Personal Data Notice & Privacy Policy

Last updated: 30 October 2026

Data controller and scope

Seller / data controller: Önder Özkoç — Woodenblack
Address: Dilmen Mah. 6016 Sk. No:16, Erenler / Sakarya, Türkiye
Contact and complaints: info@woodenblack.com · 0542 486 96 55
Website: woodenblack.com.tr

This notice explains how your personal data is processed in connection with shopping, account services, support requests, team applications and customisation images. It is not a request for explicit consent or marketing permission.

What data do we process, and why?

• Orders and delivery: Your full name, email address, telephone number, billing/delivery address, order details and selected products are processed to create and deliver your order and provide support. Legal basis: Article 5(2)(c) of the Turkish Personal Data Protection Law (KVKK), establishment or performance of a contract.
• Payments and invoicing: The bank transfer sender, amount, payment reference, selected payment method, card payment transaction reference and result, and required billing information are processed to match payments, issue invoices and keep statutory records. When paying by card through PAYTR, card details are entered on PAYTR's secure payment screen; Woodenblack's order form does not request card details. Legal basis: Articles 5(2)(c) and 5(2)(ç), contract performance and legal obligations.
• Accounts and security: Account/session information, IP addresses and activity logs are processed to operate your account, prevent unauthorised access and stop misuse of uploads. Legal basis: Article 5(2)(c) and, provided that your fundamental rights are not harmed, Article 5(2)(f), legitimate interests.
• Customisation: Your uploaded image, layout and product choices are processed for previews, printing, order fulfilment and resolving disputes. Legal basis: Article 5(2)(c) and, where necessary to protect rights, Article 5(2)(e).
• Support and rights requests: Correspondence, complaints and return records are processed to resolve requests and protect rights. Legal basis: Articles 5(2)(c), 5(2)(ç) and 5(2)(e).
• Team applications: The full name, email address, city, application message and optional Instagram/video links you provide on the form are processed to assess your team application and contact you about it. Legal basis: Article 5(2)(f) of the KVKK, the legitimate interest in assessing team applications, provided that your fundamental rights and freedoms are not harmed. Submitting an application does not authorise public disclosure of your information or marketing messages. Application records are retained only for as long as needed for assessment and, where applicable, to protect a specific right; they must be deleted, destroyed or anonymised when the conditions for processing no longer apply.

Collection and sharing

Data is collected electronically through website forms and purchases, file uploads, email/telephone correspondence and bank transaction records, and through documents where necessary. Names, addresses and telephone numbers needed for delivery may be shared with delivery service providers; transaction information needed for payments/refunds may be shared with banks; and, when card payment is selected, order, amount and contact information needed to process payment may be shared with PAYTR Ödeme ve Elektronik Para Kuruluşu A.Ş. Financial records may be shared with authorised accounting services and competent public authorities to the extent required by law. Technical providers, including hosting and email services, process the data needed to operate the website and notifications only within their assigned functions. Order artwork is not placed in a public gallery.

Hosting outside Türkiye

The website is hosted on Hostinger's servers in France. Order, contact, account, security, team application and customisation file data held on the website is stored on this infrastructure. Hosting supports operation of the website and order processing. In addition to the processing grounds above, transfers abroad must also meet the conditions in Article 9 of the KVKK. Reading this notice, accepting the sales agreement or placing an order does not, by itself, constitute consent to a transfer abroad.

Retention of order records and customisation files

Electronic commerce records relating to orders, contracts, payments and evidence of transactions are retained, under Article 11 of Law No. 6563, for 10 years from the date of the business activity or transaction. This requirement does not mean that every original uploaded image will be retained unconditionally for 10 years.

Original images and preview files are stored with access controls and encryption. Files not linked to an order are included in the daily cleanup process 30 days after upload. Files linked to an order are excluded from this automatic cleanup. The relevant files must be deleted, destroyed or anonymised once the period necessary for production and the protection of specific rights ends. You may also request deletion of a design linked to an order through the channels below; if statutory retention is required, its scope will be explained to you. Do not upload medical/identity documents or personal images of others without permission.

Social links and marketing

Instagram and WhatsApp links take you to other services; your relationship with those services is subject to their own data processing terms. Completing your order is not conditional on consenting to advertising or promotional messages. Viewing this notice or acknowledging that you have read it does not constitute explicit consent or approval for commercial communications.

Your rights and requests

To exercise your rights under Article 11 of the KVKK, you may submit a written request to the address above or email us from an email address that you have previously provided and that is registered in our system at info@woodenblack.com. Your request must include the identity/contact information required by the applicable Communiqué and details of your request. Any necessary identity verification will be appropriate and proportionate to your request. We will resolve your request as soon as possible and within 30 days at the latest, and respond in writing or electronically. Your right to complain to the Personal Data Protection Board under the statutory conditions remains reserved.