KVKK Privacy Notice
For what purposes and on what legal basis your personal data is processed, to whom it is transferred, how long it is retained and your rights under KVKK (Law No. 6698 on the Protection of Personal Data).
1. Data controller
| Trade name | İrem Erkin Dicle (sole proprietorship) |
| Address | MEGAPOL TOWER, İÇ KAPI, Adalet, Anadolu Cd. NO: 41, NO: 101, Bayraklı/İzmir |
| Phone | +90 538 775 35 22 |
| bilgi@kartmerkezi.com | |
| Tax office | Karşıyaka |
| Turkish ID No. (sole proprietorship) | 31645893122 |
| MERSİS No. | As a sole proprietorship, there is no MERSİS registration. |
| Website | kartmerkezi.com |
2. Personal data processed
| Data | When it is collected |
|---|---|
| Identity — name and surname, company title | Membership and order |
| Contact — e-mail, telephone, delivery and invoice address | Membership, order, quotation |
| Finance — invoice details, tax no./TCKN (Turkish ID no.), current account transactions | Issuing invoices, collection of payments |
| Order — product, quantity, design files, print approvals | Order and production |
| Card numbers — serial/chip numbers of the cards we produce | Production and delivery records |
| Transaction security — login records, IP address | Panel and member logins |
Your payment card details are not stored by us. Credit card payments are taken through the payment institution's own secure page; only the result of the transaction is transmitted to us.
3. Purposes of processing
- Receiving, manufacturing and delivering the order
- Issuing invoices and fulfilling statutory bookkeeping/documentation obligations
- Providing information about the order status and delivery (e-mail / SMS)
- Conducting product warranty and complaint processes
- Being able to locate previously produced card numbers upon request
4. Legal basis
- Establishment and performance of the contract (KVKK art. 5/2-c) — order, delivery, collection
- Legal obligation (art. 5/2-ç) — invoices, e-Invoices, ledger records
- Legitimate interest (art. 5/2-f) — production records, quality tracking, security records
- Explicit consent — only for sending marketing e-mails/SMS
5. Transfer
Your data is shared only with the following parties, and only to the extent necessary:
- Cargo company — name, address, telephone (for delivery)
- e-Invoice integrator — invoice details (legal requirement)
- Payment institution — for carrying out the payment transaction
- E-mail and SMS providers — sending notifications
- Competent public authorities — upon request and within the framework of the legislation
For marketing purposes, your data is not sold to third parties.
6. Retention period
- Commercial records (invoices, orders, current account transactions): pursuant to the Tax Procedure Law and the Turkish Commercial Code, 10 years
- Membership record: until the account is deleted
- Marketing consent: until the consent is withdrawn
When the period expires, the data is erased, destroyed or anonymised.
7. Your rights (KVKK art. 11)
By applying to the data controller, you may request the following:
- To learn whether your personal data is processed and to request information in this regard
- To learn the purpose of processing and whether the data is used in accordance with that purpose
- To know the third parties in Türkiye or abroad to whom the data is transferred
- To request rectification if the data is processed incompletely or inaccurately
- Where the conditions are met, to request the erasure or destruction of the data
- To request that the rectification/erasure be notified to the third parties to whom the data has been transferred
- To object to a result to your detriment arising from the analysis of the data exclusively through automated systems
- To claim compensation for the damage if you have suffered damage due to unlawful processing
You may submit your applications in writing to bilgi@kartmerkezi.com or to the postal address above. Your application will be concluded within 30 days at the latest .
Your erasure request does not cover commercial records whose statutory retention period is still running — these records must be kept as required by the legislation. In this case, the data is retained only for the relevant obligation and is not used for any other purpose.
Effective date: 16 August 2026. When this text changes, the effective date is updated; for your order, the text in force on the order date applies.