Personal Data Protection Notice

Last updated: 12 September 2026

Under Law No. 6698 on the Protection of Personal Data (KVKK), we would like to inform you about how your personal data are processed by GNR Oyuncak Gıda Sanayi Ticaret Limited Şirketi as data controller.

1. Data Controller

Company name	GNR Oyuncak Gıda Sanayi Ticaret Limited Şirketi
Address	Mahmutbey Mahallesi, 2412. Sokak, C Plaza, Kat: 8, No: 89, Bağcılar / İstanbul
Telephone	0534 871 30 50
Email	kvkk@romansonofficial.com
Registered electronic mail (KEP) address	gnroyuncak@hs01.kep.tr
MERSIS number	0396175846000001

2. Personal Data Processed

Data category	Data processed
Identity	First name, surname
Contact	Email address, telephone number, delivery and billing addresses
Customer transactions	Order details, order history, return and cancellation records, request and complaint records
Financial	Invoice information, payment amount and payment status. We do not store your card number; payment provider and scope of data: We do not store card numbers; the payment provider is PayTR ?deme ve Elektronik Para Kuruluşu A.?. through the Shopify PayTR Sanal POS app. The order number, amount, name, email, telephone, billing address and IP address are transferred to PayTR for payment processing and transaction security..
Transaction security	IP address, browser and device information, cookie records and browsing data within the site
Marketing	Newsletter subscriptions, explicit consent records and shopping preferences

3. Purposes of Processing Personal Data

• Receiving, preparing, dispatching and delivering orders
• Executing and verifying payment transactions
• Issuing invoices and meeting statutory accounting obligations
• Handling returns, cancellations, exchanges and warranty processes
• Responding to customer requests, questions and complaints
• Providing order status updates
• Ensuring site security and preventing fraud
• Meeting legal obligations and providing information to authorised institutions
• Sending marketing communications and personalising the site experience if you have given explicit consent
• Analysing site usage (heatmaps and session recordings) and measuring advertising performance if you have given explicit consent

4. Legal Grounds

Your personal data are processed under Article 5 of the KVKK on the following legal grounds:

• Necessity for establishing and performing a contract — orders, payments, delivery and returns
• Compliance with a legal obligation — invoicing, taxes, commercial books and recordkeeping obligations
• Legitimate interest — site security, fraud prevention and measuring service quality
• Establishment, exercise or protection of a right — retaining evidence in the event of a dispute
• Explicit consent — marketing communications, non-essential cookies and personalisation

5. Transfers of Personal Data

Your personal data may be transferred to the following parties, limited to the purposes of processing:

• Shipping and logistics companies — name, address and telephone information for delivery and returns
• Payment institutions and banks — to process payments
• Electronic invoice / electronic archive and accounting service providers — to issue legally required documents
• IT and infrastructure service providers — e-commerce platform, hosting and email delivery; with your explicit consent, site usage analytics and advertising measurement (Google, Microsoft)
• Authorised public institutions and organisations — in response to requests under legislation

Our store operates on Shopify. As a result, some of your data may be processed on servers located abroad. Applicable transfer conditions are determined for each service provider and processing activity. Shopify (e-commerce infrastructure and hosting; data centres in Canada, the United States and other countries), Google (corporate email, tag management, site usage measurement with Google Analytics 4 and advertising measurement with Google Ads; United States) and Microsoft (heatmap and session recording analysis with Clarity; United States). These transfers are made under the conditions set out in Article 9 of the KVKK. In Türkiye, data is shared with Kargonomi for shipment creation and tracking, PayTR for payments, and Paraşüt (with Sopyo order and invoice integration) for e-invoice and e-archive services.

6. Collection Method

Your personal data are collected electronically by automated and partly automated means through forms you complete on our website, accounts and orders you create, email and telephone communications, and cookies.

7. Retention Period

Your personal data are retained for as long as the processing purpose requires and for the limitation periods and retention obligations under applicable legislation. When the period expires, the data are deleted, destroyed or anonymised.

Data type	Retention period
Order and invoice records	Invoice and accounting records: 5 years under Tax Procedure Law No. 213; order and distance-sale records: 3 years; commercial books and records: 10 years under Turkish Commercial Code No. 6102
Account information	For the duration of the account and for 10 years under the Turkish Code of Obligations No. 6098 after it ends
Marketing consent records	Until consent is withdrawn, and afterwards for 3 years under the Regulation on Commercial Electronic Messages for evidential purposes
Site log records	2 years

8. Your Rights as a Data Subject

Under Article 11 of the KVKK, you may:

• Learn whether your personal data are processed
• Request information if they have been processed
• Learn the purpose of processing and whether the data are used in accordance with that purpose
• Know the third parties to whom data are transferred in Türkiye or abroad
• Request correction if data have been processed incompletely or incorrectly
• Request deletion or destruction when the applicable conditions are met
• Request that corrections, deletion and destruction be notified to third parties to whom data were transferred
• Object to a result against you arising from analysis exclusively through automated systems
• Request compensation for damage caused by unlawful processing

9. Application Procedure

You may submit requests concerning your rights in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller:

• In person or through a notary, with a petition bearing your handwritten signature, to Mahmutbey Mahallesi, 2412. Sokak, C Plaza, Kat: 8, No: 89, Bağcılar / İstanbul;
• Using a secure electronic signature, to gnroyuncak@hs01.kep.tr;
• From the email address registered in our system, to kvkk@romansonofficial.com.

Your application will be concluded within 30 days at the latest. If the process incurs additional costs, the fee in the tariff set by the Personal Data Protection Board may be charged.