Galerifoton.com Privacy Policy
Last updated: October 21, 2026
This Privacy Policy explains how we collect, use and share your personal data when you visit or buy from galerifoton.com (the “Site”).
Who we are
The Site is operated by Hakan Caba (sole proprietorship / şahıs şirketi), Kayışdağı Mah., Ataşehir, İstanbul, Türkiye. Hakan Caba is the data controller for the personal data described in this policy. We sell to customers outside Türkiye and ship internationally. You can reach us at info@galerifoton.com.
What we collect
- Device information: your browser, IP address and time zone, the pages and products you view, the website or search terms that referred you, and how you use the Site. We collect this through cookies and server log files.
- Order information: your name, billing address, shipping address, email address and phone number.
- Payment information: card payments are handled by our payment provider, iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.). You enter your card details on iyzico’s secure payment form. We never see or store your full card number, expiry date or security code. We only receive limited details from iyzico, such as the payment status, the first and last digits of your card, and a transaction reference.
- Messages: if you contact us by email or WhatsApp, we keep your messages so we can help you.
How we use your data and why
| Purpose | Data used | Legal basis |
|---|---|---|
| Fulfil your order: payment, shipping, customs documents, order emails | Order, payment | Performance of our contract with you |
| Keep invoices and accounting records | Order, payment | Legal obligation under Turkish tax and commercial law |
| Answer your questions and handle returns | Order, messages | Performance of our contract; our legitimate interest in customer service |
| Prevent fraud and keep the Site secure | Device, order | Our legitimate interest in protecting our business and customers |
| Understand how visitors use the Site (Google Analytics) | Device | Our legitimate interest in improving the Site |
If you subscribe through the newsletter form, we store your email address with your consent. We do not send newsletters at the moment, and you can ask us to delete your address at any time. We do not use your data for targeted advertising.
Cookies
- Essential cookies keep your cart, checkout and login working. The Site cannot work properly without them.
- Analytics cookies (Google Analytics) show us how visitors use the Site. They collect pseudonymous usage data, not your name or contact details.
You can block or delete cookies in your browser settings, or install the Google Analytics opt-out add-on.
Who we share your data with
We share your data only as needed to run our business and deliver your order:
- iyzico (payment processing): receives the information needed for the payment, which may include your name, email, phone number, billing address and IP address. iyzico uses it to complete the payment, prevent fraud and meet its legal obligations. iyzico is a payment institution licensed by the Central Bank of the Republic of Türkiye and handles card data in line with PCI DSS standards. Its privacy notice is available on iyzico.com.
- Shipping carriers and customs authorities: your name, shipping address, phone number and order contents, so your parcel can be delivered.
- Our website hosting provider: stores the Site and the data in it on our behalf.
- Banks: if you pay by bank transfer, your bank and ours process the payment details.
- Our accountant and the Turkish tax authorities: invoice details, as required by law.
- WhatsApp (Meta): if you message us on WhatsApp, your messages are handled under WhatsApp’s own privacy policy.
- Google Analytics: usage data from the Site. See how Google uses this data.
We may also share data to comply with the law, to respond to lawful requests from authorities, or to protect our rights. We do not sell your personal data.
International transfers
We are based in Türkiye and our customers live in other countries. Your data is processed in Türkiye and in the countries where our service providers and carriers operate. Transfers needed to deliver your order are made because they are necessary to perform our contract with you. Other transfers rely on the safeguards required by Türkiye’s Personal Data Protection Law No. 6698 (KVKK) and, for customers in the EEA or UK, the GDPR.
How long we keep your data
| Data | How long we keep it |
|---|---|
| Orders, invoices and payment records | As long as Turkish tax and commercial law requires (up to 10 years) |
| Messages with you | Up to 2 years after our last exchange |
| Google Analytics data | 14 months |
| Newsletter sign-ups | Until you ask us to delete them |
After these periods, we delete or anonymise the data.
Your rights
Depending on where you live, you may have the right to:
- know whether we process your data, why, and who we share it with
- get a copy of the data we hold about you
- have it corrected, completed or deleted
- object to or restrict certain processing
- receive your data in a portable format
- withdraw your consent at any time, where processing is based on consent
- claim compensation for damage caused by unlawful processing
To use any of these rights, email info@galerifoton.com. We reply within 30 days. You can also complain to your local data protection authority, or in Türkiye to the Personal Data Protection Authority (KVKK).
Security
The Site uses SSL encryption, and all card payments are processed on iyzico’s secure infrastructure. We take reasonable measures to protect your data, but no method of transmission over the internet is completely secure.
Children
The Site is not intended for anyone under 18, and we do not knowingly collect data from children.
Changes
We may update this policy to reflect changes to our practices or the law. The new version will be posted on this page with a new “Last updated” date.
Contact
Questions about this policy? Email info@galerifoton.com.