Privacy and Security Policy

This policy explains what information Nura Aydınlatma, publishing at nuraaydinlatma.com, collects when you visit the site, place an order, fill in the contact form or subscribe to our newsletter, for what purposes it uses that information, with whom it shares it and how it protects it.

The text has been drawn up on the basis of Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, KVKK), Law No. 6502 on the Protection of Consumers (Tüketicinin Korunması Hakkında Kanun), the Regulation on Distance Contracts (Mesafeli Sözleşmeler Yönetmeliği), Law No. 6563 on the Regulation of Electronic Commerce (Elektronik Ticaretin Düzenlenmesi Hakkında Kanun) and the secondary legislation issued thereunder. The data controller is Nura Aydınlatma.

The policy applies only to the website belonging to Nura Aydınlatma and to the sales processes carried out through that site. Nura Aydınlatma is not responsible for the privacy practices of third party sites you reach through links on the site.

Other texts that complement this one: the KVKK Disclosure Text (KVKK Aydınlatma Metni) for the processing of personal data, the Cookie Policy (Çerez Politikası) for the use of cookies, and the Commercial Electronic Message Disclosure and Consent Text (Ticari Elektronik İleti Aydınlatma ve Onay Metni) for consent to commercial electronic messages.

We collect only the information we genuinely need in order to provide the service. As the site has no membership or account system, you do not need to create a profile or set a password. The table below shows what information we collect and for what purpose.

For payments by bank transfer or EFT, the sender name and description information passed to us by your bank is processed in order to match the payment with your order. For card payments, the card number, expiry date and security code are never transmitted to Nura Aydınlatma at any stage; the details are in section 4.

No tracking or measurement tool such as Google Analytics, Meta Pixel, an advertising pixel or a heat map is used on the site. There are no third party analytics systems that profile visitor behaviour.

We use the information we collect only for the purposes listed below and limited to those purposes:

• Receiving, preparing, packing and dispatching your order.
• Carrying out free and insured shipping to anywhere in Türkiye and passing on the shipment tracking number.
• Collecting the payment and issuing the e-archive invoice and sending it to your e-mail address.
• Assessing and concluding requests relating to the right of withdrawal, returns, exchanges and the warranty.
• Carrying out the damage report process for a damaged delivery and replacing the product with a new one free of charge.
• Providing support by telephone on assembly and use, and meeting spare part requests.
• Answering the questions, complaints and suggestions you send through the contact form, by telephone or via WhatsApp.
• Sending commercial electronic messages containing campaigns, new products and announcements where your explicit consent exists.
• Keeping the site secure, correcting errors and blocking abusive form submissions.
• Fulfilling the document issuing and retention obligations arising from tax, consumer and electronic commerce legislation.
• Meeting the lawful requests of authorised public institutions and exercising the right of defence in disputes.

Your information is not used outside the purpose for which it was collected. No marketing electronic message is sent without your consent; newsletter subscription is optional and can be ended free of charge at any time you wish.

On our site you may pay by credit card, debit card or bank transfer/EFT; the instalment options defined for your card are displayed at the payment step. For card payments, the transaction is taken over the banks' and payment institutions' own secure infrastructure and you enter your card details directly into that infrastructure.

3D Secure verification

Payments made by card go through 3D Secure verification. At this step your bank sends a one-time verification code to your own mobile telephone, or asks for approval through its own mobile application, in order to confirm that you are the genuine cardholder. The transaction is not approved until verification is complete. This method is an additional layer of protection against the risk of your card being used without your permission.

Encrypted communication

All traffic between the site and your browser is encrypted with SSL/TLS and carried over HTTPS; the information you transmit at the payment step and in form submissions does not travel over the network as readable plain text. The padlock icon in the address bar shows that the connection is encrypted.

No saved cards are stored

Just as the site has no membership system, it also has no card storage feature for use in later purchases; at every payment the card details are entered afresh and only into the infrastructure of the bank or the payment institution. In our records, the only payment related details that may appear are whether the transaction was successful, its amount, its date, the number of instalments if any and the last digits of the card number as masked by the bank. This record is necessary for refund and accounting operations.

Under no circumstances will Nura Aydınlatma staff ask you by telephone, on WhatsApp or by e-mail for your card number, security code, internet banking password or one-time verification code. If you receive such a request, do not share it and let us know.

We do not sell, rent out or transfer your personal data to third parties for marketing purposes. Your information is shared only so that the service can be provided and legal obligations fulfilled, to the extent necessary and with the following parties:

• Courier and logistics companies: Your first name, surname, delivery address and telephone number are shared so that the shipment can be delivered.
• Banks and payment institutions: Transaction information is shared for the purposes of collecting, verifying and refunding the payment and of carrying out any chargeback processes.
• E-invoice / e-archive service provider: Invoice information is shared so that the invoice can be issued in accordance with the legislation and delivered to you.
• Suppliers providing hosting and infrastructure services: Technical access may be involved within the scope of operating the site and order infrastructure.
• Persons from whom legal, financial advisory and audit services are obtained: Only to the extent required by the work concerned and under an obligation of confidentiality.
• Authorised public institutions and organisations: Courts, public prosecutors' offices, the Ministry of Trade (Ticaret Bakanlığı), tax offices and similar authorities, in the event of their lawful requests and limited to the information requested.

The site infrastructure runs on our own server hosted in Türkiye; order and product data is kept on the Saleor e-commerce infrastructure. The site also contains two pieces of third party embedded content: the Google Maps map on the contact and store pages and the Cloudflare Stream video player on the home page. When you view this content, the relevant providers may place their own cookies and may process your technical connection information within the scope of their own policies.

If you request shipping abroad, your address and contact details may be shared with the relevant carrier and customs authorities for customs and delivery procedures.

No cookies are used on the site for advertising, tracking or analytics purposes; only mandatory cookies exist. The only persistent cookie used is the framework cookie named NEXT_LOCALE, which remembers the language you have selected; it is kept for approximately one year and carries no identity information. In addition, session cookies that maintain the technical continuity and the security of the session as you move between pages, that serve no marketing purpose and that are deleted when you close your browser may be placed.

The answer you give to the cookie notice is not sent to our servers and is kept only in your browser's local storage under the key "nura-cerez-onayi". You can reset this preference at any time by clearing the site data from your browser settings.

Embedded content such as Google Maps and Cloudflare Stream may contain cookies placed by their own providers. For detailed information about cookie types, their durations and how to manage your preferences, please see our Cookie Policy (Çerez Politikası).

In order to prevent the unlawful processing of personal data and unlawful access to it, and to ensure that the data is preserved, technical and administrative measures aimed at securing the appropriate level of security are taken in accordance with Article 12 of the KVKK.

Technical measures

• The whole of the site is published over HTTPS; all traffic is encrypted with an SSL/TLS certificate and unencrypted connections are redirected to the secure connection.
• Security headers providing protection at browser level (content security policy, framing protection, content type protection and transport security headers) are applied.
• Server and application software is kept up to date and security patches are applied regularly.
• Access to management interfaces is restricted by strong authentication and authorisation rules; each member of staff can access only the data required by their work.
• An IP address based rate limit is applied on the contact and newsletter forms so that automated and abusive submissions are blocked.
• Order and content data is backed up regularly; the backups are protected against unauthorised access.
• Server logs are kept and monitored against unusual access attempts.

Administrative measures

• Staff who access personal data are under an obligation of confidentiality and are informed about data protection rules.
• The processes in which data is processed are designed so as to work with the minimum data necessary for the purpose alone.
• Obligations ensuring that the data is used only for the purpose of the service are agreed with the suppliers from whom services are obtained.
• Deletion, destruction or anonymisation processes are operated for data whose retention period has expired.

Despite all the measures taken, no transmission made over the internet carries a guarantee of absolute security. If we determine that your data has been unlawfully obtained by others, notification is made to the data subjects concerned and to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) as soon as possible in the manner prescribed by the KVKK.

Your personal data is retained for the period necessary for the purpose for which it is processed and for the periods of limitation and retention prescribed by the legislation. When the period ends, the data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data (Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik).

Where a dispute, an audit or a legal request is involved, the relevant data is retained until the process is concluded.

The site is not directed at persons under 18 years of age and personal data is not knowingly collected from persons under 18. In order to shop on the site you must have legal capacity to act; if you are under 18 you must obtain the consent of your parent or guardian before placing an order or filling in the contact form.

If we notice that personal data belonging to a person under 18 years of age has been transmitted to us without the consent of a parent or guardian, we delete that data without delay. If you believe that we hold data belonging to your child, you may contact us and request its deletion.

Pursuant to Article 11 of the KVKK, as a data subject you have the right to: learn whether your personal data is being processed; request information about it if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties in Türkiye or abroad to whom the data has been transferred; request the correction of data that has been processed incompletely or incorrectly; request its deletion or destruction within the framework of the conditions laid down in the legislation; request that these operations be notified to the third parties to whom the data has been transferred; object to a result arising against you through analysis exclusively by automated systems; and claim compensation for the damage in the event that you suffer damage because of the unlawful processing of the data.

You may submit your requests in a manner complying with the procedure set out in the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ). For convenience, you may fill in and sign the KVKK Data Subject Application Form (KVKK Veri Sahibi Başvuru Formu) we have prepared and send it by post to the address in our corporate details, or send it to the e-mail address in our corporate details from the e-mail address you have previously notified to us and which is registered in our system.

Your application is concluded as soon as possible depending on its nature and in any event within thirty days at the latest. If the operation also requires a cost, the fee in the tariff determined by the Board may be charged. If your application is rejected, if you find the answer given insufficient or if no answer is given within the period, your right to lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) is reserved.

Detailed information about the legal grounds for the processing of your personal data and about the methods of collection and transfer is set out in the KVKK Disclosure Text (KVKK Aydınlatma Metni). For your consumer disputes arising from the sale, you may apply to the Consumer Arbitration Committee (Tüketici Hakem Heyeti) or to the Consumer Court (Tüketici Mahkemesi) within the framework of the monetary limits redetermined each year by the Ministry of Trade (Ticaret Bakanlığı).

Nura Aydınlatma reserves the right to make changes to this policy because of changes in the legislation, the development of the services offered on the site or updates in its business processes. The current text is always published on this page and the last update information is shown at the top of the page.

Changes take effect at the moment they are published. Where a substantial change is made as regards the processing of your personal data and where the legislation so requires, separate information is given or your consent is obtained again.

You may send us your questions and requests relating to your personal data, to this policy or to our security practices through the channels below. You may also come and talk to us at our showroom in Sultangazi on weekdays between 09.00 and 19.00 and on Saturdays between 10.00 and 18.00; we are closed on Sundays.

Our telephone and WhatsApp line operate on the same number; requests you send by e-mail are answered through the address from which you sent them.