Privacy Policy

1. Introduction

This Privacy Policy explains how BULBOL CRYSTAL DANIŞMANLIK TURİZM VE GIDA İTHALAT İHRACAT TİCARET LİMİTED ŞİRKETİ (“BULBOL CRYSTAL”, “we”, “us”, “our”) collects, uses, processes, stores, transfers and protects the personal data of visitors and customers of https://bulbolcrystal.com/ (“Website”).

We process your personal data in accordance with the Law on the Protection of Personal Data No. 6698 (KVKK), the Consumer Protection Law No. 6502, the E-Commerce Law No. 6563 and other applicable Turkish legislation. For customers located in the European Union, this Policy also reflects the principles of the General Data Protection Regulation (GDPR – Regulation 2016/679).

By visiting our Website, registering an account or placing an order, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

2. Data Controller

For the purposes of this Privacy Policy, the “Data Controller” (Veri Sorumlusu) is:

• BULBOL CRYSTAL DANIŞMANLIK TURİZM VE GIDA İTHALAT İHRACAT TİCARET LİMİTED ŞİRKETİ
• Address: Yakuplu Mah. Mareşal Fevzi Çakmak Cad. İnşaat No: 71 İç Kapı No: 1, Beylikdüzü / İstanbul, Türkiye
• Tax Office / Tax No.: BEYLİKDÜZÜ / 1881063691
• Phone: +90 534 821 78 90
• Email: [email protected]
• Website: https://bulbolcrystal.com/

3. Personal Data We Collect

We may collect the following categories of personal data:

a) Identity and contact data

• Full name, title
• Email address, phone number
• Billing and delivery address
• National ID or tax identification number (where required for invoicing, e.g. for corporate orders)

b) Order and transaction data

• Order history, products ordered, payment method
• Total amount paid, invoices issued
• Communications regarding your orders

c) Technical data

• IP address, browser type and version, device information
• Time and date of visits, pages viewed, referring website
• Cookies and similar tracking technologies (see Section 9)

d) Marketing data

• Email and phone number, if you have opted in to receive our newsletters and promotions
• Interaction data with our communications (opens, clicks, unsubscribes)

e) Customer support data

• Communications, complaints and requests submitted to us
• Records of telephone calls and emails (where lawful)

f) Special categories of personal data

• We do not intentionally collect special categories of personal data (such as health, religion, political opinion, race or ethnic origin) as defined in Article 6 of the KVKK, unless you voluntarily provide such information in a customer support communication.

4. How We Use Your Personal Data

We process your personal data for the following purposes:

• Order fulfilment: processing your order, shipment, delivery, invoicing and customer support;
• Contract performance: fulfilling our obligations under the Distance Sales Agreement and these Terms & Conditions;
• Legal compliance: fulfilling obligations under tax, customs, e-commerce and consumer protection legislation, including issuing electronic invoices and retaining records;
• Payment processing: verifying your payment, detecting and preventing fraud, chargebacks and unauthorised transactions;
• Customer service: responding to your inquiries, complaints, withdrawal requests and return/refund requests;
• Marketing and communication: sending newsletters, promotional offers and product information — only with your explicit consent and only until you opt out;
• Website operation and improvement: operating, securing, troubleshooting and improving the Website, its features and content;
• Dispute resolution: handling complaints before the Consumer Arbitration Committee, Consumer Courts or other competent authorities.

5. Legal Basis for Processing

We rely on the following legal bases under KVKK Article 5 and, where relevant, GDPR Article 6:

• Explicit consent (KVKK Art. 5/1-(a)) — for marketing communications and any non-essential processing;
• Contractual necessity (KVKK Art. 5/1-(c)) — for processing related to the conclusion and performance of the Distance Sales Agreement;
• Legal obligation (KVKK Art. 5/1-(ç)) — for processing required under tax, e-commerce and consumer protection laws;
• Legitimate interest (KVKK Art. 5/1-(f)) — for fraud prevention, Website security, customer support and internal reporting;
• Public disclosure / protection of rights (KVKK Art. 5/1-(d)) — for use in legal proceedings or to establish, exercise or defend a legal claim.

For special categories of personal data, we rely on explicit consent (KVKK Art. 6/2) and, where applicable, on the exceptions set out in KVKK Article 6/3.

6. Recipients of Personal Data

We may share your personal data with the following categories of recipients, only to the extent necessary for the purposes described in this Policy:

• Payment service providers — licensed payment institutions authorised to process card payments;
• Logistics and courier companies — for shipment and delivery of your orders;
• Hosting and IT service providers — providing server hosting, content delivery, analytics and customer support tools;
• Email and SMS service providers — for transactional and, with your consent, marketing communications;
• Tax advisors, accountants and auditors — for invoicing, accounting and statutory reporting;
• Public authorities — tax administration, customs, consumer protection bodies and courts, where required by law;
• Lawyers and debt collection agencies — only in case of disputes or unpaid claims.

Our service providers act as data processors on our behalf and are bound by confidentiality and data protection obligations.

7. International Transfers

Your personal data is primarily processed in Türkiye. Some of our service providers (such as cloud hosting, analytics or email platforms) may be located outside Türkiye. In such cases, we ensure that international transfers are carried out:

• To countries offering adequate protection as recognised by the Turkish Personal Data Protection Authority (KVKK Kurulu);
• Where there is no adequacy decision, on the basis of appropriate safeguards (such as Standard Contractual Clauses) and, where required by law, with the necessary KVKK permissions;
• In compliance with the conditions set out in KVKK Articles 9 and 12.

For EU customers, transfers to Türkiye are made in accordance with the safeguards required under GDPR Chapter V.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• For the duration of the customer relationship — to fulfil orders, provide customer service and respond to inquiries;
• For the periods required by law — electronic commerce records, tax and accounting documents are retained for the periods set out in the Turkish Tax Procedure Law (VUK), the Turkish Commercial Code (TTK) and the E-Commerce Law (5–10 years depending on the document type);
• For the duration of the limitation period — for any claims that may arise in connection with the sale, in accordance with the applicable statutes of limitations under the Turkish Code of Obligations;
• Until consent is withdrawn — for marketing data processed on the basis of your explicit consent.

After the end of these periods, personal data is deleted, destroyed or anonymised in accordance with KVKK and our retention and destruction policy.

9. Cookies

The Website uses cookies and similar technologies (small text files stored on your device) for the following purposes:

• Essential cookies — required to operate the Website, enable shopping cart functionality and ensure secure checkout;
• Functional cookies — to remember your preferences (language, currency, recently viewed products);
• Analytics cookies — to understand how visitors use the Website and to improve its content and performance;
• Marketing cookies — only with your consent, to deliver relevant advertising and to measure the performance of marketing campaigns.

You can manage or disable cookies through your browser settings at any time. Disabling essential cookies may affect the proper functioning of the Website.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, loss or destruction. These measures include:

• SSL/TLS encryption for data transmission between your browser and our servers;
• Secure storage of personal data on access-controlled servers;
• Restricted access rights, granted only to authorised personnel on a need-to-know basis;
• Regular security reviews, vulnerability assessments and employee training;
• Documented incident response procedures in line with KVKK Article 12.

Payment card data is never stored by BULBOL CRYSTAL; it is processed solely by our licensed payment service provider under PCI-DSS standards.

11. Your Rights

In accordance with KVKK Article 11, you have the right to:

• Be informed whether your personal data is being processed;
• Request information about your personal data that has been processed;
• Learn the purpose of processing and whether the data is used for its intended purpose;
• Know the third parties to whom your data is transferred, at home or abroad;
• Request the correction of incomplete or inaccurate personal data;
• Request the deletion or destruction of your personal data under the conditions of KVKK Article 7;
• Request notification of any correction, deletion or destruction to third parties to whom your data has been transferred;
• Object to the occurrence of a result against you through the exclusive analysis of processed data by automated systems;
• Claim compensation for damages incurred due to unlawful processing of your personal data.

For customers located in the European Union, you also have the rights granted under GDPR Articles 15–22, including the right of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection and withdrawal of consent.

To exercise any of these rights, please submit your request using the Application Form for Personal Data Holders, available on our Website, and send it to [email protected]. We will respond to your request free of charge, within 30 days at the latest, in accordance with KVKK Article 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller.

12. Children’s Privacy

The Website is intended for general audiences. We do not knowingly collect personal data from children under the age of 18 without the consent of a parent or legal guardian. If you believe that we have collected personal data from a child, please contact us at [email protected] and we will take steps to delete such data.

13. Third-Party Links

The Website may contain links to third-party websites (such as social media platforms, payment gateways or logistics trackers). We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any website you visit through a link from our Website.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technological developments, applicable laws or regulatory requirements. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this Policy periodically. Continued use of the Website after any change constitutes acceptance of the updated Policy.

15. Contact

If you have any questions, requests or complaints regarding this Privacy Policy or the processing of your personal data, please contact our Data Controller:

• BULBOL CRYSTAL DANIŞMANLIK TURİZM VE GIDA İTHALAT İHRACAT TİCARET LİMİTED ŞİRKETİ
• Email: [email protected]
• Phone: +90 534 821 78 90
• Address: Yakuplu Mah. Mareşal Fevzi Çakmak Cad. İnşaat No: 71 İç Kapı No: 1, Beylikdüzü / İstanbul, Türkiye
• Website: https://bulbolcrystal.com/

You may also submit a complaint to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu – KVKK) at https://www.kvkk.gov.tr/ if you believe that your rights have been violated.