KVKK Privacy Notice

1. Data Controller

Your personal data is processed, in the scope described below, by Komshia, established in Bulgaria (Burgas, Bulgaria; e-mail: info@komshia.com), acting as data controller.

2. Categories of Personal Data Processed

• Identity data: first name, surname.
• Contact data: e-mail address, phone number, delivery and invoice address.
• Customer transaction data: order history, cart details, return and dispute records.
• Financial data: payment method and transaction references (card details are not stored by us), bank account details for sellers.
• Seller business data: trade name, tax number, authorised contact details.
• Transaction security data: session records, IP address, user activity logs.

3. Purposes of Processing

• Establishing and managing the membership and seller relationship,
• Handling orders, payments, escrow, shipping and returns,
• Facilitating buyer-seller communication and dispute resolution,
• Fulfilling finance, accounting and tax obligations,
• Ensuring platform security and preventing fraud,
• Responding to requests from competent authorities,
• Sending commercial electronic messages, where explicit consent exists.

4. Legal Grounds

Your personal data is processed on the following legal grounds under KVKK Art. 5/2:

• Being directly related to the conclusion or performance of a contract (Art. 5/2-c),
• Fulfilment of the data controller’s legal obligations (Art. 5/2-ç),
• Establishment, exercise or protection of a right (Art. 5/2-e),
• Legitimate interest, provided your fundamental rights are not harmed (Art. 5/2-f),
• In other cases (e.g. marketing), your explicit consent (Art. 5/1).

5. Transfer of Data

Your personal data may be transferred to payment institutions (iyzico, Stripe) for payment processing, to carriers for delivery, to competent public authorities within legal obligations, and to the relevant seller to the minimum extent necessary for the performance of the order.

6. Transfers Abroad

As the data controller is established in Bulgaria and the servers are located in the EU (Frankfurt), your data is processed abroad. Transfers are carried out in accordance with KVKK Art. 9, based on your explicit consent or on adequate protection/appropriate safeguards recognised by the Board. The EU is a region providing a high level of data protection under the GDPR.

7. Method of Collection

Your personal data is collected electronically, by fully or partially automated means, through the registration form, seller application form, order and payment pages, support correspondence and cookies.

8. Security and Pseudonymisation

Your identity and contact data is stored in the database encrypted with AES-256-GCM; in internal records you are represented by an assigned number (Social-ID) instead of your real identity. Access is restricted by role-based authorisation and personal data is redacted in system logs.

9. Retention Periods

Your data is retained for as long as the processing purposes require and for the limitation/retention periods set by the relevant legislation (10 years for tax legislation, 2 years for transaction security logs); at the end of these periods it is deleted, destroyed or anonymised.

10. Your Rights under KVKK Art. 11

• To learn whether your personal data is processed,
• To request information if it has been processed,
• To learn the purpose of processing and whether the data is used in line with that purpose,
• To know the third parties to whom it is transferred, domestically or abroad,
• To request rectification if processed incompletely or inaccurately,
• To request erasure or destruction under KVKK Art. 7,
• To request that rectification/erasure be notified to third-party recipients,
• To object to outcomes arising against you from analysis made exclusively by automated systems,
• To claim compensation for damage caused by unlawful processing.

11. How to Apply

You may submit requests regarding your rights to info@komshia.com in accordance with the Communiqué on Application Procedures to the Data Controller. Requests are answered free of charge within 30 days at the latest; if your request is refused, you retain the right to complain to the Personal Data Protection Board.