Legal

This privacy notice is issued under Article 10 of the Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. Version: R19-2026-10-09 · Effective date: 09.10.2026 (9 October 2026)

1. Data controller

The data controller, who determines the purposes and means of processing your personal data, is:

• Name / trade name: Salim Ayaz, sole proprietorship operating under the brand "İsmet Peyzaj"
• Address: Çiftlik Mahallesi, İhsaniye Adnan Menderes Caddesi No: 339, Gölcük / Kocaeli, Türkiye
• Telephone: +90 543 309 32 56
• E-mail: info@ismetpeyzaj.com
• Website: https://ismetpeyzaj.com
• Tax office and tax identification number: Gölcük Tax Office · 1080066826

The data controller is established in Türkiye, so no separate data controller representative exists.

This notice applies to people who visit our website, register an account, place an order (with or without an account), submit a survey request or contact form, use the garden concept tool or write a product review.

Information and explicit consent are different things. This notice only informs you; it is not a statement of explicit consent, and reading it does not mean you have given explicit consent. For processing that requires explicit consent (visitor statistics, the concept photograph, publication of a product review, and commercial electronic messages) your consent is obtained separately from this notice and only for the relevant processing; you can withdraw it at any time.

2. Which data do we process, for what purpose and on what legal ground?

Your data is processed for the purposes shown separately for each activity below, relying on one of the conditions in Article 5(2) KVKK (or on your explicit consent). The legal grounds we use are: 5/2-(c) processing is directly related to the formation or performance of a contract; 5/2-(ç) compliance with a legal obligation; 5/2-(e) establishment, exercise or protection of a right; 5/2-(f) our legitimate interests, provided your fundamental rights and freedoms are not harmed; 5/2-(a) expressly provided for by law; 5/1 explicit consent.

Activity	Data processed	Purpose	Legal ground
Visiting the website (necessary cookies and technical logs)	Request time and address, request ID, error logs; your cart, province, language and cookie choice. Your IP address is used temporarily to limit requests and may appear in audit logs.	Operating the site, remembering your cart and choices, security, limiting excessive or malicious requests, fixing errors	5/2-(f); for cookies also 5/2-(c)
Visitor statistics (only if you choose "Accept all" in the cookie banner)	A random visitor and session identifier generated in your browser, page paths visited (without query parameters), time spent on pages, product and category views, on-site search terms, cart and order step events, device class, language, referring site domain; if you place an order, the link between the order and your visit. Your name, e-mail, telephone, address or account details are not written to these records.	To see where the shop is difficult to use, to improve products and pages, to produce aggregate (anonymous) usage statistics	5/1 explicit consent
Technical error reports	Error type, page path, action type and status code. They contain no identity, IP address, session or account data.	Keeping the site running correctly	5/2-(f)
Membership	Full name, e-mail, telephone, password (stored only as a one-way hash; the plain password is not known), preferred language, e-mail verification status, last sign-in time, failed sign-in count and temporary lock information, record of acceptance of the membership terms and privacy notice (version, time, IP address), your saved addresses (up to ten: label, recipient, telephone, province, district, full address, postal code), communication preferences	Opening and managing the account, authentication and account security, verifying the e-mail address, showing order history, pre-filling address details at checkout	5/2-(c); for security 5/2-(f); for keeping the consent record 5/2-(e)
Orders (with or without an account)	Full name, telephone, e-mail, delivery address (province, district, full address), invoice name and address, buyer type (individual or business); for business buyers the company name, tax office, tax or Turkish ID number; delivery note, preferred time slot; order contents, amount and coupon; order and delivery status records; record of acceptance of the contract and privacy notice (version and time); record that payment was received (date and staff note); for bank transfer/EFT payments, the sender name, account details and description visible in bank account movements; e-Arşiv invoice details; cancellation, return and withdrawal records. For an order without an account also an order access link (only a hash of a random key is stored) and a cookie placed in your browser.	Receiving and verifying the order, reserving stock, planning and making the delivery, tracking and matching payment, issuing an e-Arşiv invoice, handling cancellation, return, withdrawal and defect requests, communicating with you, sending order e-mails	5/2-(c); for invoice, retention and document obligations under tax, commercial and consumer law 5/2-(ç); for disputes 5/2-(e)
Survey (site visit) request	Full name, telephone, e-mail (optional), district, area type and size, current condition, wishes, budget range, your note, preferred contact time, photographs you optionally upload (up to three), record of the tick box in the form (version and time); our team's notes, request stage, estimated job value and quotation information	Assessing your request, contacting you, scheduling the site visit, preparing a quotation once needs and installation details are clear	5/2-(c) (carrying out pre-contract steps at your request) and 5/2-(f) (assessing the request properly). The tick box in the form confirms that you have read this notice and that your contact details may be used for this purpose.
Garden concept tool	Your choices (place type, area size, ground, plant palette, pergola, lighting, budget), language, the calculated material list and estimated price range; the random address of your concept page; the optional single photograph you upload and the record of the consent you gave for it (version and time). If you send a survey request, the concept is attached to your request. Anyone who knows the address of the concept page can see the page; share the address only with people you trust.	Showing your concept and estimated price range, passing it to the survey process if you ask	For the concept result 5/2-(c); for the photograph 5/1 explicit consent
Contact form and direct contact (telephone, e-mail, WhatsApp)	Full name, telephone, subject and your message; the information you give when you write or call us by e-mail, telephone or WhatsApp	Answering your questions and getting back to you	5/2-(f); if your message is a pre-contract request 5/2-(c)
Product reviews	Your rating, review text, a display name made of your first name and the initial of your surname (for example "Elif D."), the record of your publication consent (version and time), the moderation record	Reviewing your review and publishing it publicly on the product page in the form you approved	5/1 explicit consent (publication approval); for moderation and preventing abuse 5/2-(f)
Communication preferences and commercial electronic messages	Your campaign and news preferences (off by default), preference history (category, state, time, source, text version)	Sending only the commercial electronic messages you choose, and proving your choice	5/1 explicit consent (and Law No. 6563 Article 6); for keeping the record 5/2-(e) and 5/2-(ç)
Security and audit logs	The user who acted, action type, time, IP address and request ID (for example for account, order or content changes)	Preventing unauthorised access and misuse, investigating errors and disputes	5/2-(f); 5/2-(e)
Legal and financial obligations	The relevant items from the groups above (for example invoice, order and collection records)	Issuing and retaining documents and making notifications required by tax, commercial and consumer law; responding to requests from competent authorities	5/2-(a); 5/2-(ç)

Your credit or debit card details are not collected, processed or stored through our site. No online payment is taken on the site; after you place your order, payment is made by bank transfer/EFT to the bank account that we notify to you.

Photographs may show people, vehicle plates or neighbouring property. Please upload only photographs that show the area to be worked on, and do not upload images containing special categories of personal data.

We collect your data directly from you: by automatic means through the forms on our site, your account and your browser, and by non-automatic means through telephone, e-mail and WhatsApp, orally or in writing. We do not use automated decision-making or profiling that produces an adverse result for you solely through automated analysis.

3. To whom and for what purpose is your personal data transferred?

Your data may be transferred to the following groups of recipients, only for the stated purpose and to the narrowest extent necessary:

• Hosting provider (data processor): Contabo, to run the website, database and records; the servers are in Germany.
• E-mail delivery service (data processor): Brevo, for delivering account verification, password reset, order and document e-mails.
• File (object) storage service (data processor): Cloudflare R2. Product and content images and survey and concept photographs are stored there; photographs are kept in a non-public area and viewed only by authorised staff.
• Cargo companies: for orders shipped by cargo outside Kocaeli, the cargo company carrying the parcel receives your name, telephone and delivery address, to make the delivery. Deliveries inside Kocaeli are made with our own vehicle.
• Banks: if you pay by bank transfer/EFT, the banks carrying out the transaction process it under their own legislation and responsibility.
• Accountant / bookkeeping providers: to the extent we use such a service, to issue invoices and documents and meet tax obligations.
• Competent public authorities and courts: to the extent requested by those legally authorised; including the Revenue Administration because of e-Arşiv invoice issuing and reporting obligations (KVKK Articles 8/2 and 5/2-(a), (ç)).
• Legal advisers: where necessary for the establishment, exercise or protection of a right, under a duty of confidentiality.

No third-party advertising, tracking or analytics tools are used on our site, and your personal data is not shared with third parties for advertising or marketing. Links on our site to Google Maps, WhatsApp and social media take you to the third party's own site; that third party is responsible for its own data processing.

4. Transfers abroad

Because we obtain hosting from servers in Germany, the personal data processed on our site is kept on servers outside Türkiye. In addition, the servers or competent units of Cloudflare, Inc. (based in the USA), which we use for file storage, and of Brevo, which we use for e-mail delivery, may be outside Türkiye. Your data is therefore transferred abroad.

Transfers abroad are governed by Article 9 KVKK (as amended by Law No. 7499 of 2 March 2024) and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad: a transfer rests on an adequacy decision of the Personal Data Protection Board for the destination country or sector where one exists, and otherwise on one of the appropriate safeguards listed in Article 9(4), such as the standard contract. A standard contract is notified to the Authority within five business days of signature. It is also required that you can exercise your rights and seek effective legal remedies in the destination country. Explicit consent is provided for only as a basis for incidental transfers, not for routine ones.

To obtain information about which safeguard a transfer to a particular recipient rests on, you may apply to us under Article 11 KVKK.

5. Retention periods

Your data is retained for the period required by the relevant legislation or necessary for the purpose for which it is processed; after that it is deleted, destroyed or anonymised (KVKK Articles 4 and 7). Some periods are technically fixed in our system or have been set by us:

Data	Retention period
Visitor statistics (collected with your consent)	180 days
Technical error reports	90 days
Member session (on the server)	7 days of inactivity, and in any case at most 30 days
Order access link and cookie for orders without an account	180 days
Survey and concept photographs	90 days after the survey request is closed; for a concept photograph not attached to a survey request, 90 days after the concept was created. At the end of this period the photographs are deleted. You can ask at any time for them to be deleted before then.
Order, invoice, document and collection records	For the period provided by the relevant tax, commercial and consumer legislation. Under the Regulation on Distance Contracts, information and documents about withdrawal, information provided and delivery are kept for at least three years.
Account and membership data	While your account is open; after the account is closed, for the period required by legal retention obligations and for proof
Survey requests, notes and quotation information	For as long as the purpose of processing the request continues and as needed for proof
Contact form messages	For as long as needed to answer your message and for proof
Product reviews	Until you delete the review or it is withdrawn from publication; if you delete it, it is removed from publication
Communication preference and consent records	For as long as needed to prove your consent
Security and audit logs	For as long as needed for security and dispute investigation

Some records in our system (orders, survey requests, contact messages and consent records) are not deleted automatically by the application; when these records must be deleted or anonymised, this is carried out separately by the data controller.

6. Cookies and similar technologies

Our site uses the cookies it needs to work; your consent is not required for these. Visitor statistics are collected only if you choose "Accept all" in the cookie banner. With the "Cookie preferences" button at the bottom of the site you can change or withdraw your choice at any time; when you withdraw it, your analytics identifiers are deleted from your browser. Our site does not use third-party cookies or tracking tools.

Name	Purpose	Duration	Type
cookie_consent	Remembering your cookie choice	180 days	Necessary
cart	Contents of your cart (product and quantity)	30 days	Necessary
city	The province you selected (to apply the delivery rule)	365 days	Necessary
coupon	The coupon code you entered	7 days	Necessary
NEXT_LOCALE	Your language preference	Browser session	Necessary / functional
__Host-SESSION	Keeping you signed in	Browser session (the session on the server is valid for 7 days of inactivity, at most 30 days)	Necessary
XSRF-TOKEN	Form security (protection against forged requests)	Browser session	Necessary
ip_guest	Access to an order placed without an account from this browser	180 days	Necessary
ismet-theme (browser storage)	Your light / dark theme preference	Until you change it	Functional
ip_visitor, ip_session (browser storage)	Random analytics identifiers	Until you withdraw consent (server-side data: 180 days)	Only with consent
Session storage (cleared when the tab closes)	Preventing double submission at checkout and showing your last order	Until the tab is closed	Necessary

7. Data security

We apply technical and administrative measures to prevent unlawful processing of, unauthorised access to and loss of your personal data. These include an encrypted connection (HTTPS), storing passwords only as one-way hashes, limiting staff access by authorisation and two-step verification for the administration panel, keeping photographs in a non-public area and masking personal data in logs. If your personal data is obtained by others through unlawful means, we will notify you and the Personal Data Protection Board as soon as possible (KVKK Article 12/5).

8. Your rights and how to apply

Under Article 11 KVKK you may apply to the data controller to:

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether it is used in line with that purpose,
• Know the third parties to whom your data is transferred in Türkiye or abroad,
• Request correction if it is incomplete or inaccurate,
• Request deletion or destruction within the conditions of KVKK Article 7,
• Request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
• Object to a result against you arising from analysis of the data exclusively by automated systems,
• Claim compensation if you suffer damage because the data was processed unlawfully.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, applications must be made in Turkish, in one of these ways:

1. In writing to the address above (in person or through a notary),
2. By sending an application signed with a secure electronic signature or mobile signature to info@ismetpeyzaj.com,
3. By writing to info@ismetpeyzaj.com from the e-mail address that you previously notified to us and that is registered in our system (for example the address you gave when ordering, registering or sending a survey request).

Your application must state your full name, signature (for written applications), Turkish ID number (for foreigners, nationality and passport or ID number), your residence or workplace address for notification, your e-mail and telephone if any, and the subject of your request; you may attach related information and documents. We conclude your request free of charge as soon as possible according to its nature and within thirty days at the latest; if the process requires a separate cost, the fee in the tariff set by the Board may be charged. We accept the request or reject it with reasons, and communicate our reply to you in writing or electronically.

If your application is rejected, the reply is insufficient or no reply is given in time, you may complain to the Personal Data Protection Board within thirty days from learning of our reply and in any case within sixty days from the date of your application (KVKK Article 14).

9. Commercial electronic messages

Sending you commercial electronic messages (campaigns, announcements, newsletters) depends not on a processing ground in this notice but on a separate consent you give (Law No. 6563 on the Regulation of Electronic Commerce, Article 6). The related options at registration are unticked by default; you can withdraw your consent at any time in your account's communication preferences or through the link in every message. Account verification, password reset, order, delivery and security e-mails are not commercial electronic messages and are sent regardless of your preferences.

10. Changes

We may update this notice in line with changes in legislation or our services. The current text is always published on this page; the version identifier and effective date are shown at the top of the page. When there is a significant change, you will be informed again in the relevant forms.

For questions: info@ismetpeyzaj.com · +90 543 309 32 56