This notice has been prepared under Article 10 of Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
1. Data controller
Your personal data is processed by the company operating the MüzayedeBox platform, acting as data controller. Identifying details of the data controller:
- destek@muzayedebox.com
2. Personal data processed
- Identity: name and surname, declaration of being 18 or over; for seller applications, Turkish ID number or tax identification number.
- Contact: email address, phone number, delivery address.
- Customer transactions: bids and ceilings, orders, disputes, lot questions, follows and saved searches, notification preferences.
- Financial: payment and refund records; for sellers, IBAN, invoice and payout details.
- Transaction security: session records, IP address, device and browser information, audit records.
- Visual: photos and documents uploaded by the seller for a lot.
Card details are neither processed nor stored. Payment is taken through a licensed payment institution; card data never reaches our servers at any stage.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Membership, sign-in and providing the auction service | Formation and performance of a contract |
| Payment, escrow, refund and payout transactions | Performance of a contract; legal obligation |
| Invoice, accounting and tax records | Legal obligation (Tax Procedure Law, Turkish Commercial Code) |
| Keeping electronic commerce records | Legal obligation (Law No. 6563) |
| Detecting price inflation, fraud and multiple accounts | Legitimate interest |
| Compliance checks under cultural property legislation | Legal obligation (Law No. 2863) |
| Bid, closing and order notifications | Performance of a contract |
| Resolving disputes and objections | Establishing, exercising and protecting a right |
| Campaign and marketing messages | Explicit consent (commercial message consent) |
4. Method of collection
Your personal data is collected electronically through membership, profile, seller application and order forms, bid and question actions, transaction notifications from the payment institution, and system records generated while you use the Platform.
5. Transfers
Your personal data is transferred only to the following recipient groups, and only as far as the service requires:
- The other party to the transaction: when a sale is made, the details needed for delivery (name and surname, delivery address, phone) are shared with the seller. In bidding, other members see only your masked name and paddle number.
- Service providers: the payment institution, shipping companies, email and notification delivery providers, hosting and database service providers.
- Authorised bodies: judicial authorities and authorised public institutions where the legislation requires.
The hosting infrastructure is in the European Union (Frankfurt) region; because of email and payment service providers, transfers abroad may take place. Transfers abroad are made with the safeguards set out in Article 9 of the KVKK.
6. Retention periods
- Transaction, order and invoice records are kept for 10 years as required by law.
- Electronic commerce transaction records are kept for the period set out in Law No. 6563 and its secondary legislation.
- Membership data is kept after the account is closed until the legal retention periods expire, and is then deleted or anonymised.
- The Turkish ID number in a seller application is deleted from the record once the application is decided; only the fact that verification was carried out is kept.
7. Your rights
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties in Turkey or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its deletion or destruction within the framework of Article 7 of the KVKK; to request that these actions be notified to third parties to whom it was transferred; to object to an outcome against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage because of unlawful processing.
You can send your request from the email address registered to your account to destek@muzayedebox.com. Requests are concluded free of charge as soon as possible according to their nature and within 30 days at the latest; if the action requires an additional cost, the tariff set by the Board may apply.