Personal Data Protection Disclosure
Introduction
In accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”), Rare & Roots is committed to protecting the privacy, confidentiality, and security of personal data. This disclosure statement explains how personal data is collected, processed, stored, and protected when individuals interact with our website, services, and products.
Rare & Roots processes personal data in compliance with applicable legal regulations and ensures that such data is handled in a lawful, transparent, and secure manner.
​
Collected Personal Data
When customers interact with Rare & Roots through our website or services, certain personal data may be collected. This data may include identity information such as name and surname, contact information including email address, phone number, and delivery address, as well as payment-related information required to complete transactions. In addition, transaction records and order details may also be collected as part of our business operations.
The collection of personal data is limited to what is necessary to provide our services and operate our e-commerce platform effectively.
​
Purpose of Processing Personal Data
Personal data collected by Rare & Roots may be processed for several legitimate purposes related to our services and business activities. These purposes include processing customer orders, completing payment transactions securely, managing delivery and logistics processes, and providing customer support when needed.
Personal data may also be processed in order to comply with applicable legal obligations, financial regulations, tax requirements, and other regulatory responsibilities.
​
Legal Basis for Data Processing
Personal data may be processed based on one or more of the following legal grounds:
- the explicit consent of the data subject
- the necessity of processing for the performance of a contract
- compliance with legal obligations
- legitimate interests of the company, provided that fundamental rights and freedoms of individuals are not violated
Data Security
Rare & Roots takes the protection of personal data seriously and implements appropriate administrative, technical, and organizational measures to safeguard personal information. These measures are designed to prevent unauthorized access, disclosure, alteration, or destruction of personal data.
Access to personal data is restricted to authorized personnel and service providers who require such access to perform their duties.
​
Third-Party Data Transfers
In order to operate our services and complete customer transactions, certain personal data may be shared with trusted third-party service providers. These may include payment service providers, logistics and shipping companies, technical infrastructure providers, and legal or financial advisors when required by law.
Any such data sharing is conducted in compliance with the applicable legal regulations and only to the extent necessary to provide the requested services.
​
Data Retention Period
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting obligations. Once the relevant retention period expires, personal data will be securely deleted, destroyed, or anonymized in accordance with applicable regulations.
​
Cookies and Website Data
Our website may use cookies and similar technologies to improve user experience, analyze website performance, and ensure the proper functioning of our services. Cookies may collect certain technical data such as browser information, device type, and website usage patterns.
Users may manage or disable cookies through their browser settings. However, disabling cookies may affect the functionality of certain features on the website.
​
Rights of Data Subjects
Under the Personal Data Protection Law, individuals whose personal data are processed have certain rights. These rights include requesting information about whether their personal data is being processed, requesting access to personal data, requesting correction of inaccurate or incomplete information, requesting the deletion or destruction of personal data where legally applicable, and learning how their personal data is used.
Individuals may also request information regarding third parties to whom their personal data has been transferred.
​
Contact
Any requests or inquiries regarding personal data protection and the exercise of data subject rights may be submitted by contacting Rare & Roots via email at:
Requests will be evaluated and responded to in accordance with the provisions of the Turkish Personal Data Protection Law.