Personal Data Processing Notice
Prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), this notice explains why we process your data, whom we share it with, and your rights.
1. Data controller
The data controller determines the purposes and means of processing. In this notice the data controller is Two Borg.
Address: Esentepe Mah., Büyükdere Cd. No: 102, Maya Akar Center, 34394 Şişli / İstanbul
E-mail: info@two-borg.com
Our telephone line will be in service shortly; until then you can reach us by e-mail.
The address is an office; visits are possible only by prior appointment. Returns are sent by courier, unannounced hand delivery is not accepted.
2. Data we process
- Identity: name, surname.
- Contact: e-mail, telephone, delivery and invoice address.
- Customer transaction: order, return and shipping records, correspondence.
- Financial: payment amount and method, invoice and refund details. Your card number never reaches us, it goes to the payment institution.
- Transaction security: IP address, device and browser information, cookies.
- Marketing: if you consented, your newsletter subscription and consent record.
We do not process special categories of data (such as health, religion, biometrics).
3. Collection method
We collect data electronically, by wholly or partly automated means: order, account and newsletter forms, e-mails, cookies and server logs. Cookies: Privacy Policy.
4. Purposes and legal grounds
Each purpose rests on a separate legal ground; articles are those of Law No. 6698.
| Purpose | Legal ground |
|---|---|
| Order, payment and delivery | Art. 5/2-(c) conclusion or performance of a contract |
| Invoice, commercial book and tax records | Art. 5/2-(ç) legal obligation |
| Return and withdrawal requests | Art. 5/2-(c) and (ç) |
| Requests and complaints | Art. 5/2-(c) and (f) legitimate interest |
| Site security, fraud prevention, necessary cookies | Art. 5/2-(f) legitimate interest |
| Newsletter and promotional messages | Explicit consent (Art. 5/1) and consent under Law No. 6563 |
| Analytics and marketing cookies | Explicit consent (Art. 5/1) |
Legitimate interest is our reasonable business expectation that does not harm your rights.
This is a notice, it does not ask for your approval. Explicit consent is separate: given by your free will, withdrawable at any time.
5. Whom we transfer data to and why
- Our e-commerce infrastructure: store operation, order records.
- Payment institution and banks: payment, refunds, fraud checks.
- Our contracted courier: name, address, telephone for delivery and returns.
- Our accountant: invoices and statutory records.
- E-mail infrastructure: order notifications, consented newsletter.
- Competent public authorities and courts: only where legislation requires.
We do not sell or rent your data.
6. Transfer abroad
Our service providers' servers may be located abroad; your data is then transferred abroad.
Transfers are made under Article 9 of Law No. 6698, as amended by Law No. 7499 on 12 March 2024: if the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) has issued an adequacy decision, it is relied upon; otherwise an appropriate safeguard such as a standard contract, undertaking or binding corporate rules is provided; failing that, transfers are made only in the incidental cases in the Law. If a standard contract is signed, the Board is notified within five business days.
7. Retention periods
| Data | Period | Basis |
|---|---|---|
| Order, invoice and commercial book records | 10 years | Turkish Commercial Code No. 6102 (Türk Ticaret Kanunu) Art. 82 |
| Tax-related records | 5 years | Tax Procedure Law No. 213 (Vergi Usul Kanunu) Art. 253 |
| Account, membership, request and complaint records | Relationship plus limitation period | General provisions |
| Newsletter consent records | Period set by legislation after withdrawal | Law No. 6563 |
When the period ends, data is deleted, destroyed or anonymised.
8. Your rights under Article 11 of the Law
- To learn whether your data is processed and request information.
- To learn the purpose of processing and whether data is used accordingly.
- To know the recipients of transfers in Turkey or abroad.
- To request correction if the data is incomplete or inaccurate.
- To request deletion or destruction under Article 7 of the Law.
- To have correction, deletion and destruction notified to those recipients.
- To object to an adverse result reached solely by automated analysis.
- To claim compensation for damage arising from unlawful processing.
9. How to apply
We have no separate application form page. Channels:
- E-mail: to info@two-borg.com, from the e-mail address registered in our system.
- In writing: by signed petition to the address above; hand delivery only by appointment.
- By registered electronic mail (KEP), secure electronic signature or mobile signature.
Your application must state your name, surname, contact details and request. We conclude your request within 30 days at the latest. Our response is free of charge up to 10 pages; beyond that the processing fee in the Board's tariff may apply.
If you find the response inadequate or get no reply within 30 days, you may complain to the Board.
Last updated: 5 August 2026