Privacy Policy and KVKK Notice

1. Personal Data We Process

Depending on the channel you use and what you do, the following personal data is processed.

When you register or place an order:

• Identity and contact details: name, email address, phone number
• Shipping and billing address
• Order details: products purchased, amount, payment method, order and shipping status, your order note
• Payment details: card payments are processed by PayTR, a licensed payment institution; your card number and security code never reach us and are not stored on our systems. We only receive the transaction result and the masked last digits of the card
• For bank transfers, the sender name and transaction reference
• Account details: your password (stored only as an irreversible hash) and, if you sign in with Google, your Google account id and verified email address
• Consent records: the text you accepted, the time of acceptance and your IP address

Through the website and our communication channels:

• Message content and contact details (email, WhatsApp, contact forms)
• Email address (newsletter sign-ups)
• Traffic and device data: IP address, browser information, pages visited, session logs (site security and operation)

Through sign-up forms on Instagram and Facebook (Meta): name, phone number and the preference questions you answer.

2. Collection Method and Legal Grounds

Your personal data is collected electronically through the registration, order and contact forms on our website, the sign-up forms we publish on Instagram/Facebook, and the direct channels you use to reach us.

Under Article 5 of KVKK, your data is processed on the following legal grounds:

• Taking your order, collecting payment, delivering the goods and after-sales support: conclusion and performance of a contract
• Issuing invoices and keeping consent and order records: compliance with our legal obligations (Consumer Protection Law No. 6502, E-Commerce Law No. 6563, Tax Procedure Law)
• Creating and managing your account: performance of a contract
• Keeping the site secure and functional and preventing fraud: legitimate interest
• Campaign and marketing communication: your explicit consent

3. Purposes of Processing

• Receiving, preparing, shipping and delivering orders
• Collecting payments and settling refund and withdrawal requests
• Managing your account and providing account services such as order history and address book
• Responding to requests, questions and complaints
• Fulfilling statutory bookkeeping, invoicing and record-keeping obligations
• Ensuring the security and operation of the website and preventing abuse
• Sending campaign, new-product and opening announcements if you have opted in
• Planning our products and services through aggregate, statistical analysis

4. Transfers and Transfers Abroad

Your personal data is shared only to the extent the purposes above require, with the following recipients:

• Shipping carriers: your name, address and phone number, to deliver your order
• Payment institution (PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş.): order amount and contact details, to process card payments
• Banks: bank transfers and refunds
• Email and infrastructure providers: order notifications and hosting of the site
• Authorised public bodies: where a legal request or obligation exists

The servers hosting our site and some of the providers we use (email delivery, analytics, Meta Platforms sign-up forms and WhatsApp) may be located abroad. In those cases the transfer relies on the procedures set by the Personal Data Protection Board under Article 9 of KVKK and, where required, on your explicit consent.

5. Retention

Order, invoice and consent records are kept for the period required by law (at least 10 years under the Tax Procedure Law and the Turkish Commercial Code). Account data is kept for as long as your account is open; marketing data until you withdraw your consent. When the period ends, data is deleted, destroyed or anonymised.

6. Commercial Electronic Messages

Under Turkish Law No. 6563, your separate approval is obtained before commercial electronic messages are sent to you by SMS, phone, WhatsApp or email. Order and account notifications (order confirmation, shipping updates, password reset) are not commercial messages and are sent without approval. You can withdraw your approval at any time from My Account → Permissions, by following the instructions in the message, or by writing to us.

7. Cookies

We use essential cookies for session management and language preference, plus analytics cookies. Details are on the Cookie Policy page.

8. Data Security

Your data travels over encrypted connections (TLS); passwords are stored as irreversible hashes; card data never enters our systems. Access to your account is limited to your own sessions, and you can sign out of all devices from My Account → Sessions.

9. Your Rights Under KVKK

Under Article 11 of KVKK you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties to whom the data has been transferred in Turkey or abroad; request correction of incomplete or incorrect data; request its erasure or destruction; request that these actions be notified to the third parties the data was transferred to; object to a result against you arising solely from automated analysis; and claim compensation if you suffer damage.

You can send your requests through the contact channels below; your application is concluded free of charge within 30 days at the latest. Members can also request a copy of their data and account deletion from My Account → Permissions.

10. Data Controller and Contact

• Legal name: Luna Collectables - Turunç Teknolojik Yatırımlar A.Ş.
• Tax office / no: Antalya Kurumlar / 8720635620
• Trade registry no: ANTALYA / 93708
• Email: hello@lunacollectables.com
• WhatsApp: +905304820357
• Web: www.lunacollectables.com
• Instagram: @luna.collectables