establishment/execution of the contract (m.5/2-c); legal obligation for invoicing (m.5/2-ç – VUK/TTK) |
| Contact | Phone, email | Conducting the order process, delivery notifications, customer service | Establishment/execution of the contract (m.5/2-c) |
| Customer Transaction / Order | Order content, order number, transaction history, guest order information | Creation, tracking, delivery of the order, management of returns | Establishment/execution of the contract (m.5/2-c) |
| Delivery and Invoice Address | Delivery address, invoice address | Delivery of the product and issuing a legal invoice | Execution of the contract (m.5/2-c); legal obligation (m.5/2-ç) |
| Financial / Payment | Payment amount and status. Your card number is not stored by our Company; payment is made via PayTR | Collection and accounting of the order amount | Execution of the contract (m.5/2-c); legal obligation (m.5/2-ç) |
| Transaction Security | IP address, cookie records, system/access (log) records | Ensuring site and transaction security, preventing unlawful use | Legitimate interest (m.5/2-f); legal obligation (m.5/2-ç) |
| Request / Complaint | Information regarding your requests and complaints | Addressing and resolving requests and complaints | Execution of the contract (m.5/2-c); legitimate interest (m.5/2-f) |
| Vehicle Information (Garage) | Chassis (VIN) number, vehicle make, model, series code, engine information | Identifying the part compatible with your vehicle, fitment queries, providing the garage feature | Establishment/execution of the contract (m.5/2-c); legitimate interest (m.5/2-f) |
| Correspondence Content | The content of messages and images you send us via WhatsApp, Instagram, Facebook Messenger and the site chat | Understanding and answering your request, customer support, resolution of disputes | Establishment/execution of the contract (m.5/2-c); legitimate interest (m.5/2-f) |
Commercial electronic communication / marketing: Sending campaign and commercial electronic communications is not included in the above activities. These communications are made based on the ETK approval you provide under Law No. 6563, separately from KVKK explicit consent, and through the Communication Management System (IYS). Not providing this does not affect your shopping.
Guest shopping: You can complete your shopping without creating a membership; not providing any explicit consent does not prevent your guest order.
3. Transfer of Personal Data Abroad (KVKK m.9)
The server and hosting infrastructure of our website is located in the data center of Hetzner Online GmbH based in Germany, located in Finland. Therefore, your personal data provided through our site is hosted and processed in Finland within the scope of order and transaction processes; this constitutes a transfer abroad within the meaning of KVKK m.9.
The permanent legal basis for these transfers is the Standard Contract mechanism announced by the Turkish Personal Data Protection Board under KVKK m.9. Our Company is in the process of establishing this contract with the relevant providers and will notify the Board within five business days following signature. Until this safeguard takes effect, a separate and independent explicit consent is additionally obtained; no consent is requested from you through this clarification text. If you do not provide explicit consent, your data will only be processed to the extent necessary for the execution of your order (contract). This text will be updated once the process is complete.
Additionally — Messaging (WhatsApp Notifications): Twilio Inc. / USA
Notifications sent via WhatsApp regarding your order status (order confirmation, shipping, delivery, etc.) are transmitted through the messaging infrastructure of Twilio Inc. (based in the United States). In this context, your first and last name, phone number, order number, and order summary information are transferred abroad (USA) for the purpose of delivering the message. This transfer is a separate and independent transfer abroad from the hosting transfer described above; a separate, optional explicit consent checkbox in the checkout, quick purchase, and membership flows is provided as an additional transparency/consent tool for this transfer. If you do not provide consent, your order will still be completed; WhatsApp notifications may not be sent, and your order process will continue to be informed through other channels (email, SMS).
Additionally — Content Delivery Network (CDN) and Web Security: Cloudflare Inc. / USA
Our website is published through the content delivery network (CDN) and web security infrastructure of Cloudflare Inc. (based in the United States) to enhance security and access speed. Every connection you make to our site technically passes through this infrastructure with your IP address and HTTP request information. This transfer is a necessary infrastructure service for ensuring the site is securely and uninterruptedly delivered.
For the Twilio and Cloudflare transfers, the establishment of the Standard Contract mechanism under KVKK m.9 is likewise in progress, and the Board will be notified within five business days following signature.
Additionally — AI-Assisted Customer Assistant: OpenAI, L.L.C. / USA
Automatic replies given by the chat assistant on our website and to messages received via WhatsApp, Instagram and Facebook Messenger are generated using the artificial intelligence infrastructure of OpenAI, L.L.C. (based in the United States). In this context, the content of the message you write to us and your conversation history are transferred abroad (USA) for the purpose of generating the reply. Any information you share in your message (for example your vehicle chassis number or contact details) may be included in this transfer; we therefore recommend that you do not write information you would prefer not to share in these channels.
In our account, data sharing for model training is disabled and API call logging is turned off. The Standard Contract mechanism is also being established for this transfer.
Additionally — Error Logging Infrastructure: Sentry / European Union
We use the Sentry error logging infrastructure to detect technical errors on our site. Technical records of the error and your IP address may be processed in this context. The Sentry infrastructure is located in the European Union (Frankfurt) region and is configured with personal data transmission disabled by default.
4. Parties to Whom Personal Data is Transferred and Purposes of Transfer
- Cargo/logistics companies (e.g., Aras / ShipEntegra): For the purpose of product delivery.
- Payment institution (PayTR): For the purpose of secure payment collection.
- Accounting / e-invoice providers (e.g., Nilvera): For the purpose of invoicing and legal obligations.
- Authorized public institutions and organizations: For the purpose of fulfilling requests arising from legislation.
- Infrastructure / hosting provider (Hetzner Online GmbH – Finland data center): For the purpose of hosting the site and data (transfer abroad; see Section 3).
- Messaging infrastructure (Twilio Inc. – USA): For the purpose of delivering WhatsApp order notifications (transfer abroad).
- CDN / web security infrastructure (Cloudflare Inc. – USA): For the purpose of ensuring the site is securely and uninterruptedly delivered (transfer abroad).
- Artificial intelligence infrastructure (OpenAI, L.L.C. – USA): For generating chat assistant and message replies; your correspondence content is transferred (transfer abroad; see Section 3).
- Error logging infrastructure (Sentry – European Union): For detecting and resolving technical errors (transfer abroad).
- Measurement and advertising infrastructures (Google LLC, Meta Platforms Ireland): For measuring site usage and conducting advertising activities; these transfers occur only if you consent to the relevant categories in your cookie preferences. See our Cookie Policy.
5. Method of Collecting Personal Data
Your personal data is collected through our website via membership, orders, guest shopping, and communication processes, cookies, and electronic communication channels, using automatic and partially automatic methods.
6. Duration of Storage of Personal Data
- Invoices, accounting, and financial records: 10 years as required by VUK and TTK.
- Transaction security / log records: For the duration specified by the relevant legislation (5651, etc.).
- Consent/proof of consent records: For the duration of the statute of limitations and proof obligation.
- Other data: Deleted, destroyed, or anonymized when the purpose of processing ceases and legal retention periods expire.
7. Use of Automated Systems and Artificial Intelligence
Messages received through our customer support channels (site chat, WhatsApp, Instagram, Facebook Messenger) may be answered automatically by an AI-assisted assistant. The assistant works to understand your request, search for products and suggest the part suitable for your vehicle.
This assistant does not provide price, quotation or amount information, and does not process return, cancellation or withdrawal requests. Such requests are in all cases transferred to a member of our staff and the decision is made by a human.
No decision producing an adverse legal effect concerning you is taken solely by automated means. You nevertheless retain the right to object to automated replies and to request that your matter be reviewed by a member of our staff; you may send such a request to [email protected] or ask to be transferred to a representative within the chat.
For the cross-border transfer aspect of the AI infrastructure, see Section 3.
8. Your Rights Under Article 11 of the Law
You can exercise your rights under Article 11 of the Law by applying to the data controller. For details on the application procedure and channel, please refer to our separate KVKK Application Form page. In summary: you can apply in writing (with a wet signature), via KEP, or through the registered email in the system; applications made by phone are not valid. Applications will be concluded free of charge within 30 days at the latest.
This text is an information (clarification) text; only a "I have read and understood" notification can be obtained from you, and no consent is requested.