Personal Data Protection (KVKK) Notice
Son güncelleme: 20 Ağustos 2026
Prepared pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (6698 sayılı Kişisel Verilerin Korunması Kanunu).
1. Data controller
| Data controller | VİRTUESROSE — Mustafa Erdem |
|---|---|
| Address | Güneykent Yenice Mahallesi, Cumhuriyet Caddesi No: 100, Gönen / Isparta |
| siparis@virtuesrose.com | |
| Phone | +90 501 105 53 99 |
2. Personal data processed
| Identity | First name, surname; company title and tax details where a corporate invoice is requested |
|---|---|
| Contact | E-mail address, telephone number, delivery and billing address |
| Customer transaction | Order records, order number, product and amount details, shipment tracking number |
| Transaction security | IP address, browser information, session records, agreement approval timestamps |
Your credit card details are never seen or stored by us in any way; the payment is carried out through the PayTR infrastructure, directly within the systems of the payment institution.
3. Purposes of processing
- Receiving, preparing, shipping and delivering your order
- Issuing invoices and fulfilling statutory retention obligations
- Carrying out and verifying payment transactions
- Conducting return, withdrawal and complaint processes
- Creating your membership account and keeping it secure
- Sending order and shipment notifications
4. Legal grounds
- Conclusion and performance of a contract (art. 5/2-c) — order, delivery and return processes
- Compliance with a legal obligation (art. 5/2-ç) — retention required by invoicing, commercial book-keeping and tax legislation
- Legitimate interest (art. 5/2-f) — prevention of fraud, system security and evidencing agreement approvals
5. Method of collection
Your personal data is collected electronically, through order and membership forms, order tracking queries and the e-mail/telephone contact you establish with us.
6. Parties to whom data is transferred
| Payment institution | PayTR — for the purpose of carrying out the payment |
|---|---|
| Shipping company | Name, address and telephone details, for the purpose of delivering the shipment |
| Hosting provider | For the purpose of operating the website and the database |
| Competent authorities | Upon request, to the extent required by legislation |
Apart from these, your data is not shared with third parties and is not sold.
7. Retention period
Order and invoice records are retained for the periods prescribed by tax and commercial legislation (as a rule, 10 years). Membership data is kept for as long as your account remains open and, after you delete your account, throughout the applicable statutory limitation periods; it is thereafter erased or anonymised.
8. Rights of the data subject (KVKK art. 11)
By applying to the data controller, you may exercise the following rights:
- To learn whether your personal data is being processed and to request information in this regard
- To learn the purpose of the processing and whether the data is used in accordance with that purpose
- To know the third parties within the country or abroad to whom the data has been transferred
- To request rectification where the data has been processed incompletely or incorrectly
- To request erasure or destruction of the data where the conditions for it are met
- To request that rectification, erasure and destruction operations be notified to the parties to whom the data was transferred
- To object to an outcome to your detriment arising from the analysis of the data exclusively by automated systems
- To claim compensation where you suffer damage due to unlawful processing
9. Application
You may submit your applications by e-mail to siparis@virtuesrose.com or in writing to Güneykent Yenice Mahallesi, Cumhuriyet Caddesi No: 100, Gönen / Isparta. Your application is concluded free of charge within 30 days at the latest. Where the process entails an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) may be charged.