Personal Data Protection and Processing Information Text
(Within the scope of Law No. 6698 on the Protection of Personal Data)
https://dryart.com.tr/en/personal-data-protection-law
Data Controller
Title: Dry Art
Address: Sinanbey Mah. Ahmet Akyollu Cad. No: 48 C, Sinanbey – İnegöl – Bursa – Türkiye
Phone: +90 537 249 84 22
Email: [email protected]
Website: https://dryart.com.tr
1) Purpose and Scope
This Information Text has been prepared by Dry Art in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and related legislation to inform data subjects about the methods, purposes, legal grounds, transfer conditions, retention periods, and rights regarding the processing of their personal data.
This document covers all activities related to the processing of personal data, including website operations, communication and support processes, product and service delivery, after-sales services, accounting/finance, campaigns, and marketing activities.
2) Collection and Method of Personal Data
Your personal data is collected through communication forms on https://dryart.com.tr, phone and email communication, contracts and invoicing, cargo/delivery processes, social media and digital marketing activities, and customer service channels, by automatic, semi-automatic, or manual means.
Examples of collected data categories:
- Identity: Name, surname.
- Contact: Phone number, email address, postal address.
- Customer Transaction: Order/offer history, request/complaint records, preferences, and satisfaction information.
- Financial: Invoice and payment details (credit card data are not stored; if processed, they are handled by the payment service provider).
- Transaction Security and Marketing: IP address, cookies, session records, device/navigation data, and campaign interaction details.
3) Purposes of Processing Personal Data
- Providing, delivering, and supporting products and services,
- Managing customer relations, offers, campaigns, and satisfaction surveys,
- Fulfilling contractual and legal obligations, accounting and invoicing,
- Managing requests and complaints and ensuring necessary notifications to public authorities,
- Operating information systems, ensuring system security, and reducing fraud risks,
- Offering personalized experiences, developing products/services, and determining business strategies,
- Conducting marketing and promotional communications based on explicit consent.
4) Legal Grounds for Processing
Your personal data is processed based on the legal grounds stated in Articles 5 and 6 of the KVKK: establishment and performance of a contract, compliance with legal obligations, establishment, exercise or protection of rights, and legitimate interest provided that it does not harm fundamental rights and freedoms. In other cases, explicit consent will be obtained.
5) Transfer of Personal Data (Domestic / International)
- Domestic Transfer: Personal data may be shared with public institutions and organizations when legally required, and with service providers such as logistics, accounting, auditing, IT, payment, infrastructure, consultancy, and business partners to the extent necessary.
- International Transfer: With explicit consent and under the conditions of Article 9 of the KVKK, data may be transferred abroad to cloud systems, email, backup, analytics, and marketing service providers, provided that adequate security measures are in place.
6) Retention Period and Destruction
Personal data are retained for the duration required by law or the purpose of processing. After this period, data are deleted, destroyed, or anonymized.
- Accounting and invoice records: 10 years (according to Turkish Tax Procedure Law and Turkish Code of Obligations)
- Customer transaction and communication records: 5 years
- Cookie/session data: 6 months – 2 years
- Marketing consent records: Until withdrawal of consent or until the maximum retention period expires
7) Technical and Administrative Measures
- Network and application security, firewalls, and encryption systems,
- SSL/TLS communication and access authorization controls,
- Logging, intrusion detection/prevention, and secure backups,
- Employee confidentiality commitments and KVKK awareness training,
- Inclusion of KVKK compliance clauses and audits in supplier contracts.
8) Rights of the Data Subject (Article 11 of KVKK)
- To learn whether personal data are processed,
- To request information regarding processing,
- To learn the purpose of processing and whether they are used accordingly,
- To know the third parties to whom data are transferred domestically or abroad,
- To request correction of incomplete or inaccurate data,
- To request deletion or destruction of personal data within the scope of the law,
- To request notification of these operations to third parties,
- To object to any adverse results arising from analysis solely by automated systems,
- To request compensation for damages suffered due to unlawful processing.
9) Application Procedures and Principles
You may exercise your rights by sending your request with identification documents through the contact channels listed below. Your requests will be answered free of charge within 30 days; however, if additional costs arise, fees may be charged in accordance with the KVKK and relevant regulations.
10) Enforcement, Updates, and Amendments
This Information Text was published on 06.11.2025 and may be updated by Dry Art when necessary. The most recent version will always be available at https://dryart.com.tr/en/personal-data-protection-law.
