Privacy Policy — KVKK Notice

1. Introduction

At Fenikya we take our users' privacy seriously. This Privacy Policy explains what information we collect when you use the platform, how we use it, who we share it with and what your rights are.

2. Information We Collect

2.1. Information You Provide

• Registration details: First name, surname, email, phone number, store name.
• Payment details: Billing details (card details are not stored on Fenikya servers; they are sent directly to the payment infrastructure provider (TAMI or iyzico)).
• Store content: The products, images, categories and orders you upload.
• Support requests: Email and live chat correspondence.

2.2. Information Collected Automatically

• Device information: IP address, browser type, operating system.
• Usage data: Pages visited, session duration, clicks.
• Cookies: Session, preference and analytics cookies (see Cookie Policy for details).

3. How We Use the Information

• To deliver the service and to create and run your store.
• To process payments and issue invoices.
• To provide technical support and customer service.
• To improve the platform and add new features.
• To detect and prevent security breaches.
• To meet our legal obligations.
• To send marketing and informational communications where you have consented.

4. Sharing of Information

Your personal data is not shared with third parties except in the following cases:

• Service providers: TAMI and iyzico (payments), cloud server providers, email services.
• Legal obligations: Court orders and requests from official authorities.
• Explicit consent: Specific cases where we have obtained your consent.

Your data is never sold to third parties for marketing purposes.

5. Data Security

Fenikya applies industry-standard security measures to protect your data:

• All data in transit is protected with SSL/TLS encryption.
• Passwords are stored hashed with the bcrypt algorithm.
• Databases are backed up regularly and held in encrypted storage.
• Access logs are recorded and monitored.
• Two-factor authentication (2FA) is supported.

6. Data Retention

Your personal data is retained for as long as the service requires and in line with statutory retention obligations (for example 10 years under tax legislation). When you delete your account, your data is permanently destroyed once the statutory retention periods have expired.

7. Your Rights

Under the KVKK and related legislation you have the following rights:

• To learn whether your data is being processed.
• To request access to the data processed about you.
• To request correction of inaccurate or incomplete data.
• To request erasure or destruction of your data.
• To object to the processing.
• To be informed about transfers of data to third parties.

To exercise these rights, please contact [email protected]. For details, see our Privacy Notice page.

8. Instagram / Meta Integration

If you choose to use the "Instagram Feed" add-on in your store, you can connect your Instagram account to the platform. This integration works through Meta Platforms, Inc.'s official Instagram API with your explicit authorisation (OAuth).

8.1. Data Processed

• Access token: Used to read content on your behalf on Instagram.
• Profile information: Your Instagram username and user ID.
• Posts: The image URL, caption and post link of your latest posts, for display in your storefront.

Your Instagram password is never collected or stored. This data is used solely to display the Instagram feed on your store's home page; it is not sold to third parties or used for marketing.

8.2. Revoking Access and Deletion

You can disconnect at any time with Add-ons → Instagram Feed → "Disconnect"; this immediately deletes the token and all fetched post data. For detailed instructions see our Data Deletion page.

9. WhatsApp Order Notifications

Stores on the Platform may notify buyers who opt in during checkout about their order status (confirmation, shipment, out for delivery, delivery, cancellation) via WhatsApp. These notifications are sent through the WhatsApp Business Platform of Meta Platforms, Inc. No campaign or marketing messages are sent through this channel.

9.1. Roles

The data controller for buyer data is the store where the purchase is made. Fenikya provides the technical infrastructure that sends the notifications on behalf of the store. Meta is the service provider that delivers the messages.

9.2. Data Processed

• Phone number: The number the notification is sent to.
• Order details: Order number, buyer name, order total, carrier, shipment tracking number and order page link.
• Message logs: Text of the message sent, template name, Meta message ID, delivery status (sent, delivered, read, failed) and replies from the buyer.
• Consent records: Date and place the consent was given, IP address, browser information and the date the consent was withdrawn.

9.3. Consent

WhatsApp notifications are sent only to buyers who tick this option on the checkout page. This consent is not a condition of purchase.

9.4. International Transfer

Messages are delivered through Meta's servers located abroad. Therefore, the data above is transferred outside Turkey.

9.5. Retention Period

Message logs are deleted automatically after 90 days. Consent records are kept to prove that consent was obtained. When consent is withdrawn, the record is not deleted; the withdrawal date is recorded.

9.6. Stopping Notifications

You can stop receiving WhatsApp notifications from a store at any time by sending "DUR", "STOP" or "İPTAL" to the store's WhatsApp number. To exercise your rights under the KVKK (Turkish Personal Data Protection Law), you can contact the relevant store or [email protected].

10. Children's Privacy

The platform is not intended for people under 18. If we become aware that we have collected data from someone under 18, we close the account and delete the data as soon as possible.

11. Updates

This Privacy Policy may be updated from time to time. You will be notified by email of any significant changes. The current version is always published on this page.