Skip to content

Personal Data Protection Notice

Effective from October 9, 2026 · Version 1

This English text is provided for convenience; the Turkish version is binding.

Personal Data Protection Notice

Effective date: 09/10/2026

This English translation is provided for convenience. If there is any difference between the two versions, the Turkish version prevails.

This notice explains how ByDipa — Didem Parlakyiğit Art & Design Studio (“ByDipa”) processes the personal data of people who visit our website at https://bydipa.com, create an account, place an order or contact us. It is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (the “Law”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

This notice is for information only; it does not ask for your consent. Where processing relies on your explicit consent (analytics and marketing cookies, commercial electronic messages), we ask for that consent separately, and giving it is optional.

1. Data controller

The data controller is Didem Parlakyiğit Görücü, an individual (natural person) trading under the ByDipa brand:

  • Full name: Didem Parlakyiğit Görücü (“ByDipa”)

  • Brand: ByDipa — Didem Parlakyiğit Art & Design Studio

  • Address: Güvenevler Mah. Şair Nedim Cad. No: 54 A, Merkez, Afyonkarahisar

  • Tax office and tax identification number: Kocatepe – 7220669652

  • Registered electronic mail (KEP) address, if any:

  • Email: didemnisaparlakyigit@gmail.com

  • Phone: +90 553 060 58 13

2. Personal data we process, purposes and legal grounds

Below we explain, for each activity, which data we process, why, and on which provision of the Law.

2.1. Customer account

  • Data: Full name, email address, phone number (optional), an irreversibly hashed form of your password (we cannot see the password itself), saved delivery and billing addresses, company name, tax office and tax number for corporate invoices, order history, account creation and last sign-in times.

  • Purposes: Creating and managing your account, verifying your identity when you sign in, sending password reset links, showing your orders and addresses, sending necessary account notices.

  • Legal grounds: Formation and performance of the Membership Agreement (Law Art. 5/2-c); our legitimate interest in keeping your account and our website secure (Art. 5/2-f).

2.2. Orders, delivery and invoicing

  • Data: Full name, email, phone, delivery and billing address, company name, tax office and tax number for corporate invoices; your Turkish ID number only where tax law requires it and only if we ask you for it separately; order code, order contents, amounts, your order note, order status history, carrier and tracking number; a record that you accepted the Pre-Information Form and the Distance Sales Agreement (date and time, document version, an irreversibly hashed form of your IP address).

  • Purposes: Concluding and performing the sales contract; producing made-to-order pieces; packing and shipping; issuing an invoice or other legally required financial document; emailing order status updates; handling withdrawal, return and defective-goods requests; customer support; meeting legal record-keeping duties; evidence in case of a dispute.

  • Legal grounds: Formation and performance of a contract (Art. 5/2-c); our legal obligations under Consumer Protection Law No. 6502, the Distance Contracts Regulation, Income Tax Law No. 193 and Tax Procedure Law No. 213 (Art. 5/2-ç); establishing, exercising or protecting a right (Art. 5/2-e).

2.3. Payment notice, bank receipt and refunds

Our website accepts payment by bank transfer (havale/EFT) only; it does not collect or store card details.

  • Data: Name of the account holder who sent the payment, bank name, amount, date and payment description; if you choose to upload it, the bank receipt image and the information on it (which may include part of an account number); the IBAN and account holder name you give us for a refund.

  • Purposes: Matching the payment to your order and verifying it manually, making refunds, keeping accounting records.

  • Legal grounds: Performance of a contract (Art. 5/2-c); obligations under tax and commercial law (Art. 5/2-ç); establishing, exercising or protecting a right (Art. 5/2-e).

If you pay by card through our brand’s store on Shopier, that transaction takes place on the Shopier platform, and your card and payment data are processed by Shopier and the relevant payment institutions under their own privacy notices. The information needed to deliver an order placed on Shopier (name, address, phone, order contents) is passed to us and processed under section 2.2 of this notice.

2.4. Contact, commission and product inquiry forms

  • Data: Full name, email, phone (optional), your message; for commission requests, project details such as the space, dimensions, colours, budget and expected timing, and any images you share; for product inquiries, the product you are interested in; the time the form was sent and a hashed form of your IP address.

  • Purposes: Answering your question, preparing a design proposal and price quote for a commission, giving information about a product, keeping track of your request, preventing form abuse (spam).

  • Legal grounds: For commission and product inquiries, processing that is directly related to concluding a contract at your request (Art. 5/2-c); for general enquiries and spam prevention, our legitimate interest (Art. 5/2-f).

Please do not share special categories of personal data (such as health, religion or ethnic origin) in the forms; we do not ask for such data.

2.5. Cookies

  • Strictly necessary cookies (cart, session and your cookie choice): Used to make the website work, keep your cart and keep you securely signed in. Legal grounds: formation and performance of a contract (Art. 5/2-c) and our legitimate interest (Art. 5/2-f).

  • Analytics cookies (Google Analytics 4): Used to measure how the website is used, through data such as pages visited, visit duration, device and browser type and approximate location derived from your IP address. Legal ground: your explicit consent (Art. 5/1).

  • Marketing cookies (Meta Pixel): Used to measure the effect of our Instagram and Facebook ads and to show relevant ads. Legal ground: your explicit consent (Art. 5/1).

Analytics and marketing cookies run only after you allow them. See our Cookie Policy for details.

2.6. Security and activity logs

  • Data: IP address, date and time, browser and device information, pages accessed, sign-in attempts, error logs; logs of actions taken in the admin panel.

  • Purposes: Information security; preventing and detecting unauthorised access, fraud and abuse; fixing technical faults; answering lawful requests from competent authorities.

  • Legal grounds: Our legal obligations (Art. 5/2-ç); establishing, exercising or protecting a right (Art. 5/2-e); our legitimate interest (Art. 5/2-f).

2.7. Commercial electronic messages

We do not currently send newsletters or promotional emails. If we start sending them, we will do so only with the separate, optional approval you give under Law No. 6563 on the Regulation of Electronic Commerce and your explicit consent (Art. 5/1), and we will record your approval in the Message Management System (İYS). You can withdraw it at any time through the link in each message, through İYS or by writing to us. Transactional emails such as order, payment and shipping notices are not commercial messages and do not require approval.

3. Recipients of personal data

We do not sell your personal data. We share it only with the recipients below, limited to the stated purpose and in line with Articles 8 and 9 of the Law:

  • Cargo and logistics companies: Full name, phone, delivery address and shipment details, to deliver your order and collect return shipments (Art. 5/2-c).

  • Our accountant, our e-invoice/e-archive service provider and the Revenue Administration: Information needed for invoices and accounting records, to meet tax law obligations (Art. 5/2-ç).

  • Hosting provider: The company providing the servers, located in Türkiye or abroad, on which the website and database run; acting as a data processor on our instructions to store data securely.

  • Email delivery provider (Resend, Inc., USA): Full name, email address and email content (order summary, payment and shipping information, password reset links); acting as a data processor to send transactional emails.

  • Analytics and advertising providers (Google, Meta): Only if you have allowed the relevant cookies; cookie identifiers, device, browser and page interaction data.

  • Banks: IBAN, account holder name and amount, to make refunds.

  • Competent public authorities, courts, consumer arbitration committees and mediators: Information requested by law or in connection with a dispute (Art. 5/2-ç and 5/2-e).

  • Our legal and financial advisers: To the extent needed to establish, exercise or protect a right (Art. 5/2-e).

4. Transfers abroad

Our email delivery provider, Resend, Inc., is located in the United States. The servers running our website may be located in Türkiye or abroad. If you allow analytics and marketing cookies, the related data is sent to Google’s and Meta’s servers abroad.

We carry out these transfers in line with Article 9 of the Law as amended in 2024. As there is no adequacy decision of the Personal Data Protection Board for the destination countries, transfers rely primarily on appropriate safeguards under Article 9/4, such as the standard contract published by the Board; standard contracts are notified to the Personal Data Protection Authority within five business days of signature. In exceptional cases where an appropriate safeguard cannot be put in place, a transfer is made only occasionally and only on one of the grounds listed in Article 9/6 (for example, where it is necessary to perform our contract with you).

The law that applies to recipients abroad may not offer the same level of protection as Turkish law, so we keep transferred data limited to what the purpose requires.

5. How we collect personal data

We collect personal data electronically, by fully or partly automated means, through:

  • account, checkout, address, payment notice and receipt upload screens,

  • contact, commission and product inquiry forms,

  • cookies and similar technologies,

  • emails, phone calls and social media messages you send us,

  • for orders placed on our Shopier store, the information Shopier passes to us for delivery.

6. Retention periods

We keep personal data for as long as the purpose requires and for the periods set by law. When the period ends, the data is deleted, destroyed or anonymised within the periodic destruction interval under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

  • Order, invoice, payment and bank receipt records: 10 years from the end of the year in which the record was created (taking into account the 5-year retention period in Tax Procedure Law No. 213, Art. 253, and the 10-year general limitation period in Turkish Code of Obligations No. 6098, Art. 146). Pre-information, contract acceptance, withdrawal and delivery records for distance sales are kept for at least 3 years (Distance Contracts Regulation Art. 20); as they form part of the order record, they are kept together with it.

  • Account data: As long as your account is open. When you close your account, account data that is not subject to a legal retention duty is deleted within 6 months at the latest; records of your past orders continue to be kept for the periods above.

  • IBAN provided for a refund: 10 years after the refund, as part of the accounting record.

  • Contact, commission and product inquiry forms: 2 years from the last message. If the request leads to an order or contract, the same period as order records.

  • Cookies: The period stated for each cookie in our Cookie Policy. The record of your cookie choice: 12 months.

  • Security and activity logs: Up to 2 years from the log date, or, where a retention duty arises under Law No. 5651 and related legislation, the period set there.

  • Approval for commercial electronic messages (if given): While the approval is valid and for 3 years after it ends (Regulation on Commercial Communication and Commercial Electronic Messages, Art. 13).

  • In case of a dispute: Until the dispute is finally resolved and the relevant limitation periods expire.

7. Your rights

Under Article 11 of the Law, you may apply to us to:

  • learn whether your personal data is processed,

  • request information about the processing,

  • learn the purpose of processing and whether the data is used for that purpose,

  • know the third parties in Türkiye or abroad to whom your data is transferred,

  • request correction of incomplete or inaccurate data,

  • request deletion or destruction of your data under the conditions of Article 7 of the Law,

  • request that corrections, deletions or destruction be notified to third parties who received your data,

  • object to a result against you that arises from analysis carried out exclusively by automated systems,

  • claim compensation if you suffer damage because of unlawful processing.

Where processing relies on your explicit consent (analytics and marketing cookies, commercial electronic messages), you can withdraw that consent at any time. You can change your cookie choices through the “Cookie preferences” link at the bottom of every page.

8. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application by one of these methods:

  • In writing: A signed letter delivered in person, by courier or through a notary to Güvenevler Mah. Şair Nedim Cad. No: 54 A, Merkez, Afyonkarahisar.

  • By registered electronic mail (KEP): To , if we have a KEP address.

  • With a secure electronic signature or mobile signature: By sending your signed application to didemnisaparlakyigit@gmail.com.

  • By email: From an email address you have previously given us and that is registered in our system (for example, your account or order email address), to didemnisaparlakyigit@gmail.com.

Your application must include: your full name (and signature for written applications), your Turkish ID number if you are a Turkish citizen, or your nationality and passport number or ID number if you are a foreign national, your residential or business address for service, your email address, phone number for notifications if any, and the subject of your request. You may attach documents related to your request.

We will conclude your application as soon as possible according to its nature and within 30 days at the latest, free of charge. If the request involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. We may ask for additional information to verify your identity.

If your application is rejected, you find our answer insufficient or we do not answer in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application.

9. Changes

We update this notice when our processing activities or the law change. The current version is always published on this page with its effective date.