Datenschutzerklärung
Privacy Policy
Last updated: [[DOLDUR: yayım tarihi — politikanın siteye eklendiği/güncellendiği tarih]]
Fifty Boutique respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, place an order, contact us, create an account, subscribe to marketing communications or otherwise interact with our store. It is provided in accordance with Articles 12, 13 and 14 of the EU General Data Protection Regulation (GDPR).
Nothing in this Privacy Policy limits any privacy or consumer rights that may apply under mandatory law.
1. Who We Are (Data Controller)
The data controller responsible for your personal information is:
Store name: Fifty Boutique
Website: https://www.fiftyboutique.com
Data controller (legal business name): [[DOLDUR: veri sorumlusu — şahıs/şirket yasal adı]]
Registered business address: [[DOLDUR: kayıtlı ticari adres — mevcut şahıs işletmesinin veya kurulunca BG EOOD'nin tam yasal adresi]]
Email: [[DOLDUR: destek e-posta adresi]]
Phone / WhatsApp: [[DOLDUR: telefon / WhatsApp numarası, uluslararası formatta]]
Representative in the European Union (Article 27 GDPR): [[DOLDUR: AB temsilcisinin adı, adresi ve e-postası — veri sorumlusu AB dışında (Türkiye'de) yerleşik olduğu sürece GDPR Madde 27 gereği zorunludur; AB içinde şirket (BG EOOD) kurulduğunda bu satır kaldırılabilir]]
We have not appointed a data protection officer, as we are not required to do so. For any privacy question or request, please use the contact details above.
2. Personal Information We Collect
Depending on how you interact with our store, we collect the following categories of personal information:
- Identity and contact details: name, billing and shipping addresses, email address, phone number.
- Order information: products purchased, sizes, order value, order history, delivery details and delivery status.
- Payment information: payment method and payment confirmation. Full card numbers are processed by our payment providers (Shopify Payments, PayPal) and are never stored by us.
- Account information: login details and preferences, if you create a customer account.
- Communications: messages you send us, including service messages, support requests, returns and complaints.
- Technical and usage data: IP address, device and browser type, operating system, pages viewed and interactions with our website.
- Cookie and consent data: cookie identifiers and the consent choices you make in our cookie banner.
- Marketing preferences: whether you have subscribed to or opted out of marketing communications.
- Fraud prevention data: signals used to detect and prevent fraudulent transactions.
We do not intentionally collect any special categories of personal data (such as health or religious information) and ask that you do not send us such data.
3. How We Collect Information
We collect personal information:
- Directly from you, when you place an order, create an account, contact us or subscribe to marketing.
- Automatically, through cookies and similar technologies when you use our website (see Section 9).
- From our service providers — such as payment processors, fraud prevention services and shipping carriers — which confirm payment, screening and delivery information to us.
- From analytics and advertising platforms (such as Google and Meta), which provide us with aggregated statistics and, only where you have consented, campaign measurement data.
4. How We Use Your Information (Purposes)
We use personal information to:
- accept, process and fulfil your orders;
- process payments and prevent fraudulent transactions;
- arrange delivery and provide shipment tracking;
- handle returns, exchanges and refunds;
- provide customer support and respond to your messages;
- secure and improve our website, products and services;
- send service messages about your orders and account;
- send marketing communications, if you have opted in;
- measure the performance of our advertising, if you have consented to marketing cookies;
- comply with legal obligations, such as tax, accounting and consumer protection law;
- establish, exercise or defend legal claims.
5. Legal Bases for Processing
Under the GDPR, we rely on the following legal bases, mapped to the purposes above:
- Performance of a contract (Article 6(1)(b) GDPR): accepting and fulfilling orders, payments, delivery and tracking, returns and refunds, customer support and service messages.
- Legal obligation (Article 6(1)(c) GDPR): keeping tax and accounting records and complying with consumer protection and other applicable laws.
- Legitimate interests (Article 6(1)(f) GDPR): securing our website, preventing fraud and abuse, improving our products and services, and establishing, exercising or defending legal claims. These are the legitimate interests we pursue; you may object to this processing as described in Section 12.
- Consent (Article 6(1)(a) GDPR): email/SMS marketing, non-essential cookies, and analytics and advertising pixels (Meta, Google). You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Providing your identity, contact, delivery and payment details is a requirement necessary to enter into and perform a sales contract with us: without this information we cannot accept or deliver your order. All other information (such as marketing preferences) is optional.
6. Sharing Personal Information
We share personal information with the following categories of recipients, only to the extent necessary:
- Shopify and its affiliates, which provide our e-commerce platform, hosting and payment infrastructure;
- payment processors (Shopify Payments, PayPal) and fraud prevention services;
- shipping and logistics carriers that deliver your orders;
- email/SMS and customer support service providers;
- analytics providers and advertising platforms (Google, Meta) — only where you have given consent through our cookie banner;
- professional advisors (such as accountants and lawyers) where necessary;
- public authorities, courts or regulators, where required by law.
We do not sell personal information in the traditional sense. Some laws define "sale" or "sharing" broadly enough to cover the use of advertising cookies; you can control this at any time through our cookie banner (see Sections 9 and 14).
7. Shopify
Our store is hosted by Shopify, which processes personal information on our behalf as a processor under a data processing agreement that incorporates the European Commission's Standard Contractual Clauses. Shopify may store data on secure servers in various countries. For more information, see the Shopify Privacy Policy at https://www.shopify.com/legal/privacy.
8. International Data Transfers
We are based in Türkiye and fulfil orders from Türkiye, so the personal information needed to process, pack and ship your order is transferred to and processed in Türkiye. Türkiye is not covered by a European Commission adequacy decision. Some of our service providers also process data outside the European Economic Area (EEA), for example in Canada and the United States.
Where personal data is transferred outside the EEA, we rely on the following safeguards:
- the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with supplementary measures where needed — this is the safeguard we apply to processing in Türkiye, and it is also included in our agreements with providers such as Shopify;
- European Commission adequacy decisions, where the recipient country or framework is covered by one (for example, transfers to US providers certified under the EU-US Data Privacy Framework).
You may request a copy of the relevant safeguards using the contact details in Section 18.
9. Cookies and Similar Technologies
We use cookies and similar technologies to make our store work, remember your cart and preferences, analyse how the site is used and — only with your consent — measure and personalise advertising (including Meta and Google pixels).
Non-essential cookies are set only if you agree through our cookie consent banner, which is integrated with Shopify's consent management (Customer Privacy) system. You can change or withdraw your choices at any time through the cookie settings link on our website or via your browser settings.
For details of the cookies we use and their lifespans, please see our Cookie Policy.
10. Marketing Communications
We send email or SMS marketing (such as news about products and offers) only if you have opted in. You can unsubscribe at any time using the link in each message or by contacting us. Opting out of marketing does not affect service messages about your orders, and withdrawing consent does not affect the lawfulness of marketing sent before you withdrew.
11. Data Retention
We keep personal information only for as long as necessary for the purposes described in this policy. The criteria we use to determine retention periods are: the duration of our relationship with you; the retention periods required by applicable tax, accounting and commercial law; the limitation periods for legal claims; and our security and fraud prevention needs.
For example: order, invoice and payment records are kept for the period required by applicable tax and commercial legislation ([[DOLDUR: geçerli vergi/ticaret mevzuatına göre saklama süresi, örn. 10 yıl]]); marketing data is kept until you unsubscribe or withdraw consent; cookie lifespans are set out in our Cookie Policy. When information is no longer needed, we delete or anonymise it.
12. Your Privacy Rights
Subject to applicable law, you have the right to:
- access the personal information we hold about you and receive a copy;
- rectification of inaccurate or incomplete information;
- erasure ("right to be forgotten") of your information;
- restriction of processing;
- data portability (receiving your data in a structured, commonly used, machine-readable format);
- object to processing based on legitimate interests, and object at any time to direct marketing, in which case we will stop;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you. Automated fraud screening by our payment providers is subject to human review before any order is finally refused, and interest-based advertising profiles are created by advertising platforms only if you consent to marketing cookies.
To exercise any of these rights, contact us at [[DOLDUR: destek e-posta adresi]]. We may need to verify your identity before responding. We will respond within one month (extendable by up to two further months for complex requests, in which case we will inform you) and free of charge, unless a request is manifestly unfounded or excessive.
13. European Economic Area, United Kingdom and Similar Regions
If you are in the EEA or the UK, all of the rights in Section 12 apply to you. You also have the right to lodge a complaint with a data protection supervisory authority — in particular in the EU member state where you live, where you work or where you believe an infringement of data protection law occurred (in the UK, the Information Commissioner's Office). A list of EU supervisory authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. We would appreciate the chance to address your concerns first, but you may contact your supervisory authority at any time.
14. United States Privacy Rights
Fifty Boutique currently sells and ships only to customers in the European Union, so this section does not currently apply. It will apply only if and when we begin offering products to residents of the United States. In that case, residents of certain US states will have rights to access, correct and delete personal information and to opt out of "sale", "sharing" or targeted advertising, exercisable through our cookie banner ("Your Privacy Choices") or by contacting us.
15. Security
We use appropriate technical and organisational measures to protect personal information, including encrypted (TLS/SSL) connections, access controls and PCI-DSS compliant payment processing through our payment providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work continuously to protect your information.
16. Children's Privacy
Our store is not intended for children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new "Last updated" date and, if changes are material, we will provide a more prominent notice (for example on our website or by email where appropriate). Please review this page periodically.
18. Contact
For any question, request or complaint about this Privacy Policy or your personal information, contact:
Fifty Boutique
[[DOLDUR: veri sorumlusu — şahıs/şirket yasal adı]]
Email: [[DOLDUR: destek e-posta adresi]]
Address: [[DOLDUR: kayıtlı ticari adres]]
Phone / WhatsApp: [[DOLDUR: telefon / WhatsApp numarası]]