Notice de confidentialité KVKK

This notice is given under Article 10 of Turkey's Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles of the Obligation to Inform. It explains how we process the personal data of couples who buy our wedding website designs, of guests who reply on their websites and of visitors to our websites.

1. Data controller

The data controller is BKE Studio, which sells wedding website designs on Etsy in the shop BKEStudioInvites. The full legal name and postal address of the data controller are provided on request by email to bkestudio01@gmail.com.

Contact: bkestudio01@gmail.com or Etsy messages.

2. Personal data we process

Couples who buy a design

• Identity and contact: the name and email address Etsy shares with sellers; the email address you enter when you start your website.
• Order: your Etsy order number, the design bought and the order details in the sale emails Etsy sends to our shop's mailbox.
• Website content: the names, wedding date and time, venue and address, schedule, story, questions and answers and links you enter in your editor; the photos and the music file you upload.
• Security: for each device where you open your editor, a one-way hash of its key, the date it was added and a short label such as “iPhone · Safari”; a one-way hash of your edit link's key; if you connect Google Sheets, the encrypted access token Google gives us.
• Support messages: what you write to us on Etsy and by email.

Guests

• Reply form: name, attending or not, number of guests, the names of the others in the reply, an optional email address and message, and answers to the couple's questions.
• Guest password: if the couple sets one, a cookie that remembers for 90 days that the right password was entered.

The couple decides what guests are asked and what the replies are for; we keep the replies for the couple and show them only to the couple. We do not aim to collect special categories of data (such as health information): you do not have to write such information in answer to a couple's question.

Visitors

• Technical logs: the standard request logs of our hosting provider (IP address, browser details, time). To stop spam, we do not keep the IP address itself; a one-way hash of it counts requests for at most 24 hours.
• Cookies and browser storage: the editor language you choose, changes not saved yet and the editors you opened on this device are kept in your browser; our sales website sets no cookies. Details are in the privacy notice.
• Live help chat: the messages you type, the address of the page you are on and, when you ask from your editor, a few facts about your website (its design, whether it is published, how many name and date changes are left). Names, guests and replies are never sent to the chat.

3. Purposes and legal bases

• Providing what you bought: creating, hosting and publishing your website; opening your editor with your order number and email; emailing your edit and sign-in links; name and date change rights and your “Online until” date; support. Legal basis: necessary for the conclusion or performance of a contract (KVKK Art. 5(2)(c)).
• Confirming orders: looking up the order number among our Etsy shop's orders and in the sale emails Etsy sends us; allowing as many websites as designs bought in an order. Legal basis: Art. 5(2)(c) and our legitimate interest in stopping websites started with fake order numbers (Art. 5(2)(f)).
• Collecting guest replies: storing them, showing them to the couple and, if the couple wants, writing them to a spreadsheet in the couple's own Google Drive. Legal basis: our legitimate interest in performing our contract with the couple, without harming the guests' fundamental rights and freedoms (Art. 5(2)(f)).
• Security and preventing abuse: spam limits, device key hashes, technical logs. Legal basis: legitimate interest (Art. 5(2)(f)).
• Live help chat: answering your question. Using the chat is optional. Legal basis: legitimate interest (Art. 5(2)(f)); for buyers also Art. 5(2)(c).
• Legal obligations: keeping sales records, requests from authorities and answering applications under this notice. Legal basis: compliance with a legal obligation (Art. 5(2)(ç)).
• Protecting rights: in a possible dispute. Legal basis: establishing, exercising or protecting a right (Art. 5(2)(e)).

4. How we collect data

We collect personal data electronically, by fully or partly automated means: from Etsy (order details and Etsy messages), from the sale emails Etsy sends to our shop's mailbox, from the start form and the editor, from the reply form on wedding websites, from emails and from the live help chat.

5. Transfers, including abroad

We do not sell personal data. To provide the service we use the providers below under their standard terms of service. Their servers are outside Turkey, so this use is a transfer abroad under Art. 9 KVKK:

• Vercel Inc. (USA): hosting of the websites, the editor and our sales website; the private storage that holds content, photos, music and replies; technical logs.
• Google LLC (USA): our shop's Gmail account (sending edit and sign-in link emails, receiving Etsy's sale emails and reading them to confirm orders); Google Sheets (if the couple connects it, replies are written to a spreadsheet in the couple's own Google Drive); the fonts of wedding websites (Google Fonts) and Google Maps when a guest taps “Show map”.
• translated.net (MyMemory translation service, Italy): when you use “Translate automatically” in the editor and your browser has no translator of its own, the texts are sent from your browser directly to this service.
• Etsy: buying, payment and Etsy messages run on Etsy, which is a separate data controller for them under its own privacy policy. To confirm an order we may look up its number on Etsy.

The live help chat is our own help bot: it answers from our FAQ on our own server, and the messages are not sent to any other company. We do not keep the conversations; please do not type personal details in the chat.

Data may be disclosed to public authorities only on their lawful request and as far as the law requires (Art. 8, Art. 5(2)(ç)).

6. How long we keep it

• Website, photos, music and guest replies: your website stays online until 12 months after your wedding date (and at most 48 months after you first publish it). After your “Online until” date, we keep your website archived for 12 months, then we delete it with its photos and replies.
• Deletion on request: Message us on Etsy with your order number and we delete your website, its photos and your guests’ replies within 30 days.
• Device records and the Google Sheets connection: with the website; earlier when you sign a device out or disconnect.
• Order records (Etsy orders and sale emails): as sales records, for as long as Etsy's rules and tax law require.
• Support messages: Etsy messages stay on Etsy, emails in our shop's mailbox; you can ask us at bkestudio01@gmail.com to delete them.
• Live help chat: we do not keep it; your browser keeps the conversation only until you close the tab.
• Technical logs: for the hosting provider's own retention periods.

7. Your rights under Art. 11 KVKK

You can apply to us to:

• learn whether your personal data is processed,
• request information about it if it is,
• learn the purpose of the processing and whether the data is used accordingly,
• know the third parties in Turkey or abroad to whom it is transferred,
• have it corrected if it is incomplete or wrong,
• have it erased or destroyed under the conditions of Art. 7 KVKK,
• have the third parties it was transferred to told about a correction, erasure or destruction,
• object to a result against you that comes only from automated analysis of your data,
• claim compensation if you suffer damage because of unlawful processing.

You can also change or remove your content in your editor at any time, take your website offline, sign out other devices and disconnect Google Sheets. Guests can also ask the couple directly to correct or delete their reply.

8. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your application by email to bkestudio01@gmail.com from the email address you used when you started your website (the address registered with us), or signed with a secure electronic or mobile signature. For a written application by post, ask us for our postal address by email.

Your application must give your name and surname, your signature for a written application, your Turkish ID number if you are a Turkish citizen or otherwise your nationality and passport number (or ID number, if any), your address for notifications, your email address and phone number if any, and what you are asking for. We do not delete or share data before we have confirmed it is you.

We answer as soon as possible and at the latest within 30 days, free of charge; if the request causes an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

If your application is refused, you find our answer insufficient or we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our answer, and in any case within 60 days of your application (Art. 14 KVKK).

9. Other notices and changes

More detail is in our privacy notice; the rules for buying and using a design are in our terms of use. When this notice changes, the date at the top changes too.