1. Data controller
Under Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by GIOS Plastik ("ottopien"), as data controller, within the scope described below.
- Address: Büyükdere Cad. Meydan Sok. No:1 Beybi Giz Plaza Kat:15 Daire:55, 34398 Sarıyer / İstanbul
- Email: [email protected]
2. Categories of personal data processed
- Identity: name and surname; for company invoices, company name, tax office and tax number; where required for an e-archive invoice, Turkish ID number.
- Contact: email address, telephone number, delivery and billing address.
- Customer transactions: order history, bag contents, order and return requests, customer service correspondence.
- Financial: payment amount, payment method, transaction result and refund information. Card data such as the card number and CVV is never seen or stored by ottopien; it is processed directly by the payment institution.
- Transaction security: IP address, session information, browser and device information, site usage logs, and the hashed form of your account password.
- Marketing: consent to commercial messages, preferences and, if you consent, usage data obtained through analytics and marketing cookies.
ottopien does not process special categories of personal data such as health data. Please do not share such information when writing to us.
3. Purposes of processing
- Taking orders, collecting payment, delivering products, and handling returns and withdrawals
- Issuing invoices and meeting legal accounting and tax obligations
- Creating and managing member accounts
- Responding to customer requests and complaints
- Ensuring information security and preventing fraud and unlawful transactions
- Responding to information requests from authorised bodies and protecting rights in possible disputes
- If you consent, informing you of campaigns, news and offers; measuring and improving the site experience
4. Method of collection and legal grounds
Your personal data is collected, partly or wholly by automated means, through our website, order and membership forms, email, telephone and social media channels, through cookies, and through transaction information returned by our payment and shipping service providers.
We rely on the following legal grounds under Article 5 of the KVKK:
- Processing directly related to the formation or performance of a contract (Art. 5/2-c): orders, delivery, returns, membership.
- Compliance with a legal obligation of the data controller (Art. 5/2-ç): invoices, tax and commercial records, retention obligations under Laws No. 6502 and No. 6563.
- Establishing, exercising or protecting a right (Art. 5/2-e): dispute and complaint procedures.
- Legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f): information security, fraud prevention, improving service quality.
- Explicit consent (Art. 5/1): sending commercial electronic messages; analytics and marketing cookies. You may withdraw your explicit consent at any time.
5. Transfers of personal data
Limited to the purposes above and in proportion to them, your personal data may be transferred to the following recipients:
- Shipping and logistics companies: name, address and telephone (to make the delivery).
- Payment institution / banks: the data needed to carry out the payment, 3D Secure verification and refunds.
- E-invoice / e-archive integrator: identity, contact and order information to issue the invoice and pass it to the Revenue Administration.
- Hosting, infrastructure, email and software service providers: so that the site and systems can run.
- If you consent, analytics and marketing service providers and the Message Management System (İYS).
- Our financial adviser, legal advisers and public bodies authorised by law: within the framework of legal obligations and requests.
Some of our service providers may have servers abroad. In that case, transfers abroad are made in line with Article 9 of the KVKK, with appropriate safeguards such as signing the standard contracts announced by the Personal Data Protection Board and notifying the Board, or under the other conditions set out in the law.
6. Retention periods
Your personal data is kept for as long as the purpose of processing requires and for the periods set out in the relevant legislation. For example, invoices and accounting records are kept for 5 to 10 years under the Tax Procedure Law and the Turkish Commercial Code; distance contract records for at least 3 years; and records of consent to commercial messages for 3 years after the consent ends.
When the period ends, your data is erased, destroyed or anonymised.
7. Your rights under Article 11 of the KVKK
By applying to the data controller, you have the right to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether it is used for that purpose,
- know the third parties, in Türkiye or abroad, to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request erasure or destruction under the conditions of Article 7 of the KVKK,
- request that third parties to whom the data was transferred be notified of any correction, erasure or destruction,
- object to a result against you arising from analysis exclusively by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
8. How to apply
You can send requests about your rights, with information that allows us to verify your identity and in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, in the following ways:
- By wet-signed letter to Büyükdere Cad. Meydan Sok. No:1 Beybi Giz Plaza Kat:15 Daire:55, 34398 Sarıyer / İstanbul, in person or through a notary,
- From the email address registered in our system to [email protected].
Your application is concluded free of charge as soon as possible, and within 30 days at the latest, depending on the nature of the request. If the process involves a separate cost, the fee set by the Personal Data Protection Board may apply. If your application is rejected, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board.
Last updated: 15 October 2026. Questions? See contact.