1. Data controller

The data controller is Semiha Demir (Fame Stoned).

2. Data we process

• Identity: first name, last name; Turkish ID number where required for invoicing
• Contact: e-mail, phone, delivery and billing address
• Customer transactions: order number, order contents, return and exchange records, your correspondence with us
• Financial: bank account details, for refunds
• Transaction security: IP address, browser and device information, on-site browsing records
• Custom design orders: the image and text you upload
• Marketing: your newsletter subscription, only if you opted in

We never see your payment details. Card data goes straight to the payment provider and is not stored in our systems.

3. Purposes

• Receiving, preparing, shipping and tracking your order
• Handling returns, exchanges and support requests
• Issuing invoices and meeting our legal record-keeping obligations
• Site security, debugging and preventing abuse
• Sending campaign and news e-mails, if you opted in

4. Legal grounds

We process your data under KVKK art. 5 on the following grounds: necessity for the conclusion and performance of a contract (art. 5/2-c), compliance with our legal obligations (art. 5/2-ç), establishment and protection of a right (art. 5/2-e), and our legitimate interests provided your fundamental rights are not harmed (art. 5/2-f). Marketing messages are sent only with your explicit consent, which you can withdraw at any time.

5. Who we share with

• Courier companies — name, address and phone, for delivery
• Payment providers and banks (iyzico and similar) — to take and refund payments
• E-commerce platform (Shopify) — to run and host the store
• Printing and production partner — to produce your order
• Accounting and e-invoice provider — to issue legal documents
• Authorised public bodies — where required by law

We do not sell your data to third parties for advertising.

6. Transfer abroad

Our store runs on Shopify, whose servers are located outside Türkiye. Your data is therefore transferred abroad to the extent necessary for the service to work. Transfers are made under KVKK art. 9.

7. Retention

We keep order and invoice records for as long as the law requires (ten years for commercial books and documents). Support correspondence is kept for three years after the request is closed, and marketing records until you withdraw your consent. Once the period ends, data is deleted, destroyed or anonymised.

8. Cookies

Strictly necessary cookies (cart, session, security) are used so the site can work; without them checkout cannot be completed. Measurement cookies may also be used to understand how the site is used. You can delete or block cookies in your browser settings; blocking the necessary ones will break parts of the site.

9. Security

Site traffic is encrypted with SSL. Only people who need the data for their work can access it. Technical and administrative measures are in place against unauthorised access.

10. Third-party sites

Our site may link to other sites (for example our social media accounts). We are not responsible for their privacy practices; once you follow such a link, that site's own policy applies.

11. Children's privacy

Our site is not aimed at children under 18 and we do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and notice that your child has given us data, contact us and we will delete it.

12. Your rights (KVKK art. 11)

Under KVKK art. 11 you may:

• Learn whether your personal data is being processed
• Request information if it has been processed
• Learn the purpose of processing and whether it is used accordingly
• Know the third parties to whom it is transferred, in Türkiye or abroad
• Request correction if it is incomplete or inaccurate
• Request deletion or destruction where the conditions are met
• Request that corrections and deletions be notified to third parties it was transferred to
• Object to a result against you produced solely by automated analysis
• Claim compensation for damage caused by unlawful processing

13. How to apply

Send your request, together with information confirming your identity, to bilgi@stonedturk.com or in writing to the postal address above. Under the Turkish Communiqué on Application Procedures to the Data Controller, we conclude your request free of charge within 30 days at the latest.

14. Changes

We update this text when necessary. The current version is always published on this page.