Data Protection (KVKK) Notice

```html

Personal Data Processing Privacy Notice

Last Updated: 13 September 2026

This Personal Data Processing Privacy Notice has been prepared in accordance with Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform you about the purposes and legal grounds on which your personal data is processed by OZDSystems, the parties to whom it may be transferred, the methods through which it is collected and your rights under the KVKK.

1. Data Controller

For the purposes of the KVKK, the data controller responsible for your personal data is:

OZDSystems
Brand: Tobchik
Address: Ş. Turan Selvi Sk. 7/4, Maltepe, Istanbul, Turkey

OZDSystems operates under the Tobchik brand and conducts activities including online product sales, production of personalised products, order management, payment, delivery and customer support.

2. Categories of Personal Data Processed

When you use the Tobchik Website, place an order or communicate with us, the following categories of personal data may be processed:

2.1. Identity Information

First name
Last name
Other identification information required for invoicing or legal purposes

2.2. Contact Information

Email address
Telephone number
Delivery address
Billing address

2.3. Customer Transaction and Order Information

Order number
Order date
Products purchased
Product options and personalisation preferences
Order value
Delivery information
Return, exchange and cancellation requests
Order history

2.4. Personalisation Information

For the purpose of producing personalised Tobchik products, we may process information provided by you including:

A name or pet name
Text requested to appear on the product
Measurements
Colour and design preferences
Product options
Custom production instructions submitted with an order

We ask that you provide only information necessary for the production of the relevant personalised product.

2.5. Financial and Payment Transaction Information

Payment method
Payment status
Transaction or payment reference number
Order and refund amounts
Billing information

Depending on the payment infrastructure used, credit or debit card information may be processed directly by authorised payment service providers. For transactions completed through a payment provider's secure payment infrastructure, OZDSystems may not have access to or store your full card details within its own systems.

2.6. Transaction Security and Technical Information

IP address
Browser and device information
Session information
Website access and usage records
Error and security logs
Information collected through cookies and similar technologies

2.7. Requests, Complaints and Communication Information

Customer support requests
Messages submitted through contact forms
Complaints, requests and suggestions
Correspondence relating to returns and exchanges

2.8. Marketing Information

Where you have provided the permissions required under applicable law, we may process:

Commercial electronic communication permissions
Marketing preferences
Campaign and communication interaction information
Advertising and analytics information where the required consent has been provided

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

Creating, receiving and managing orders,
Producing personalised products according to your order,
Establishing and performing sales and distance sales contracts,
Processing payments and verifying payment status,
Carrying out invoicing and accounting activities,
Packaging and delivering products,
Managing shipping and logistics processes,
Managing returns, exchanges, cancellations and customer support,
Responding to customer requests, questions and complaints,
Providing after-sales support,
Ensuring the secure and proper operation of the Website,
Preventing fraud, misuse and unauthorised transactions,
Maintaining information and transaction security,
Improving service quality and user experience,
Complying with legal obligations,
Responding to requests from competent authorities,
Establishing, exercising or protecting legal rights,
Managing legal disputes,
Conducting marketing and promotional activities where the required permission has been obtained.

4. Legal Grounds for Processing Personal Data

Your personal data is processed on the applicable legal grounds set out in Article 5 of the KVKK.

4.1. Establishment or Performance of a Contract

Personal data relating to activities such as creating an order, producing a personalised product, managing payment, delivering products and processing returns or exchanges may be processed where processing is directly related to the establishment or performance of a contract under Article 5 of the KVKK.

4.2. Compliance with Legal Obligations

Your personal data may be processed where necessary for issuing invoices, maintaining accounting and tax records, providing legally required information to competent authorities and complying with other statutory obligations.

4.3. Establishment, Exercise or Protection of a Right

Personal data may be processed where necessary for managing disputes, pursuing legal claims, collecting receivables and establishing, exercising or protecting the legal rights of OZDSystems or other relevant persons.

4.4. Legitimate Interests

Provided that your fundamental rights and freedoms are not adversely affected, personal data may be processed for the legitimate interests of OZDSystems, including maintaining Website and transaction security, preventing fraud, managing operations and improving service quality.

4.5. Explicit Consent

Where no other lawful processing condition under the KVKK applies and explicit consent is required, personal data relating to activities such as marketing, advertising, certain analytics activities and non-essential cookies will only be processed after the necessary explicit consent has been obtained.

Providing explicit consent is not presented as a condition for accessing Tobchik's core product and order services, except where processing of the relevant data is inherently necessary to provide a specific function requested by you.

5. Methods of Collecting Personal Data

Your personal data may be collected by fully or partially automated means, or by non-automated means forming part of a data recording system, through channels including:

The Tobchik Website,
Order and payment pages,
Customer accounts and registration systems,
Contact and support forms,
Email and other communication channels,
Payment service providers,
Shipping and logistics service providers,
Cookies and similar internet technologies,
Customer service processes,
Competent authorities in connection with legal or administrative processes.

6. Transfer of Personal Data

Your personal data may be transferred to third parties in accordance with Articles 8 and, where applicable, 9 of the KVKK and only to the extent necessary for the relevant purpose.

6.1. Shipping and Logistics Providers

Your name, surname, telephone number, delivery address and other information necessary for delivery may be shared with shipping and logistics providers for the purpose of delivering your order.

6.2. Payment Service Providers

Order value, transaction information and information necessary to process payment may be shared with payment service providers and relevant financial institutions for payment processing and transaction security.

6.3. IT and Technical Service Providers

Personal data necessary for Website infrastructure, hosting, cloud services, software, cybersecurity, technical support and similar services may be shared with relevant service providers.

6.4. Accounting and Professional Advisers

Information necessary to fulfil legal and financial obligations may be shared with accountants, financial advisers, lawyers and other professional advisers.

6.5. Competent Public Authorities

Where required by law or pursuant to a legally valid request, personal data may be disclosed to courts, enforcement authorities, tax authorities and other competent public institutions and authorities.

6.6. Marketing and Analytics Providers

Where explicit consent or another valid processing condition is required for the relevant activity, personal data will only be shared with advertising, analytics or marketing service providers after the applicable legal requirements have been satisfied.

7. International Transfers of Personal Data

Where providers or servers used by Tobchik for Website infrastructure, hosting, cloud services, software, email, security, analytics or similar technology services are located outside Turkey, certain personal data may be transferred abroad.

Such transfers are carried out in accordance with Article 9 of the KVKK and applicable legislation governing international transfers of personal data.

Depending on the nature of the transfer, applicable mechanisms may include an adequacy decision, appropriate safeguards, sta ```