Privacy Policy and KVKK Notice

This English version is provided for information. In case of any conflict, the Turkish text prevails.

Last updated: 30.10.2026

1. Purpose and scope of this text

The website elisabettazanardi.com (the “Site”) is operated under the name Elisabetta Zanardi by ENVERO TEKSTİL SANAYİ VE TİCARET LİMİTED ŞİRKETİ (Envero Textile Industry and Trade Limited Company) (the “Company” or “we”). This text describes how we process your personal data when you visit the Site, shop, open an account, make a wholesale application, subscribe to our newsletter or write to us.

This text is the information notice prepared under Article 10 of the 6698 sayılı Kişisel Verilerin Korunması Kanunu (Personal Data Protection Law No. 6698, “KVKK”) and the Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ (Communiqué on the Procedures and Principles to be Followed in Fulfilling the Duty to Inform). Because we also sell goods to, and advertise to, people in the European Union (EU), accepting that Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), may apply to those people, it also contains the information required by Article 13 GDPR.

This text is for information; it does not ask for your approval. For processing based on your explicit consent (optional cookies, the newsletter and cart reminders), we ask for your consent separately and in a separate step. Confirming the Pre-Information Form or the Distance Sales Agreement does not mean that you have given consent for the newsletter, cart reminders or optional cookies.

This text covers the following people:

• Those who visit the Site.
• Our retail customers (those who place orders with or without opening an account).
• Owners, officers and employees of businesses that make a wholesale application or hold a wholesale account.
• Those who subscribe to our newsletter.
• Those who write to us through the contact form, e-mail or WhatsApp.

2. Data controller

The data controller under KVKK (the “controller” under the GDPR) is the following company:

Information	Value
Trade name	ENVERO TEKSTİL SANAYİ VE TİCARET LİMİTED ŞİRKETİ
Site and brand name	Elisabetta Zanardi
Address	Mimar Kemalettin Mah. Kızıltaş Sk. Tekcan İş Hanı No: 5 İç Kapı No: 401 Fatih / İstanbul
MERSİS no. (Central Registry System number)	0336042191900019
Tax office and no.	Beyazıt V.D. / 3360421919
Trade registry	İstanbul Ticaret Sicili Müdürlüğü (Istanbul Trade Registry Directorate), 515869-0
Telephone	+90 530 446 67 77
E-mail	info@elisabettazanardi.com
Electronic notification address (UETS)	25959-36608-08735
KEP address (Registered Electronic Mail)	None
E-mail for KVKK and GDPR applications	info@elisabettazanardi.com
Professional chamber	İstanbul Ticaret Odası (İTO) (Istanbul Chamber of Commerce)

The Company is established in Türkiye. There is therefore no separate data controller representative of the kind mentioned in Article 10 KVKK. Information on an EU representative and a data protection officer is in Section 11.2.

3. Summary: which data we process, why and for how long

The table below is a summary. Each row shows a single processing purpose and a single legal basis for that purpose; if the same data is processed for more than one purpose, it appears in separate rows. The details of each activity, how the data is collected and to whom it is transferred are in Section 4, and the location of recipients and transfers abroad are in Sections 5 and 6. The legal basis abbreviations in the table mean the following:

• KVKK Art. 5/1, GDPR Art. 6(1)(a): your explicit consent.
• KVKK Art. 5/2-c, GDPR Art. 6(1)(b): being directly related to the formation or performance of a contract (under the GDPR, entering into a contract with you or taking steps at your request before a contract).
• KVKK Art. 5/2-ç: being necessary for us to comply with a legal obligation. Because these obligations arise from Turkish law, the basis under the GDPR for persons in the EU is Article 6(1)(f) (our legitimate interest in complying with obligations arising from Turkish legislation).
• KVKK Art. 5/2-e: being necessary for the establishment, exercise or protection of a right (Article 6(1)(f) for the GDPR).
• KVKK Art. 5/2-f, GDPR Art. 6(1)(f): being necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed.

Activity	Data	Purpose	Legal basis (KVKK Art. 5 / GDPR Art. 6)	Recipients	Retention period
Receiving and delivering the order (4.1)	Name and surname, billing and delivery address, e-mail, telephone, products and amounts, order note, shipment tracking number	To receive, prepare, ship and deliver the order; to send order and tracking information by e-mail; to handle withdrawal, return and defective product requests	KVKK Art. 5/2-c / GDPR Art. 6(1)(b)	Hostinger (Germany), UNALSOFT Panel (Germany), Natro (e-mail), carriers	For as long as withdrawal, return and defect processes arising from the contract continue; afterwards the periods in the record rows below
Invoice, ledger and tax records (4.1)	Name and surname, billing address, products and amounts, invoice details; tax number for wholesale buyers. The invoice is sent on paper with the parcel	To issue invoices, keep commercial books and documents, comply with tax legislation	KVKK Art. 5/2-ç / GDPR Art. 6(1)(f) (for persons in the EU)	Financial adviser, competent public authorities, Hostinger (Germany), UNALSOFT Panel (Germany)	10 years
Pre-information and contract confirmation records (4.1)	The copy, filled in for your order, of the Pre-Information Form and Distance Sales Agreement you confirmed in a retail order, the time of confirmation, the language version shown	To keep the pre-information and confirmation records required by distance sales legislation	KVKK Art. 5/2-ç / GDPR Art. 6(1)(f) (for persons in the EU)	Hostinger (Germany), UNALSOFT Panel (Germany), Natro (sending by e-mail)	Together with the order record
Protection of a right (4.1)	Order, payment, return and correspondence records	To establish, exercise or protect our right in the event of a dispute or legal claim	KVKK Art. 5/2-e / GDPR Art. 6(1)(f)	Lawyers and judicial authorities (only if there is a dispute)	For the retention period of the record concerned
IP address and browser information in the order (4.1)	The IP address from which the order was placed and the browser information (user agent)	To prevent fraud and abuse in orders; if you have marketing permission, to make the purchase notification to Meta (4.9)	KVKK Art. 5/2-f / GDPR Art. 6(1)(f); for the notification to Meta, KVKK Art. 5/1 / GDPR Art. 6(1)(a)	Hostinger (Germany), UNALSOFT Panel (Germany); with marketing permission, Meta (including the USA)	1 year; then deleted (the period applying to the other records of the order does not apply to the IP address and browser information); for the copy reported to Meta, Meta’s own retention rules also apply
Cookie consent status at the time of the order (4.1)	Your cookie preference (analytics, marketing) in force at the time of the order	To determine, and prove where needed, which permission the recording of the order source and the purchase notification to Meta are based on	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	Hostinger (Germany), UNALSOFT Panel (Germany)	For as long as the order record is kept (together with the order record)
Order source (4.1, 4.9)	Which page or link led to the order (from the sbjs_* cookies)	To measure which pages lead to orders	KVKK Art. 5/1 (your analytics cookie permission) / GDPR Art. 6(1)(a)	Hostinger (Germany)	13 months from the order; then deleted. If you withdraw your analytics cookie permission, deleted earlier on your request
Payment and refund (4.2)	Order number and amount, payment result, amount charged to the card and currency; in orders converted into Turkish lira, the TCMB rate applied. The full card number, expiry date and security code do not reach us	To take payment, record the payment result on the order, make refunds	KVKK Art. 5/2-c / GDPR Art. 6(1)(b)	Denizbank A.Ş., UNALSOFT Panel (Germany)	Together with the order record; for the part kept as an accounting record, the period in the invoice row
Cart and payment step data: resolving technical problems and assistance (4.3)	Products in the cart and the cart total; the name, e-mail and telephone you write at the payment step (the address is not transferred); if you are logged in, the name, e-mail and telephone in your account	To detect and resolve technical problems at the payment step; to help if you tell us that you could not complete your order	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	UNALSOFT Panel (Germany), Hostinger (Germany)	90 days at the latest; if the order is completed, this data becomes part of the order record
Cart reminder (4.3)	The same data (name, e-mail, telephone, products in the cart)	To send a reminder by e-mail or WhatsApp if you have not completed the order; only with your separate consent and after İYS registration is completed	KVKK Art. 5/1 (explicit consent; also commercial electronic message consent under Article 6 of Law No. 6563) / GDPR Art. 6(1)(a)	UNALSOFT Panel (Germany); Natro for e-mail reminders, Meta for WhatsApp reminders. No SMS provider is used, because marketing and reminders are not sent by SMS	Until the 90-day period of the data expires or you withdraw your consent; no reminder is sent until İYS registration is completed
Customer account (4.4)	E-mail, name, hashed password, saved addresses	To open and manage the account, to let you log in, to let you use your addresses in later orders	KVKK Art. 5/2-c / GDPR Art. 6(1)(b)	Hostinger (Germany), UNALSOFT Panel (Germany), Natro (account e-mails)	As long as the account stays open. Account closure is done on request by e-mail; the data of a closed account is deleted within 30 days of the closure request. Records relating to orders are kept for the periods above
Wholesale application and wholesale account: sole proprietorship (4.5)	Name, e-mail, company name, telephone, tax number, country, address, city, postal code, agreed carrier, website, message	To evaluate the application; if approved, to operate the wholesale account and orders	KVKK Art. 5/2-c / GDPR Art. 6(1)(b)	Hostinger (Germany), UNALSOFT Panel (Germany), Natro, carriers	If approved, as long as the account stays open; rejected application 1 year; application left pending approval 1 year
Wholesale application and wholesale account: company officer or employee (4.5)	The same data	To establish and conduct the commercial relationship with the business you represent	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	The same recipients	If approved, as long as the account stays open; rejected application 1 year; application left pending approval 1 year
Contact form, e-mail and WhatsApp: messages relating to an order or contract (4.6, 4.7)	Name, e-mail, telephone, name shown on WhatsApp, subject, content of the message	To answer your request relating to your order or contract	KVKK Art. 5/2-c / GDPR Art. 6(1)(b)	Natro (e-mail), Meta (WhatsApp), Hostinger (Germany)	Together with the order record
Contact form, e-mail and WhatsApp: other messages (4.6, 4.7)	The same data	To answer your question or request	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	The same recipients	2 years; deleted at the end of the period
Sending the newsletter (4.8)	E-mail address	To send the newsletter; not sent until İYS registration is completed	KVKK Art. 5/1 (explicit consent; also commercial electronic message consent under Article 6 of Law No. 6563) / GDPR Art. 6(1)(a)	Natro (sending e-mail), Hostinger (Germany)	Until you withdraw your consent to your subscription; an unconfirmed registration at most 30 days
Newsletter consent and refusal records (4.8)	Date of consent or refusal, the form through which you consented, version of the consent text, language and country information	To prove that you consented and that you withdrew your consent	KVKK Art. 5/2-ç / GDPR Art. 6(1)(f) (for persons in the EU)	Hostinger (Germany)	3 years from the end of the consent, then deleted; for sending records, 4.8
Essential cookies: cart and session (4.9)	woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*	To keep the products you add to the cart and your cart session	KVKK Art. 5/2-c / GDPR Art. 6(1)(b)	These are the Site’s own cookies	For the duration of the session; wp_woocommerce_session_* 2 days
Essential cookies: login (4.9)	wordpress_logged_in_*	To let you log in to your account	KVKK Art. 5/2-c / GDPR Art. 6(1)(b)	These are the Site’s own cookies	For the duration of the session; 14 days if “remember me” is selected
Essential cookies: login security (4.9)	wordpress_sec_*, wordpress_test_cookie	Security of the login session and testing of the browser’s cookie acceptance	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	These are the Site’s own cookies	For the duration of the session; 14 days if “remember me” is selected (wordpress_test_cookie: session)
Currency, language and announcement bar preference (4.9)	zanardi_currency and zanardi_lang cookies; zanardi_currency record and zanardi_announcement_dismissed (browser session storage)	To remember the currency and language you selected and the announcement bar you closed	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	These are the Site’s own cookies	zanardi_currency and zanardi_lang cookies 1 year; the zanardi_currency session record and the announcement bar record until the browser tab is closed
Cookie preference record (4.9)	zanardi_consent cookie (in your browser); if you place an order, the cookie consent stamp in the order record (_zanardi_cx_consent; cookie text version, analytics and marketing choice, a personalisation flag that is always stored as off, date of the choice, consent ID)	To remember your cookie preference; by keeping your preference at the time of the order with the order, to determine, and prove where needed, which permission the recording of the order source and the purchase notification to Meta are based on	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	The Site’s own cookie; Hostinger (Germany), UNALSOFT Panel (Germany)	Cookie 1 year; the consent stamp in the order record for as long as the order record is kept
Saved list (4.9)	zcx_saved (the browser’s persistent storage)	To keep the list of products you saved with the heart icon only in this browser; the list is not sent to the store	The list stays only in your browser and does not reach us; there is therefore no personal data processing by us	None (stays only in your browser)	Until you remove the products from the list or delete browser data
Analytics cookies (4.9)	sbjs_* (order source); _ga and _ga_<kimlik> (Google Analytics 4); events sent to Google Analytics 4 (including the order number in the purchase event); zanardi_cx_sent (order numbers sent to Google Analytics 4, only in your browser)	To measure visits, page and shopping events, and the pages that lead to orders; to prevent the same purchase from being sent twice	KVKK Art. 5/1 (your analytics cookie permission) / GDPR Art. 6(1)(a)	Google (Google Analytics 4; including the USA)	Cookie and record periods are in the list in 4.9; data transmitted to Google Analytics is deleted at the end of the period in the data retention setting of our Google Analytics account
Measurement event queue (4.9)	zanardi_cx_q cookie: an event verified by the server (for example add to cart, form submission); contains no identifier	To pass the event on the next page to the measurement tools you have permitted	KVKK Art. 5/1 (your analytics or marketing cookie permission) / GDPR Art. 6(1)(a)	The Site’s own cookie; the event is passed to the tool you permitted (Google or Meta)	At most 5 minutes; deleted after being read
Marketing: Meta Pixel and Meta Conversions API (4.9)	_fbp, _fbc, zanardi_cx_engaged (only in your browser); through the Meta Pixel, the full address of the page you view (including campaign parameters and fbclid) and the address of the referring page, page view, shopping, form and click events (product codes, quantities, prices, amount, currency; for clicks also the type of page on which the click was made); from the server, only with marketing permission: a completed order (without price, amount and currency for wholesale users), a successfully submitted wholesale application or contact form, a click on a WhatsApp, e-mail or telephone link, a product view and an Engaged Visit; with every event the event name, time, event ID, page address (without the query string and the # fragment; my-account subpages are reduced to the base path; events on the order confirmation and order payment pages are not reported; for orders the general checkout page address, for forms the address of the page with the form), IP address, browser information and the _fbp/_fbc values; in an order also the product codes, quantities, item prices, amount, currency and order number (inside the event ID; without price, amount and currency for a Wholesale Order); on a product view the product code, the quantity and the retail price (for wholesale users without price, amount and currency) (from the server, name, e-mail, telephone, postal address and hashed personal data are not sent; because automatic advanced matching of the Meta Pixel is on, the e-mail address, telephone number, first name, last name, city, state/province, postal code and country you type into forms on pages where the Meta Pixel is loaded (including checkout) may be hashed in your browser and sent through the Meta Pixel)	To measure the results of our Instagram and Facebook advertisements; to show our advertisements to people who have visited our site, with Meta ad audiences (retargeting)	KVKK Art. 5/1 (your marketing cookie permission) / GDPR Art. 6(1)(a)	Meta (including the USA)	Cookies 90 days; Meta’s own retention rules also apply to data transmitted to Meta
Server logs (4.10)	IP address, browser information, requested page	To secure the Site; to detect and resolve attacks and faults	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	Hostinger (Germany)	nginx access logs 14 days; system log 7 days
Login security (4.11)	IP address, number and time of failed login attempts	To protect administration login against password-guessing attacks	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	Hostinger (Germany)	IP block 1 hour; block record deleted after 1 day
Backups (4.12)	A copy of the data stored on the Site and in UNALSOFT Panel (including order, account, wholesale application, cart and newsletter records)	To prevent data loss; to restore the Site in the event of a fault	KVKK Art. 5/2-f / GDPR Art. 6(1)(f)	Hostinger (Germany; the same server)	14 days (backups taken manually before updates: 30 days)

4. Our processing activities

Below we describe each processing activity separately: which data we process, for what purpose and on what legal basis, how we collect the data, to whom we transfer it and how long we keep it. If we process a datum for more than one purpose, we write the legal basis separately for each purpose.

We do not process your special categories of personal data (Article 6 KVKK; for example health information). Please do not share such information in your messages or order note.

4.1 Orders

We receive your retail and wholesale orders through the Site. When you place an order, your information is transferred to our order management system UNALSOFT Panel and a notification goes to our authorised staff. In retail orders, when your payment is approved, the Pre-Information Form and Distance Sales Agreement you confirmed are saved to your order filled in specifically for your order and sent to your e-mail address. Your invoice is sent on paper with the parcel.

• Data: name and surname; billing and delivery address; e-mail; telephone; the products you buy and amounts; your order note; shipment tracking number; the IP address from which the order was placed and the browser information (user agent); your cookie consent status at the time of the order; if you allowed marketing cookies, the Meta cookie values (_fbp, _fbc) until the purchase notification is made or can no longer be made; in retail orders, the record that you confirmed the Pre-Information Form and the Distance Sales Agreement and a copy of the text at the time of confirmation; tax number for wholesale buyers; if you permitted analytics cookies, the order source (which page or link led to the order).
• Purpose and legal basis, order performance: to receive, confirm, prepare and deliver your order; to send order information and the shipment tracking number by e-mail; to handle your withdrawal, return and defective product requests. Legal basis: being directly related to the formation or performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Purpose and legal basis, invoice and accounting: to issue invoices and keep commercial books and documents. Legal basis: compliance with our legal obligation (KVKK Art. 5/2-ç; for persons in the EU, GDPR Art. 6(1)(f), see Section 3).
• Purpose and legal basis, distance sales records: to keep the pre-information and confirmation records required by distance sales legislation. Legal basis: compliance with our legal obligation (KVKK Art. 5/2-ç; for persons in the EU, GDPR Art. 6(1)(f)).
• Purpose and legal basis, disputes: to establish, exercise or protect our right in a dispute. Legal basis: KVKK Art. 5/2-e (GDPR Art. 6(1)(f)).
• Purpose and legal basis, IP address and browser information: to prevent fraud and abuse in orders and, if you allowed marketing cookies, to make the purchase notification to Meta (4.9). Legal basis: for fraud prevention, our legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)); for the notification to Meta, your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
• Purpose and legal basis, cookie consent status: to determine, and prove where needed, which cookie permission the recording of the order source and the purchase notification to Meta are based on. Legal basis: our legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Purpose and legal basis, order source: to measure which pages lead to orders. Legal basis: your explicit consent to analytics cookies (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
• Method of collection: electronically, through the form you fill in at the payment step. The IP address, browser information, cookie consent status and order source are recorded automatically by the Site.
• Recipients: our hosting provider Hostinger; our order management system UNALSOFT Panel; Natro (mnic) for order e-mails; carriers for delivery (DHL Express or UPS for shipments within Türkiye and abroad; for shipments to Russia and Belarus, the private carrier agreed by the Seller); Denizbank A.Ş. for payment and refunds; our financial adviser for accounting; our legal adviser where necessary; where legislation requires, competent public authorities and judicial authorities. The Hostinger and UNALSOFT Panel servers are in Germany (Section 6). Details are in Section 5.
• Retention period: order, invoice and accounting records are kept for 10 years. The IP address and browser information saved to the order are not subject to the 10-year period of the order record; they are kept for 1 year to the extent necessary for the purpose of preventing fraud and then deleted. If you allowed marketing cookies at the time of the order, this information is also sent once to Meta with the purchase notification within at most 24 hours of the order (4.9). The order source information is deleted from the order 13 months after the order; if you withdraw your analytics cookie permission, you may also request earlier deletion of the order source information in your earlier orders. The pre-information and confirmation records, which must be kept for 3 years under Article 20(1) of the Mesafeli Sözleşmeler Yönetmeliği (Distance Contracts Regulation), are kept with the order record because they are part of the order record. The cookie consent status at the time of the order is kept with the order record for as long as the order record is kept.

4.2 Payment

On the Site, retail payments are taken only by card and in a single instalment. Card payment is made through the virtual POS service of Denizbank A.Ş. and through UNALSOFT Panel. You enter your card details (card number, expiry date, security code) yourself directly on the bank’s 3-D Secure payment page. Your full card number, expiry date and security code do not reach the Site and our order management system; they are neither seen nor stored by us.

You place your order in the currency you select on the Site (USD, EUR or TRY); the currency of your order is shown in the order summary at the payment step and the amount in this currency is charged to your card. If your delivery address (your billing address if there is no separate delivery address) is in Türkiye and your order was placed in USD or EUR, the order total is converted into Turkish lira at the TCMB selling rate, no margin is added to this rate, and Turkish lira is charged to your card; the Turkish lira amount and the rate applied are shown on the confirmation screen before the bank’s payment page and are recorded on your order. The amount that can be charged to your card in a single transaction is limited to TL 200,000 (Turkish lira) or its equivalent in the order currency at the TCMB rate; for orders exceeding this amount, the payment method is agreed separately with you, and the data to be processed under that method is notified to you separately at that time.

• Data: order number and amount; the result of the payment; the amount charged to the card and the currency; in orders converted into Turkish lira, the TCMB rate applied; where a refund is needed, the order and payment information necessary for the refund request.
• Purpose and legal basis, payment and refund: to take payment, record the payment result on your order, make refunds. Legal basis: performance of the contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Purpose and legal basis, accounting: to keep accounting records relating to payment. Legal basis: compliance with our legal obligation (KVKK Art. 5/2-ç; for persons in the EU, GDPR Art. 6(1)(f)); this purpose is the same as the invoice and accounting record in 4.1.
• Method of collection: the payment result and the amount charged come electronically from the bank through UNALSOFT Panel.
• Recipients: Denizbank A.Ş.; UNALSOFT Panel. The bank processes your card details and the 3-D Secure verification within the framework of its own legislation; the bank’s own information notice applies to this processing.
• Retention period: together with the order record; for the part kept as an accounting record, the period in 4.1.

4.3 Cart and payment step data

The products in your cart and the cart total, and the name, e-mail and telephone details you write at the payment step, are transferred to our order management system UNALSOFT Panel whenever your cart changes; your address details are not part of this transfer. If you are logged in to your account, the name, e-mail and telephone saved in your account are also transferred. This transfer is made even if you do not complete the order. A short note about this transfer and a link to this text are shown on the payment page. We process this data for two separate purposes: resolving technical problems and assistance (for every customer) and cart reminders (only for those who give separate consent).

• Data: the products in your cart and the cart total; the name, e-mail and telephone you write at the payment step (the address is not transferred); if you are logged in, the name, e-mail and telephone in your account.
• Purpose and legal basis, resolving technical problems and assistance: to detect and resolve technical problems at the payment step; to help you complete your order when you tell us that you could not complete it (for example when you write to us by e-mail or WhatsApp). Legal basis: our legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). For this purpose we contact you only if you write to us.
• Purpose and legal basis, cart reminder: to send you a reminder by e-mail or WhatsApp if you have not completed the order. Legal basis: your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)) and your commercial electronic message consent under Article 6 of Law No. 6563. At the date this text is published, no cart reminders are sent; reminders are sent only to those who give this separate consent, and if you do not consent, we do not send reminders. You can withdraw your consent at any time. Commercial electronic messages are not sent until our registration in the İleti Yönetim Sistemi (İYS, Message Management System) is completed; cart reminders are therefore not sent until that date either.
• We do not use this data for marketing other than for the two purposes above.
• Method of collection: through the form fields at the payment step, automatically by the Site as you proceed, and electronically.
• Recipients: UNALSOFT Panel; Hostinger (both are in Germany, Section 6). If a reminder is sent, according to the channel chosen, Natro (mnic) for e-mail and Meta for WhatsApp. No SMS provider is used, because marketing and reminders are not sent by SMS.
• Retention period: if the order is completed, this data becomes part of the order record (4.1). If the order is not completed, it is deleted after 90 days.

4.4 Customer account

You do not need to open an account to place an order. If you open an account, the following data is processed. Orders you place with your account are processed under 4.1.

• Data: e-mail; name; the hashed form of your password; your saved addresses. We do not see or store your password in clear text.
• Purpose and legal basis: to open and manage your account; to let you log in to your account securely; to let you use your saved addresses in later orders. Legal basis: formation and performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Method of collection: electronically, through the forms you fill in when opening and updating your account.
• Recipients: Hostinger; UNALSOFT Panel (both are in Germany); Natro (mnic) for account e-mails.
• Retention period: as long as your account stays open. There is no feature on the Site to delete your account yourself; you ask for your account to be closed by writing to info@elisabettazanardi.com, and the account is closed on this request. The data of a closed account is deleted within 30 days of the closure request. Even if your account is closed, the invoice, accounting and contract records relating to your orders are not deleted by the account closure request; they are kept for the period in 4.1.

4.5 Wholesale application and wholesale account

Wholesale sales are made only with approved wholesale accounts. When you send the application form, a user account is created for you on the Site; this account stays in “pending” status until your application is approved. Applications are evaluated by administrator approval; your application is not automatically rejected by the system. Wholesale purchasing is a commercial transaction; commercial legislation, not consumer legislation, applies to wholesale buyers. The personal data you give us as an owner, officer or employee of a business is protected according to this text.

• Data: name; e-mail; company name; telephone; tax number; country; address, city and postal code; your agreed carrier; your website; your message. After approval, the data relating to your wholesale orders is processed under 4.1.
• Purpose and legal basis, sole proprietorship: if the wholesale buyer is a sole proprietorship and the application is made by the business owner, to evaluate the application, if approved to open and manage the wholesale account, to apply wholesale price and size run terms, and to receive, invoice and ship orders. Legal basis: formation and performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Purpose and legal basis, company officer or employee: if you make the application as an officer or employee of a company, to establish and conduct the commercial relationship with your business and to communicate with you. Legal basis: our legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Purpose and legal basis, tax and invoice: to process the tax number and invoice details for the invoice and accounting record. Legal basis: legal obligation (KVKK Art. 5/2-ç; for persons in the EU, GDPR Art. 6(1)(f)); this purpose is the same as the invoice and accounting record in 4.1.
• Method of collection: electronically, through the wholesale application form on the Site; afterwards through your correspondence with us.
• Recipients: Hostinger; UNALSOFT Panel (both are in Germany); Natro (mnic) for e-mails; for wholesale shipments, the buyer’s carrier or our DHL Express or UPS shipment; Denizbank A.Ş. for payment (in wholesale orders payment is taken only by card); our financial adviser for accounting.
• Retention period: if your application is approved, for as long as your wholesale account stays open; records of wholesale orders for the period in 4.1. If your application is rejected, your application data is deleted after 1 year. Applications left pending approval are deleted after 1 year.

4.6 Contact form and e-mail

Messages you send through the contact form are not saved in the Site’s database. Your message is forwarded to us by e-mail and, depending on its subject, goes to our wholesale or general mailbox. An automatic reply stating that your message has been received is sent to you.

• Data: name; e-mail; subject; your message. If you e-mail us directly, your e-mail address and what you write.
• Purpose and legal basis, messages relating to an order or contract: to answer your question or request. Legal basis: formation and performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Purpose and legal basis, other messages: to answer your question or request, to route your message to the relevant mailbox, to let you know that your message has been received. Legal basis: our legitimate interest in being able to respond to your request (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Method of collection: electronically, through the contact form on the Site or by e-mail.
• Recipients: our mailboxes and Natro (mnic; an Open-Xchange based e-mail service) for sending e-mail; Hostinger (Germany) for the server on which the form runs. Natro’s mail servers may be abroad (Section 6).
• Retention period: 2 years in our mailbox; messages relating to an order or contract together with the order record (4.1).

4.7 WhatsApp

The WhatsApp link on the Site redirects you to the WhatsApp application owned by Meta and to our WhatsApp line shown on the Site. Using WhatsApp is optional; if you wish, you may also write to us by e-mail. WhatsApp correspondence is processed on Meta’s infrastructure. Meta also processes this data under its own privacy policy.

• Data: your telephone number; the name shown on your WhatsApp; the content of our correspondence.
• Purpose and legal basis, correspondence relating to an order or contract: to answer your question or request; to receive your requests for changes to the order before shipment. Legal basis: formation and performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Purpose and legal basis, other correspondence: to answer your question or request. Legal basis: our legitimate interest in being able to respond to your request (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). For transfer abroad, see Section 6.
• Method of collection: electronically, when you write to us on WhatsApp.
• Recipients: Meta (WhatsApp).
• Retention period: 2 years; correspondence relating to an order or contract together with the order record (4.1).

4.8 Newsletter (Zanardi Letter)

You subscribe to our newsletter called Zanardi Letter only if you wish to. The newsletter sends announcements of new collections, campaigns and events. Subscription is in two steps: first you tick the consent box in the form, then you confirm by clicking the link in the e-mail we send you. The link is valid for 7 days. If you do not confirm with the link, you do not subscribe and no newsletter is sent to you. Registrations not confirmed within 30 days of the registration date are deleted automatically every day.

Every newsletter contains an unsubscribe link. You can withdraw your consent at any time, without giving a reason and free of charge, with this link or by writing to us. Placing an order or opening an account does not mean newsletter consent.

No commercial electronic message, including the newsletter, is sent until our registration in the İleti Yönetim Sistemi (İYS, Message Management System) is completed. At the date this text is published there is no İYS registration, so no commercial electronic message, including the newsletter, is sent.

• Data: your e-mail address; your consent record (date of consent or refusal, the form through which you consented, version of the consent text, language and country information).
• Purpose and legal basis, sending the newsletter: to send the newsletter. Legal basis: your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)) and also your commercial electronic message consent under Article 6 of the 6563 sayılı Elektronik Ticaretin Düzenlenmesi Hakkında Kanun (Law No. 6563 on the Regulation of Electronic Commerce).
• Purpose and legal basis, consent records: to prove that you consented and that you withdrew your consent. Legal basis: legal obligation (KVKK Art. 5/2-ç; for persons in the EU, GDPR Art. 6(1)(f)).
• Method of collection: electronically, through the newsletter form on the Site and the link in the confirmation e-mail.
• Recipients: Natro (mnic) for sending e-mail; Hostinger (Germany).
• Retention period: your subscription continues until you withdraw your consent. Unconfirmed registrations are deleted within 30 days at the latest. Consent and refusal records are kept for 3 years from the end of the consent and deleted at the end of that period.

4.9 Cookies and similar technologies

Cookies and similar technologies are used on the Site. The full list of cookies, their purposes and periods is also in the Cookie Policy (elisabettazanardi.com/cookie-policy/). A summary is given below.

With the cookie banner we ask which optional cookies you permit. Until you make a choice, no optional cookie is loaded and no external tracking code is loaded. Essential cookies are saved only when you perform the relevant action (when you select a currency or language, add a product to the cart, log in); the Site does not save cookies to your browser without such an action and without a cookie choice. The “Necessary only”, “Accept all” and “Choose” buttons have equal weight; with “Choose” you can select the categories one by one and save with “Save choices”. You can change your choice at any time from the “Cookie settings” link at the bottom of every page. When you reject analytics and marketing cookies, these cookies are deleted from your browser. However, the Site cannot delete cookies that companies providing measurement and advertising services write to their own domains; you can delete them in your browser’s settings.

Your consent is valid for 1 year; when the period expires your preference is asked again. Your preference is also asked again when the cookie text changes or when the measurement and marketing tools used on the Site change. Your choice is kept in the zanardi_consent cookie in your browser; no separate consent record is kept on our server. When you place an order, your cookie consent status at that moment (your analytics and marketing choice, the version of the cookie text, the date of the choice and the consent ID in the cookie) is saved to the order (4.1).

The list below is identical to the cookie and record list in the Cookie Policy. The * sign in a cookie name shows a variable suffix that the site adds to the end of the cookie name; the <kimlik> (<id>) in the _ga_<kimlik> cookie shows a suffix derived from our Google Analytics measurement ID.

Cookie or record name	Provider	Group	Purpose	Duration	Party
zanardi_consent	Our site	Essential	Stores your cookie preference: the version of the cookie text and the short code of the tools active on the site at the time of the choice, your analytics and marketing choice, the date of the choice and a consent ID (made up of the creation time and random characters).	1 year	First party
zanardi_currency	Our site	Essential	Remembers the currency you selected; saved when you select a currency. Cannot be read by code on the page (HttpOnly). SameSite=Lax.	1 year	First party
zanardi_lang	Our site	Essential	Remembers the language you selected; saved when you select a language in the language selector. It is written by code on the page, so it is not HttpOnly. SameSite=Lax.	1 year	First party
zanardi_currency (the browser’s session storage, sessionStorage)	Our site	Essential	Saved when you select a currency in the currency selector; remembers the currency you selected in this tab, so that a page you return to with the browser’s back or forward button is shown in the currency you selected.	Session (deleted when the tab or browser closes)	First party
woocommerce_cart_hash	Our site (WooCommerce)	Essential	Tracks changes in the contents of your cart so that the cart is shown correctly. Saved when you perform a cart action (for example, when you add a product to the cart).	Session (deleted when the browser closes)	First party
woocommerce_items_in_cart	Our site (WooCommerce)	Essential	Remembers whether there are products in your cart. Saved when you perform a cart action.	Session (deleted when the browser closes)	First party
wp_woocommerce_session_*	Our site (WooCommerce)	Essential	Recognises your cart session and remembers the products in your cart. Saved when you perform a cart action.	2 days	First party
wordpress_logged_in_*	Our site (WordPress)	Essential	Remembers that you have logged in to your account. Set only for those who log in.	Session; 14 days if “Remember me” is selected at login	First party
wordpress_sec_*	Our site (WordPress)	Essential	Securely verifies your login session. Set only for those who log in.	Session; 14 days if “Remember me” is selected at login	First party
wordpress_test_cookie	Our site (WordPress)	Essential	Tests, during login, whether your browser accepts cookies.	Session	First party
zanardi_announcement_dismissed (the browser’s session storage, sessionStorage)	Our site	Essential	Remembers that you have closed the announcement bar at the top of the page, so that the bar is not shown again in the same session.	Session (deleted when the tab or browser closes)	First party
zcx_saved (the browser’s persistent storage, localStorage)	Our site	Essential	Keeps, only in this browser, the list of products you saved with the heart icon (product number, name, address, image, the colour you selected and the time of saving). The list is not sent to the store; it contains no price, stock or personal information.	No set period; stays until you remove the products from the list or delete browser data	First party
zcx_probe (the browser’s persistent storage, localStorage)	Our site	Essential	Tests, before the saved list, whether the browser’s persistent storage is usable; deleted immediately after being written.	Deleted immediately	First party
sbjs_current, sbjs_first, sbjs_current_add, sbjs_first_add, sbjs_udata, sbjs_session, sbjs_migrations	Our site (WooCommerce order attribution)	Analytics (only with your permission)	Records the source from which you came to the site (referring site and campaign link information), the first page you entered the site on, and the page or link that led to the order. If you place an order, this information is added to your order and deleted 13 months after the order.	Session (deleted when the browser closes); sbjs_session 30 minutes	First party
zanardi_cx_q	Our site	Analytics or marketing (only with your permission)	Passes an event verified by the server (for example add to cart, form submission) on the next page to the measurement tools you have permitted. Written only if you gave permission, contains no identifier, and is deleted after being read.	At most 5 minutes	First party
zanardi_cx_sent (the browser’s persistent storage, localStorage)	Our site	Analytics (only with your permission)	Keeps the order numbers of the purchase events sent from this browser to Google Analytics 4 and the time of sending, so that the same purchase is not sent a second time when the order confirmation page is reopened. Not sent to the store.	At most the last 20 orders; records older than 30 days are disregarded and removed from the list at the next write. The list is deleted when you withdraw your analytics permission.	First party
zanardi_cx_engaged (the browser’s session storage)	Our site	Marketing (only with your permission)	Remembers that the Engaged Visit event was sent once in this session; holds only the value “1” and is not sent to the shop; deleted when you withdraw marketing permission.	Session (deleted when the tab or browser is closed)	First party
_ga	Google (Google Analytics 4)	Analytics (only with your permission)	Distinguishes visitors from one another to produce visit statistics.	At most 13 months	First party; data is transmitted to Google (third-party service)
_ga_<kimlik>	Google (Google Analytics 4)	Analytics (only with your permission)	Stores session information for visit statistics.	At most 13 months	First party; data is transmitted to Google (third-party service)
_fbp	Meta (Meta Pixel)	Marketing (only with your permission)	Recognises your browser; used to measure the results of our Instagram and Facebook advertisements and to show our advertisements on these platforms to people who have visited our site (Meta ad audiences).	90 days	First party; data is transmitted to Meta (third-party service)
_fbc	Meta (Meta Pixel)	Marketing (only with your permission)	If you came to the site by clicking a Facebook or Instagram advertisement, stores the information of that click; used to measure advertisement results and for ad audiences.	90 days	First party; data is transmitted to Meta (third-party service)
fr	Meta (Meta Pixel)	Marketing (only with your permission)	According to Meta’s description, used to show, measure and improve the relevance of Meta advertisements.	90 days	Third party (facebook.com)
datr	Meta (Meta Pixel)	Marketing (only with your permission)	Recognises your browser for security and fraud prevention.	400 days	Third party (facebook.com)

Calling a cookie “essential” does not, by itself, mean that no consent is required; the legal basis of each cookie and similar technology is written separately in the table in Section 3.

Google Analytics 4 is loaded only if you permit analytics cookies; if you do not give permission, the Google Analytics code is not loaded on the page at all. Google’s Consent Mode v2 is used in basic mode. Google signals and the use of Google Analytics data for ad personalisation are off in every case. Besides page views, the events sent to Google Analytics 4 are product views, add to cart, begin checkout, purchase, submission of the contact form and the wholesale application form, newsletter sign-up and clicks on the WhatsApp button. In shopping events, product codes, product names, quantities, prices, the total amount and the currency are included, and in the purchase event the order number as well; no price or amount information is sent for wholesale orders. The order key in the address of the order confirmation page is removed from the address before it is sent to Google. To prevent the same purchase from being sent to Google Analytics 4 twice, the order numbers sent are kept, together with the time of sending, only in your browser, in the zanardi_cx_sent record.

The Meta Pixel is loaded only if you permit marketing cookies; if you do not give permission, the Meta Pixel code is not loaded on the page at all and no notification is made from our server to Meta. The Meta Pixel transmits to Meta page views and the events of product view, add to cart, begin checkout, submission of the contact form and the wholesale application form, newsletter sign-up and clicks on the WhatsApp, e-mail and telephone links; it also transmits a custom event called “Engaged Visit” (EngagedVisit) when you actually spend time on a page (details below); in shopping events, product codes, quantities, prices, the total amount and the currency are also sent. The Meta Pixel is not loaded on the order confirmation and order payment pages. Automatic collection of button clicks and page information is off. The “automatic advanced matching” feature of the Meta Pixel is on: if you have allowed marketing cookies, the e-mail address, telephone number, first name, last name, city, state/province, postal code and country you type into forms on pages where the Meta Pixel is loaded (including checkout) may be hashed in your browser and sent to Meta through the Meta Pixel; Meta uses them to match you with its own users. Our server does not send this information. Of these events, we also report product views, Engaged Visits, submissions of the wholesale application and contact forms and clicks on the WhatsApp, e-mail and telephone links, and in addition completed orders, from our server to Meta through the Meta Conversions API; page views, add to cart, begin checkout and newsletter sign-up are sent only from your browser. Every notification from our server is made only if you allowed marketing cookies; for the order notification, you must have allowed them at the time of the order. The following events are reported from our server: (1) Purchase: a completed order, that is, when the order changes to “processing” or “completed” and was placed at most 24 hours earlier; for orders of wholesale users, a “Wholesale Order” (WholesaleOrder) event without any price or amount is reported instead. (2) Lead: a successfully submitted wholesale application or contact form, and a click on a WhatsApp, e-mail or telephone link; for a click, only the name of the channel (whatsapp, email or phone) is sent, never the address or the number itself. (3) View Content (ViewContent): your viewing of a product page; the content type (product), the product code (SKU), the quantity (1), the item price, and the value and currency (equal to the retail price) are sent; no price information is sent for wholesale users. (4) Engaged Visit (EngagedVisit, custom event): you stay at least 10 seconds on a visible page and also scroll at least 25% of it or touch, click or press a key; the page type (product, wholesale, shop, home or other) is sent. With every event the following is sent: the event name, the event time, an event ID, the action source (website), the address of the page where the event happened (without the query string and the # fragment; the addresses of my-account subpages are reduced to the base path; events on the order confirmation and order payment pages are not reported from the server at all; for Purchase and Wholesale Order the general checkout page address is sent, for form events the address of the page with the form), and, as user data, your IP address, the user agent of your browser and, if present, the values of the Meta cookies _fbp and _fbc (_fbc is created when the address contains an fbclid parameter). The event ID is generated at random and is the same as that of the matching Meta Pixel event in your browser, so that Meta does not count the same event twice. For an order, the ID is derived from the order number; because the Meta Pixel is not loaded on the order pages, the same order is not also sent from your browser. A Purchase event additionally carries the product codes, quantities, item prices, the total amount, the currency and the order number (inside the event ID); a Wholesale Order event carries the product codes, quantities and the order number (inside the event ID), and no price, amount or currency. Nothing else is sent from our server: your name, e-mail address, telephone number, postal address and any external ID are not sent, and no hashed personal data is sent either. The _fbp and _fbc values are saved on your order for the order notification and are deleted from the order once the notification is made or can no longer be made (if the order is not paid within 24 hours, at the latest at the next daily cleanup; if it is cancelled or fails). The recipient of Meta Pixel and Conversions API data is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland); Meta may share this data with Meta Platforms, Inc. in the USA. If you allow marketing cookies, besides measuring the results of our advertisements, this data is also used to show our advertisements on Instagram and Facebook to people who have visited our site: we may add you to our ad audiences at Meta (custom audiences, retargeting). If you do not give permission, we do not add you to these audiences through our site; after you withdraw your permission, no new data is sent from our site to Meta; only if the payment confirmation of an order you placed while your permission was in place arrives outside your browser (from the bank or our order management system) may that order still be reported within at most 24 hours of the order. If you have an Instagram or Facebook account, Meta may match this information with your account and also process it for its own purposes; Meta’s own privacy policy applies to this processing.

• Legal basis, essential cookies: written separately for each cookie in the table in Section 3 (cart and session, login to the account: KVKK Art. 5/2-c; login security, preference and currency cookies: KVKK Art. 5/2-f; because the saved list stays only in your browser, there is no personal data processing by us). Analytics and marketing cookies: your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
• Method of collection: automatically, through your browser, when you use the Site.
• Recipients: essential cookies and order source cookies are the Site’s own cookies. If you permit, Google Analytics data goes to Google, and Meta Pixel and Meta Conversions API data goes to Meta (the recipient is Meta Platforms Ireland Limited; Meta may share this data with Meta Platforms, Inc. in the USA).
• Retention period: the periods in the table.

Google Search Console, which we use to monitor how the Site appears in Google search, reports only aggregated query, impression and click counts relating to Google search; it uses no cookies on the Site and collects no data about our visitors.

Fonts: The fonts on our pages are loaded from the Site’s own server; therefore your IP address is not transmitted to Google or any other font service for fonts.

4.10 Server logs

When you visit the Site, our server keeps technical logs.

• Data: IP address; browser information; requested page.
• Purpose: to secure the Site; to detect and resolve attacks and faults.
• Legal basis: our legitimate interest in the security of the Site (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). Article 12 KVKK makes it mandatory to take data security measures; it does not, of itself, require these logs to be kept for a particular period.
• Method of collection: automatically by the server when you access the Site.
• Recipients: Hostinger (Germany).
• Retention period: access logs are rotated daily and kept for 14 days; the system log is kept for 7 days. These periods have been set according to our own security needs; they are not presented as a period provided for by any law.

4.11 Login security

To prevent password-guessing attacks against administration login, an IP address that makes 5 failed login attempts within 5 minutes on the WordPress login page is blocked for 1 hour. In addition, there is rate limiting on our server, and only permitted IP addresses can access the administration pages. For server events sent with marketing permission, a hash of your IP address is kept for at most 10 minutes for rate limiting. These are technical measures for security purposes; they are not an automatic rejection system that makes decisions about anyone.

• Data: IP address; number and time of failed login attempts.
• Purpose: to protect administration login and the Site against unauthorised access.
• Legal basis: our legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). The data security obligation in Article 12 KVKK is the reason for these measures.
• Method of collection: automatically by the Site during the login attempt.
• Recipients: Hostinger (Germany).
• Retention period: the IP block lasts 1 hour; the block record is deleted after 1 day.

4.12 Backups

To protect against data loss, the data on our server is backed up: the Site’s database every day, the Site’s files (the wp-content folder and configuration files) once a week on Sundays, and the UNALSOFT Panel database and uploaded files every day. A backup may also be taken manually before the Site or the Panel is updated. The backups contain a copy of the data stored on the Site and in the Panel and are used only for restoration in the event of data loss or a fault.

• Data: a copy of the data stored on the Site and in UNALSOFT Panel (including order, account, wholesale application, cart and newsletter records).
• Purpose: to prevent data loss; to restore the Site in the event of a fault.
• Legal basis: our legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). The data security obligation in Article 12 KVKK is the reason for backing up.
• Method of collection: automatically by scheduled jobs on the server (the Site’s database and UNALSOFT Panel every day, the Site’s files on Sundays); backups before updates are taken manually.
• Recipients: the backups are kept on the same server as the Site and UNALSOFT Panel, in Hostinger’s data centre in Germany; there is no copy outside the server.
• Retention period: scheduled backups are kept on the same server for 14 days and then automatically deleted. Backups taken manually before updates are deleted after 30 days. Data that we have deleted may remain in the backups until these periods expire.

5. To whom we transfer the data

We transfer your personal data only for the purposes written in this text and to the extent necessary, in accordance with Articles 8 and 9 KVKK. We do not sell your personal data.

Recipient	For what	Data transferred	Location	Role
Hostinger International Ltd. (hosting, VPS)	The server on which the Site runs and backups	All data processed on the Site	Germany (Frankfurt am Main)	Data processor
UNALSOFT (UNALSOFT Panel)	Order management, payment and refund processing, notification to staff	Order, customer, wholesale customer, cart and payment step data	Germany (Frankfurt am Main; the Panel and database run on the same server at Hostinger)	Data processor (the service is operated by UNALSOFT)
Denizbank A.Ş.	Card payment (virtual POS, 3-D Secure) and card refunds	Order and amount information necessary for payment and refund; you enter your card details directly to the bank	Türkiye	Separate data controller (within the framework of banking legislation)
Natro (mnic)	Mailboxes and sending of e-mail (Open-Xchange based service)	Name, e-mail address, telephone, subject and content of the e-mail (orders, accounts, contact form, newsletter and incoming e-mail)	Türkiye (provider); mail servers may be abroad	Data processor
Carriers: DHL Express, UPS; for shipments to Russia and Belarus, the private carrier agreed by the Seller	Delivery; customs procedures in shipments abroad	Name, delivery address, telephone; in shipments abroad, the contents and value of the shipment	Türkiye and the country of destination of the shipment	Separate data controller
Google	Google Analytics 4, only with your permission. Google Search Console does not collect visitor data	If you permit, visit, usage and shopping event measurement data (including the order number in the purchase event)	Including the USA; the countries where Google or its sub-processors have facilities	Data processor for Google Analytics; separate data controller for processing Google carries out for its own purposes
Meta	WhatsApp; Meta Pixel and Meta Conversions API, only with your permission	WhatsApp correspondence; if you permit, page view, shopping, form and click events; from the server the Purchase, Wholesale Order, Lead, View Content and Engaged Visit events: event name and time, event ID, page address, IP address, browser information, cookie identifiers, and in an order also the product codes, quantities, item prices, amount, currency and order number (inside the event ID; without price, amount and currency for a Wholesale Order); also from your browser, because automatic advanced matching of the Meta Pixel is on, the e-mail address, telephone number, first name, last name, city, state/province, postal code and country you type into forms on pages where the Meta Pixel is loaded (including checkout), which may be sent in hashed form (for advertisement measurement and ad audiences)	Including the USA	Separate data controller; joint controller for visitors in the EEA with respect to the Meta Pixel and Conversions API
Financial adviser and legal adviser	Accounting, tax and legal advice	Invoice and accounting records; relevant data if there is a dispute	Türkiye	Separate data controller or data processor
Competent public bodies and institutions, judicial authorities	Legal obligations, official requests and disputes	Data requested to the extent legislation permits	Türkiye	Separate data controller

Hostinger, UNALSOFT and Natro (mnic) process data on our behalf and in line with our instructions (data processors). The bank, carriers, Google, Meta and public bodies carry out some processing under their own responsibility; their own information notices also apply to that processing. With respect to visitors in the European Economic Area, at the stage of collecting data with the Meta Pixel and the Meta Conversions API and transmitting it to Meta, we are joint controllers with Meta; the essentials of this joint responsibility are in the controller addendum attached to Meta’s business tools terms. For processing after this stage Meta is itself responsible. The recipient of Meta Pixel and Conversions API data is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland); Meta may share this data with Meta Platforms, Inc. in the USA.

6. Transfer abroad

Article 9 KVKK was amended in 2024 by Law No. 7499. Accordingly, provided that one of the conditions in Article 5 or 6 KVKK is present, personal data may be transferred abroad only in the following cases:

1. If there is an adequacy decision of the Kişisel Verileri Koruma Kurulu (Personal Data Protection Board) on the country to which it will be transferred.
2. If there is no adequacy decision, if one of the appropriate safeguards listed in the Law is provided, on condition that you can exercise your rights and have recourse to effective legal remedies in the country to which it is transferred (for example a standard contract notified to the Authority within five business days of being signed).
3. If neither is present, only in incidental transfers, that is, transfers that are not regular and continuous, and in one of the cases listed in the Law (for example if it is necessary for the performance of the contract we have with you, or if you have given explicit consent after being informed of the possible risks).

Regular and continuous transfers such as the hosting of the Site and order management cannot be regarded as incidental transfers. We do not base these transfers on the incidental transfer exception or on consent in the cookie banner; an adequacy decision or an appropriate safeguard is required.

Your data is transferred outside Türkiye in the following cases:

• Hostinger (Germany, Frankfurt am Main): The Site’s server is a virtual private server (VPS) in Hostinger International Ltd.’s data centre in Frankfurt am Main. All data processed on the Site, including order, account, wholesale application, cart and newsletter records, and backups, are stored on this server. This transfer is regular and continuous.
• UNALSOFT Panel (Germany, Frankfurt am Main): the order management system runs on the same server and the Panel’s database is also in Germany. Order, customer, wholesale customer, cart and payment step data is thus processed outside Türkiye. The Panel service is operated by UNALSOFT.
• E-mail (Natro): Natro is an e-mail provider established in Türkiye; its mail servers may be abroad. In that case your e-mail correspondence is also regularly processed outside Türkiye.
• Google (including the USA): Google Analytics 4 data, if you permit.
• Meta (including the USA): your correspondence if you write to us on WhatsApp; Meta Pixel and Meta Conversions API data, if you permit.
• DHL Express, UPS and, for shipments to Russia and Belarus, the private carrier agreed by the Seller: the data needed for delivery and customs procedures in shipments abroad, to the destination country of the shipment.

Transfer mechanism for Hostinger and UNALSOFT Panel: For the regular transfers to this server in Germany, the use of a standard contract is envisaged among the appropriate safeguards listed in Article 9/4 KVKK. At the date this text is published, a standard contract has not been signed with Hostinger and UNALSOFT and has not been notified to the Personal Data Protection Board.

Transfers to Google and Meta: Your data is transferred to these companies only with your permission (Google Analytics 4, Meta Pixel and the Meta Conversions API) or if you write to us on WhatsApp. At the date this text is published, there is no standard contract notified to the Personal Data Protection Board for these transfers. Your data may not be protected in countries outside Türkiye, such as the USA, at the same level as the safeguards in Türkiye, the public authorities of these countries may access the data, and exercising your rights there may become difficult.

If you are in the EU: we collect your data directly from you, as a controller established in Türkiye. There is no European Commission adequacy decision on Türkiye. The EU-US Data Privacy Framework does not replace the conditions for transfers from Türkiye in Article 9 KVKK; it is therefore not written as a basis for transfer.

7. Retention and destruction

We keep your personal data for the period required for the purpose for which it is processed and for the periods provided for by legislation. The retention period of each activity is written in the table in Section 3 and in Section 4. Your closing your account does not result in the deletion of the order, invoice and accounting records that we must keep by law.

When the period expires or the conditions for processing cease to exist, your data is deleted, destroyed or anonymised in accordance with Article 7 KVKK and the Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik (Regulation on the Deletion, Destruction or Anonymisation of Personal Data). Unconfirmed newsletter registrations are deleted by an automatic job that runs every day in the Site’s database. Newsletter consent and refusal records are deleted 3 years after the end of the consent. Incomplete cart and payment step data, the IP address and browser information in the order, the order source information and rejected or pending wholesale applications are also deleted when the periods written in Sections 3 and 4 expire. Data that we delete may remain in the backups until the retention period of the backup (14 days for scheduled backups, 30 days for backups taken manually before updates) expires (4.12).

8. Security of your data

Under Article 12 KVKK we take appropriate technical and administrative measures to prevent the unlawful processing of your data and unlawful access to it and to protect your data. The main ones are the following:

• Your card details are entered only on the bank’s 3-D Secure payment page; they do not reach the Site or our order management system.
• Passwords are stored not in clear text but hashed.
• At administration login, an IP address that makes 5 failed login attempts within 5 minutes is blocked for 1 hour; rate limiting is applied on the server.
• The Site’s database, and the UNALSOFT Panel database and uploaded files, are backed up every day and the Site’s files once a week; backups are automatically deleted after 14 days, and backups taken manually before updates are deleted after 30 days.
• Optional cookies are not loaded without your permission.
• The whole Site runs over HTTPS and the connection between your browser and the Site is encrypted (HSTS is on).
• The administration panel and the WordPress login page can be accessed only from permitted IP addresses; only authorised persons who need to access the data because of their work can access it.

If your data is obtained by others through unlawful means, we notify you and the Personal Data Protection Board as soon as possible (Article 12/5 KVKK). For persons in the EU, the notification rules in Articles 33 and 34 GDPR also apply.

9. Are you obliged to provide the data?

To place an order you must fill in the mandatory fields at the payment step; without this information we cannot receive and deliver your order. For a wholesale account you must fill in the mandatory fields in the application form. In retail shopping, opening an account, subscribing to the newsletter, giving consent for cart reminders and permitting optional cookies are optional. Your not accepting them does not prevent you from shopping.

10. Your rights under KVKK

Under Article 11 KVKK, you can exercise the following rights by applying to us:

• To learn whether your personal data is processed.
• To request information about it if it has been processed.
• To learn the purpose of processing and whether the data is used in accordance with its purpose.
• To know the third parties in Türkiye or abroad to whom your data is transferred.
• To request correction if it is processed incompletely or inaccurately.
• To request erasure or destruction within the framework of the conditions in Article 7 KVKK.
• To request that correction, erasure or destruction operations be notified to the third parties to whom the data has been transferred.
• To object to a result against you arising from the analysis of the processed data exclusively by automated systems.
• To request compensation for the damage if you suffer damage due to unlawful processing.

For processing based on your explicit consent, you can withdraw your consent at any time: for cookies you can use the “Cookie settings” link at the bottom of every page, for the newsletter the exit link in every message, or write to us. Your withdrawing consent does not affect the lawfulness of processing carried out up to that date.

Automated decision-making: We do not make a decision about you based solely on automated processing that affects you legally or in a similarly significant way. Wholesale applications are evaluated by administrator approval. In order and payment processes there is no automated decision that affects you without human review; the result of the 3-D Secure verification of your card is the bank’s decision. Rate limiting on the server and the IP block on failed logins are only security measures (4.11).

11. Additional information for persons in the EU (GDPR)

If you are in the EU, you also have the following rights under the GDPR:

• Right of access: to request a copy of your data (Article 15 GDPR).
• Right to rectification (Article 16 GDPR).
• Right to erasure (Article 17 GDPR).
• Right to request restriction of processing (Article 18 GDPR).
• Notification of rectification, erasure and restriction to the recipients to whom the data has been transferred (Article 19 GDPR).
• Right to data portability: to receive the data that you have provided, which is based on your consent or a contract and processed by automated means, in a structured, commonly used and machine-readable format, and to request that it be transferred to another controller (Article 20 GDPR).
• Right not to be subject to decisions based solely on automated processing (Article 22 GDPR). We do not make such a decision about you (see Section 10).
• Right to withdraw your consent at any time (Article 7(3) GDPR).
• Right to lodge a complaint with the data protection supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

11.1 Your right to object (Article 21 GDPR)

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. In that case we stop processing unless we can show compelling legitimate grounds for continuing the processing, or the data is necessary for the establishment, exercise or defence of legal claims (Article 21(1) GDPR). You can object at any time and without giving a reason to the processing of your data for direct marketing purposes; in that case your data is no longer processed for this purpose (Articles 21(2) and 21(3) GDPR).

11.2 Legal bases, cookies and representative

The legal basis of each activity under Article 6(1) GDPR is written in Sections 3 and 4. Where we rely on legitimate interest, our interests are the following: the security of the Site, accounts and orders; the prevention of fraud; responding to your requests; conducting the commercial relationship with businesses; protecting our right against legal claims.

In the EU, cookies are also subject to national rules based on Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive). We use optional cookies only with your permission.

Data protection officer and EU representative: Although we sell goods to, and direct advertising at, people in the EU, we are not established in the EU. At the date this text was prepared, we have no appointed EU representative or data protection officer.

12. Method of application

To exercise your rights, you can make your application in Turkish and in writing, under the Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ (Communiqué on the Procedures and Principles of Application to the Data Controller), by one of the following ways:

• By a petition with a wet-ink signature; in person, by post or through a notary, to the following address: Mimar Kemalettin Mah. Kızıltaş Sk. Tekcan İş Hanı No: 5 İç Kapı No: 401 Fatih / İstanbul.
• By signing with a secure electronic signature or mobile signature, or from your e-mail address that you have previously notified to us and that is registered in our system (for example the address you used in an order or in your account), to: info@elisabettazanardi.com.

The Company has no registered electronic mail (KEP) address; we therefore cannot receive applications by KEP.

Your application must contain the following information:

• Name, surname and, if the application is written, signature.
• For citizens of the Republic of Türkiye, the T.C. identity number; for foreigners, nationality and passport number or identity number, if any.
• Residence or workplace address for notification.
• If any, the e-mail address, telephone and fax number for notification.
• The subject of the request.

We may ask for additional information to verify that you are the applicant. If you are applying on behalf of someone else, you must attach the document showing your authority (for example a power of attorney).

If you live abroad and find it difficult to write in Turkish, we also receive your request written in English or Russian at info@elisabettazanardi.com and try to answer it. This does not change the requirement of a Turkish and written application in the Communiqué for applications under KVKK; for a request to be regarded as an application under KVKK, the conditions in the Communiqué are required. If you are in the EU, you can send your requests under the GDPR by e-mail to the same address; we answer these requests under Article 12 GDPR. If we have reasonable doubts about your identity, we ask only for the additional information needed to verify your identity (Article 12(6) GDPR).

We conclude your application, according to the nature of the request, as soon as possible and within 30 days at the latest, free of charge (Article 13 KVKK). If the process requires a separate cost, we may charge the fee in the tariff determined by the Personal Data Protection Board. We answer applications under the GDPR within one month at the latest (Article 12(3) GDPR); these applications are free of charge unless manifestly unfounded or excessive (Article 12(5) GDPR). We either accept your request or reject it explaining the reasons; we notify our reply to you in writing or electronically.

If your application is rejected, if you find our reply insufficient, or if we do not reply in time, you may complain to the Personal Data Protection Board within 30 days from the date you learn of our reply and in any case within 60 days from the date of application (Article 14 KVKK). Under Article 14 KVKK, you must apply to us before complaining to the Board. This condition does not apply to a complaint you make to the supervisory authority in the EU under Article 77 GDPR.

13. Children

The Site is not directed at persons under 18. The Site does not technically prevent access by persons under 18 and does not verify age; we therefore ask that persons under 18 do not give us personal data. If we notice that a person under 18 has given us personal data, we delete this data, other than that which we are legally obliged to retain. Parents or guardians may also apply to us on this matter.

14. Changes to this text

We update this text when the processing activities on the Site or legislation change. The current text is always published on this page and the “Last updated” date at the top changes. When the information about cookies changes, your cookie preference is asked again. If we want to process your data for a new purpose that requires explicit consent, we ask for your consent separately before starting the processing.

15. Language

This text is prepared in Turkish and the Turkish text prevails. The English and Russian translations are provided for information; the translations have not been reviewed by a lawyer or translator. If there is a difference between a translation and the Turkish text, the Turkish text prevails.

16. Contact

For questions about this text you can reach us by the following means: info@elisabettazanardi.com, +90 530 446 67 77, Mimar Kemalettin Mah. Kızıltaş Sk. Tekcan İş Hanı No: 5 İç Kapı No: 401 Fatih / İstanbul. For your applications under KVKK and the GDPR: info@elisabettazanardi.com (see Section 12). The Company has no KEP address.