Privacy policy

This is an English translation for convenience; the Turkish version prevails.

KVKK Privacy Notice

This notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains to people who visit ethosshoes.com, place orders, create a customer account, subscribe to the newsletter or contact us how their personal data is processed. Details about cookies, the newsletter and site security are on the Privacy and Cookie Policy page.

1. Data controller

Your personal data is processed by Yalım Kartal (sole proprietorship; business name: ethosshoes, brand: ETHOS) as data controller.
Address: Çankaya Mahallesi, Üsküp Caddesi 1/B, Çankaya/Ankara, Türkiye
Email: info@ethosshoes.com
Phone: +90 539 220 90 08

2. Personal data we process

  • Identity: first name, last name.
  • Contact: email address, phone number, delivery and billing address.
  • Customer transaction: ordered product, size and quantity, order amount and number, invoice details, shipment tracking information, withdrawal, return and complaint requests, and our correspondence with you.
  • Payment transaction: payment method, payment status and transaction details provided by the payment institution. Your card number, expiry date and security code (CVV) never reach us and are not stored by us; they are processed directly by the payment institution iyzico.
  • Customer account: if you create an account, your login details, saved addresses and order history.
  • Marketing: the email address you provide for the newsletter and your consent and opt-out records (date and channel).
  • Transaction security and online identifiers: IP address, browser and device information, session and cookie identifiers, pages viewed on the site and cart activity.

We do not ask for special categories of personal data (such as health or religion). Please do not share such information in the contact form or in your messages.

3. Purposes and legal grounds

  • Taking your order, collecting payment, making and delivering the product and informing you about the order status; creating and managing your customer account. Legal ground: establishment or performance of a contract (KVKK Art. 5/2-c).
  • Providing pre-contractual information, concluding and keeping the distance sales contract; handling withdrawal, return, exchange and defective product requests. Legal ground: establishment or performance of a contract (Art. 5/2-c) and legal obligations under Law No. 6502 on Consumer Protection and the Regulation on Distance Contracts (Art. 5/2-ç).
  • Issuing invoices, keeping accounting and tax records and retaining e-commerce records. Legal ground: legal obligations under tax legislation and Law No. 6563 on the Regulation of Electronic Commerce (Art. 5/2-ç).
  • Responding to questions, requests and complaints sent via the contact form, email, phone or Instagram. Legal ground: performance of a contract if your request concerns an order (Art. 5/2-c); otherwise our legitimate interest in responding to your request (Art. 5/2-f).
  • Running the site, keeping your cart and session, ensuring security and preventing fraud and misuse (including strictly necessary cookies). Legal ground: establishment or performance of a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f).
  • Protecting our rights in disputes and responding to requests from competent authorities. Legal ground: establishment, exercise or protection of a right (Art. 5/2-e) and legal obligation (Art. 5/2-ç).
  • Recording your newsletter subscription and, once newsletter sending begins, sending news about new products, collections and offers by email. Legal ground: your explicit consent (Art. 5/1) and the commercial electronic message consent you give under Law No. 6563.
  • Measuring site usage with analytics cookies and campaign performance with marketing cookies. Legal ground: your explicit consent (Art. 5/1).

We do not ask for explicit consent for processing that is necessary for the contract, such as orders and delivery. Explicit consent is requested only for the newsletter and for analytics and marketing cookies. Not giving consent does not prevent you from shopping, and you can withdraw your consent at any time.

4. Method of collection

Your personal data is collected electronically: directly from you through the checkout page, customer account, newsletter and contact forms, and through email, phone and Instagram messages; automatically on the site through cookies and similar technologies; and from the payment institution and the shipping company as regards payment and delivery status.

5. Recipients and purposes of transfer

Your personal data may be transferred to the following recipient groups, only for the purposes below and only to the extent necessary for them:

  • E-commerce platform provider: Shopify International Limited (Ireland) and the sub-processors it uses to provide its service, to host the site, orders, customer accounts and the newsletter list and to send order emails.
  • Payment institution: iyzico (Türkiye), to collect payments, make refunds and keep payments secure. iyzico also processes payment data under its own legal obligations.
  • Shipping companies: the carriers that deliver orders and carry returns (Türkiye), to deliver products and collect returns.
  • Email service provider: Google (Google Workspace), to handle correspondence sent to and from info@ethosshoes.com.
  • Social media service provider: Instagram (Meta). If you message us on Instagram, your messages are processed on Meta's infrastructure to handle the conversation; Meta also processes this data under its own terms.
  • Financial advisor (accountant): to handle invoicing, accounting and tax matters.
  • Competent public authorities, consumer arbitration committees, mediators and courts: such as the Revenue Administration and the Ministry of Trade, when requested or required by law, to fulfil our legal obligations and protect our rights.

We do not sell your personal data.

6. Transfers abroad

The servers of Shopify, Google and Instagram (Meta) are located outside Türkiye. Therefore, data relating to your orders, customer account, newsletter subscription and email correspondence, your Instagram messages, and online identifiers relating to your use of the site are stored and processed on these providers' servers abroad. Shopify and Google process this data on our behalf, as data processors, and only to provide their services. You can contact us for more information about transfers abroad.

7. Retention periods

  • Order, invoice, payment and delivery records, and pre-contractual information, contract and withdrawal records: 10 years from the transaction date (Law No. 6563, Art. 11/3). The shorter retention periods in tax legislation and the Regulation on Distance Contracts are covered within this period.
  • Customer account: as long as your account remains open. If you delete your account, your account details are deleted; records of your past orders are kept for the period above.
  • Newsletter: until you withdraw your consent. Consent and opt-out records are kept for 3 years after the consent ends (Regulation on Commercial Communication and Commercial Electronic Messages, Art. 13).
  • Contact requests and correspondence not related to an order: 2 years after the request is resolved.
  • Cookies: for the period stated for each cookie on the Privacy and Cookie Policy page.

If a dispute arises, the relevant records may be kept until the dispute is resolved and the limitation period expires. When the period ends, personal data is deleted, destroyed or anonymised.

8. Your rights

Under Article 11 of the KVKK, you can apply to us to exercise the following rights:

  • to learn whether your personal data is processed,
  • to request information if it has been processed,
  • to learn the purpose of processing and whether it is used in line with that purpose,
  • to know the third parties in Türkiye or abroad to whom it is transferred,
  • to request correction if it is incomplete or inaccurate,
  • to request its deletion or destruction under the conditions of Article 7 of the KVKK,
  • to request that corrections, deletions or destructions be notified to the third parties to whom the data was transferred,
  • to object to a result against you arising from the analysis of your data exclusively through automated systems,
  • to claim compensation if you suffer damage due to unlawful processing.

9. How to apply

You can submit your application in Turkish:

  • in writing with a wet signature, by hand or by post to our address above,
  • by email to info@ethosshoes.com from the email address you previously provided to us and that is registered in our system,
  • by email to info@ethosshoes.com, signed with a secure electronic signature or mobile signature.

Your application must include your name and surname, your signature if made in writing, your Turkish ID number (or, if you are a foreign national, your nationality and passport number), your address for notifications, your email address and phone number if any, and the subject of your request.

Your application will be concluded free of charge within 30 days at the latest. If the process involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the response, and in any case within 60 days of your application date.

Last updated: 19 October 2026