KVKK DISCLOSURE TEXT

İdex Dış Ticaret Limited Company – Nurly Brand

1. Data Controller

Pursuant to the Law on the Protection of Personal Data No. 6698 (“KVKK”), your personal data are processed by the following data controller:

İDEX DIŞ TİCARET LİMİTED ŞİRKETİ
Trade Registry No: 230463-5
MERSİS No: 0465104794200001
Address: Akşemsettin Mah. Akdeniz Cad. No: 64 İç Kapı No: 3 Fatih / İstanbul
Phone: +90 212 877 0269
E-mail: destek@nurly.com.tr

Tax Office: Avcılar – Tax No: 4651047942

---

2. Purposes of Processing Personal Data

Your personal data are processed in accordance with Articles 5 and 6 of KVKK for the following purposes:

2.1 Order and Sales Processes

• Receiving orders

• Preparing and delivering products

• Issuing and archiving invoices

• Carrying out payment transactions

2.2 Customer Service

• Responding to support requests

• Managing return/exchange processes

• Complaint management

2.3 Marketing and User Experience

• Sending campaign and promotion announcements

• Improving user experience

• Website traffic and usage analytics

2.4 Legal Obligations

• Fulfilling tax obligations

• Keeping commercial records

• Responding to requests from authorized institutions

---

3. Categories of Processed Personal Data

The following categories of data may be processed:

• Identity Information: Name, surname

• Contact Information: Phone, address, e-mail

• Customer Transaction Info: Orders, invoices, requests, complaints

• Payment Information: Payment method (credit card data is processed by the payment provider, not stored by the Seller)

• Technical Data: IP address, cookies, session information

• Marketing Data: Cookie preferences, product browsing history

---

4. Methods and Legal Grounds for Collecting Personal Data

Your personal data are collected through the methods listed below:

(A) Methods

• Orders placed through www.nurly.com.tr

• Membership and contact forms

• Cargo delivery processes

• Payment infrastructures (iyzico / PayTR, etc.)

• Cookies and analytics tools

(B) Legal Grounds (KVKK Art. 5/2)

• Necessity for establishment or performance of a contract

• Compliance with legal obligations

• Explicit consent

• Legitimate interests requiring data processing

---

5. Transfer of Personal Data to Third Parties

Your personal data are transferred only to the extent necessary and limited to the purposes below:

5.1 Cargo Companies

• Delivery information (name-surname, address, phone number)

5.2 Payment Institutions

• Mandatory information for payment processes
  (credit card details are not transmitted to the Seller)

5.3 Service Providers

• Technical support

• Data backup services

• Website security providers

5.4 Public Authorities

• Courts, prosecutors, MASAK, and other authorized authorities when legally required

---

6. Retention Period of Personal Data

Your data are stored as required by KVKK and related legislation:

• Commercial records: 10 years

• Invoices and financial documents: 5–10 years

• Order data: Minimum 3 years

• Cookie data: 6–24 months

• Support records: 3 years

After the period ends, data are securely deleted, destroyed, or anonymized.

---

7. Your Rights Under KVKK Article 11

You have the following rights:

• To learn whether your personal data are processed

• To request information regarding processing

• To learn the purpose of processing and whether it is used appropriately

• To know third parties to whom data are transferred

• To request correction of incomplete or incorrect data

• To request deletion or destruction of data

• To object to processing based solely on automated systems

• To claim compensation for damages

For applications:
📩 destek@nurly.com.tr
📍 Address: Akşemsettin Mah. Akdeniz Cad. No: 64 İç Kapı No: 3 Fatih / İstanbul

---

8. Application Methods

You may submit KVKK-related requests through:

• Written application (wet signature)

• Registered Electronic Mail (KEP)

• Signed request sent to the data controller’s e-mail

• Other identity-verifying methods

The Seller will respond within 30 days.

---

9. Security Measures

To protect your data, the following measures are implemented:

• SSL certificate

• Secure server infrastructure

• Access control mechanisms

• Protection against unauthorized access

• Encryption systems

Your credit card information is never stored by the Seller.

---

10. Enforcement and Updates

This disclosure text enters into force on the date it is published.
İdex Dış Ticaret Limited Şirketi reserves the right to update the policy when necessary.

---