Privacy Policy

1. Data Controller

The data controller responsible for your personal information is:

2. Personal Data We Collect

We collect only the information necessary to fulfil your order and provide our services. This includes:

• Identity data — first name, last name, displayed username (provided via our authentication provider, Clerk).
• Contact data — email address, delivery address, telephone number (if provided at checkout).
• Transaction data — details of products purchased, order amounts in EUR, order status, and order date.
• Technical data — IP address, browser type, operating system, and session identifiers collected automatically when you visit our website.
• Payment data — payment card details are processed directly and exclusively by our payment service provider; Perge Trading does not store card numbers, CVV codes, or full payment credentials.

We do not collect sensitive personal data (special categories) as defined under KVKK Article 6.

3. Legal Basis for Processing

We process your personal data on the following legal grounds (KVKK Art. 5):

• Contract performance — to fulfil purchase orders, arrange shipping, and manage your account.
• Legitimate interests — to prevent fraud, ensure the security of our systems, and improve our services in ways that do not override your fundamental rights.
• Legal obligation — to comply with applicable KKTC and Turkish commercial, tax, and consumer-protection laws.
• Explicit consent — where required by law, for example if we send you marketing communications beyond transactional updates. You may withdraw consent at any time.

4. How We Use Your Data

We use collected data to:

• Process and fulfil your orders and manage returns or refunds.
• Maintain your order history accessible via your account.
• Communicate order status updates and respond to your enquiries.
• Detect and prevent fraudulent transactions and unauthorised access.
• Comply with our legal, regulatory, and accounting obligations under KKTC and Turkish law.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

5. Disclosure to Third Parties

We share your data only where strictly necessary, with:

• Clerk, Inc. — our authentication provider, which manages sign-in, session tokens, and user identity on our behalf. Clerk processes data under its own privacy policy and applicable US and EU regulations.
• Payment processors — to authorise and complete card transactions. They operate as independent data controllers for payment data.
• Shipping and courier partners — your name and delivery address are shared solely to arrange international fulfilment.
• Neon Tech, Inc. — our database infrastructure provider (Neon PostgreSQL). Your order data is stored on servers located in the EU Central region. Neon operates under a data processing agreement with us.
• Authorities — we may disclose data to KKTC or Turkish government authorities where required by law or court order.

6. International Data Transfers

Our service providers may process data outside the KKTC. Where data is transferred internationally, we take reasonable steps to ensure an adequate level of protection, including relying on standard contractual clauses and data processing agreements aligned with KVKK Article 9 requirements.

7. Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes described in this policy, and thereafter as required by applicable law:

• Order and transaction records: 10 years (Turkish Commercial Code, Art. 82).
• Account data: for the duration of your account plus 2 years after closure.
• Technical logs: up to 12 months.

After the applicable retention period, data is securely deleted or anonymised.

8. Cookies

Our website uses strictly necessary cookies to maintain authentication sessions (issued by Clerk). These cookies do not track your behaviour across other websites and are not used for advertising. No third-party analytics or advertising cookies are set.

You may disable cookies via your browser settings; however, doing so will prevent you from signing in or accessing your account.

9. Your Rights

Under KVKK (Art. 11) and applicable KKTC law, you have the right to:

• Learn whether your personal data is being processed.
• Request information about how your data is used.
• Learn to whom your data has been disclosed.
• Request correction of incomplete or inaccurate data.
• Request erasure or destruction of your data where processing is no longer legally justified.
• Object to a decision taken solely by automated processing that adversely affects you.
• Claim compensation for damages arising from unlawful data processing.

To exercise any of these rights, contact us at info@pergetrading.com. We will respond within 30 days in accordance with KVKK Article 13. Requests are free of charge unless manifestly unfounded or excessive.

10. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encrypted connections (TLS), access controls, and regular security reviews. No system can guarantee absolute security; in the event of a data breach that poses a risk to your rights, we will notify you and the relevant authorities as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date above and, where appropriate, by notifying you via email. Continued use of our website after the updated policy takes effect constitutes acceptance of those changes.

12. Contact & Complaints

For any questions, data requests, or complaints regarding this policy, please contact us at info@pergetrading.com.

If you believe your rights under KVKK have been violated, you may also lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu — KVKK Board) or the relevant KKTC authorities.