KVKK Privacy Notice

1. Data Controller

Your personal data is processed by the following company in its capacity as data controller.

2. Scope and Definitions

This notice covers people who visit our website, place an order, request service, fill in a form or contact us.

• Personal data: Any information relating to an identified or identifiable natural person.
• Data subject: The natural person whose personal data is processed; “you” in this notice.
• Data controller: The person who determines the purposes and means of processing and is responsible for establishing the data filing system; Orven in this notice.
• Data processor: A person who processes data on the controller’s behalf under its authority; for example hosting and courier service providers.

3. Categories of Personal Data Processed

Personal data is processed in the following categories according to our processes.

We do not request special categories of personal data (health, biometric data, etc.). If you share such data on your own initiative, it is processed only to a limited extent in order to assess your request and is erased once that purpose no longer applies.

4. Methods of Data Collection

Your personal data is collected by the following means, through automated or partly automated methods.

• The order, contact, service, suggestion and complaint, dealership, influencer, EPC quotation and product review forms on our website, the Orven Club newsletter sign-up, and the “Notify Me When Back in Stock” request.
• Account creation and product registration.
• Requests you make by e-mail, phone and other contact channels.
• Technical records generated while you use the site (session and security logs).

5. Purposes of Processing Personal Data

• Receiving, preparing, delivering and invoicing the order.
• Carrying out withdrawal, return and refund processes.
• Planning and carrying out warranty, service, repair and spare-part processes.
• Handling your requests, suggestions and complaints; providing customer support.
• Ensuring information security and preventing misuse.
• Fulfilling statutory retention, notification and reporting obligations.
• Pursuing legal claims and exercising the right of defence.
• Sending commercial electronic messages where you have given explicit consent.
• Publishing the product reviews we approve on the relevant product page, with the name or nickname you provide, the rating and the date.
• If you allow it, measuring how the website is used (Google Analytics, Microsoft Clarity) and reviewing the questions asked to Orva in order to improve the website, the chat assistant and our content.

6. Legal Grounds

Our processing is based on the following legal grounds listed in Article 5 of the Law.

• Necessary for the conclusion or performance of a contract — order, delivery, warranty and service processes, and dealership, collaboration and quotation applications.
• Compliance with the controller’s legal obligation — invoicing, retention of commercial correspondence and notification duties.
• Necessary for the establishment, exercise or protection of a right — dispute and claim processes.
• Legitimate interest, provided it does not harm your fundamental rights and freedoms — information security and service quality.
• Explicit consent — only where necessary: commercial electronic messages and the analytics tools, Orva conversation records and external content you allow in your cookie preferences.

7. Transfers and Recipient Groups

Your personal data may be transferred to the following recipient groups, limited to the purpose of processing. Your data is not sold or rented to third parties for marketing purposes.

• Courier and logistics companies — name, address and phone for delivery and return processes.
• Payment and banking institutions — to carry out the payment transaction. Your card details are not stored by us.
• Hosting, e-mail and form infrastructure providers — so that the service can be delivered technically.
• Authorised service and business partners — to meet service and installation requests.
• Accounting, legal and audit advisers — to fulfil our obligations.
• Authorised public institutions and bodies — within the scope of statutory requests and obligations.
• Analytics service providers — only with your permission: Google LLC (Google Analytics) and Microsoft Corporation (Microsoft Clarity). For data collected through Clarity, Microsoft is a separate controller, independent of us.

8. Transfers Abroad

The servers of some services we use are located abroad: our website and our e-mail service are hosted on servers in France; requests you send through the forms and stock notification requests are stored on Google’s Firebase infrastructure, on servers in Europe; analytics data is transferred, when you give permission, to Google LLC (Google Analytics) and Microsoft Corporation (Clarity), and your Orva messages to Anthropic, PBC, in the USA. The conditions laid down for these transfers by Article 9 of the Law (the amendment that entered into force on 1 June 2024) are set out below.

• First, we check whether the Board has issued an adequacy decision for the country or sector to which the transfer will be made.
• There is no adequacy decision by the Board for the countries where these servers are located. In this case, Article 9 of the Law requires one of the appropriate safeguards for the transfer (primarily the standard contract announced by the Board) and the notification of a signed standard contract to the Authority within 5 business days. Your explicit consent is not the legal basis for transfers abroad. You can ask info@orvenenerji.com for the current status of these safeguards for each provider.
• Where neither exists, in incidental cases a transfer may be made only on the basis of the exceptions listed in the Law.
• In every case the data transferred is kept limited to the purpose and proportionate.

Orva chat assistant. The messages you write to Orva on our website, together with the last few messages of the conversation, are sent through our function running on Google's servers in Europe to our AI service provider Anthropic, PBC to generate a reply. Anthropic processes this data on our behalf and does not use it to train its AI models. Replies are generated on Anthropic's infrastructure in the USA and the data is stored in the USA; Anthropic may also process the data in other countries where it operates for internal processes such as security reviews, support and incident response. If you allowed “Analysis and improvement” in your cookie preferences, your conversation (your messages, Orva's replies, if you told Orva your name, how you were addressed in a Turkish conversation (Bey or Hanım), the page where the chat was opened and the last page it reached, the page language and the device type: phone, tablet or computer) is stored without your IP address on Google's servers in Europe (Firebase) for at most 90 days to improve Orva and our website content, and is then deleted automatically (deletion may be delayed by up to 1 day; deleted records remain in the daily database backups for at most 7 more days); if you did not, the conversation is not stored on Orven's own systems. Before storage, email addresses, phone numbers, Turkish ID numbers, IBANs and card numbers recognised by their pattern are hidden in the text; details such as names and addresses may not be hidden. If you withdraw your permission, the conversations stored under it are deleted and new conversations are not recorded. Messages and replies are deleted at Anthropic within 30 days at the latest, while content flagged by Anthropic's automated safety systems as potentially violating its usage policy may be kept for up to 2 years, or longer where required by law. To prevent misuse, your IP address is used temporarily for at most one hour; it is also kept for 30 days in Google's server request logs. Orva may ask your name during the chat so it can address you by it; you do not have to tell it, and the name you give appears in the conversation text. Please do not write other personal information such as your phone number or address to Orva.

Analytics tools. If you allowed “Analysis and improvement” in your cookie preferences, data about your use of the website (pages visited, clicks and scrolling, device and browser information, approximate location) is processed through Google Analytics (Google LLC) and Microsoft Clarity (Microsoft Corporation) on these companies’ servers abroad, including in the USA. Advertising features and Google signals are turned off in Google Analytics; Microsoft Clarity does not record what you type into forms. Microsoft is a controller independent of us for the data it collects through Clarity. Under the Clarity terms, it may use this data for its own purposes in line with its privacy statement, including improving its products and creating user profiles for advertising (Microsoft Advertising). We signal to Clarity that we do not allow advertising storage. If you withdraw your permission, these tools are not loaded and our site’s own cookies are deleted. You can delete the cookies Microsoft keeps on its own domains in your browser settings. Microsoft Privacy Statement

9. Retention Periods and Erasure

Your personal data is kept for the period required by the purpose of processing and for the limitation and retention periods prescribed by legislation.

When the period expires or the purpose of processing no longer applies, your data is erased, destroyed or anonymised.

10. Data Security Measures

Technical and administrative measures are applied to prevent unlawful processing of and access to your data.

• Encrypted communication over HTTPS across the site.
• Access rights limited by role and reviewed regularly.
• Session security: cookies hardened with HttpOnly and SameSite policies.
• Access and transaction logs kept, and security events monitored.
• Backup and business continuity procedures.
• Contractual and technical security requirements applied to processors.
• Payment card details are not stored by us.

11. Your Rights as a Data Subject

Under Article 11 of the Law you have the following rights.

• To learn whether your personal data is being processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether the data is used in accordance with that purpose.
• To know the third parties to whom the data is transferred, in Türkiye or abroad.
• To request correction if the data has been processed incompletely or inaccurately.
• To request erasure or destruction within the conditions of Article 7 of the Law.
• To request that correction, erasure and destruction be notified to the third parties to whom the data was transferred.
• To object to an adverse outcome arising from analysis carried out exclusively by automated systems.
• To claim compensation for damage suffered as a result of unlawful processing.

12. How to Apply and Time Limits

To exercise your rights, you can submit your request, together with information verifying your identity, by one of the following routes.

• In writing, by a wet-signed petition sent to our company address.
• Through a registered electronic mail (KEP) address.
• By secure electronic signature or mobile signature.
• From the e-mail address you have previously notified to us and which is registered in our system, to info@orvenenerji.com.

Your application must include your name and surname, your signature (for written applications), your Turkish ID number for citizens of the Republic of Türkiye, an address or e-mail for notification, and the subject of your request.

• If your application is rejected, you find our response insufficient, or no response is given within 30 days, you may lodge a complaint with the Personal Data Protection Board.
• The complaint period is 30 days from the date you learn of the response and in any case 60 days from the date of application.
• A complaint cannot be made directly to the Board; you must first apply to the data controller.

13. Cookies and Local Storage

Our website always uses the cookies and browser storage needed to provide the service; for anything not strictly necessary we ask for your permission, and nothing happens without it.

• Necessary cookies: used to maintain the session, for security and form validation, and to remember your cookie choice (orven_onay, 12 months). The site cannot work without them.
• Functional local storage: used to keep information such as your basket, your preferences and your Orva conversation (while the tab is open) in your browser.
• Analysis and improvement (only with your permission): Google Analytics cookies (_ga, _ga_*; 13 months), Microsoft Clarity cookies (our site’s _clck 1 year and _clsk 1 day; MUID 1 year, CLID and similar cookies on Microsoft’s own domains) and keeping your Orva conversations for up to 90 days. Details are in the “Transfers Abroad” section.
• External content (only with your permission or when you open the map yourself): Google Maps on the contact page; when loaded, Google may use its own cookies.
• We do not use cookies for advertising or profiling. Microsoft, however, may use Clarity data for its own purposes, including advertising.
• You can delete or block cookies from your browser settings; if essential cookies are blocked, some parts of the site may not work.
• If cookies for advertising or marketing are used in the future, this text will be updated and your permission will be asked separately.

Necessary cookies and browser storage are needed so that we can provide the site in the way you request, and they do not depend on your permission (Article 5(2) of the Law). Analytics and external content cookies are used only with your explicit consent (Article 5(1) of the Law); you can withdraw your permission through the “Cookie preferences” link at the bottom of every page.

Change cookie preferences

14. Commercial Electronic Messages

• Commercial electronic messages containing campaigns and announcements are sent only if your prior consent has been obtained.
• Consents are recorded in the Message Management System (İYS) as required by legislation.
• Every message includes a link or method by which you can exercise your right to stop receiving them.
• You may withdraw your consent at any time without giving a reason; messages informing you about your order are not covered by this.

15. Changes to This Notice

• This privacy notice may be updated in line with changes in legislation or in our processes.
• The current version is always published on this page; the update date at the top of the page shows which version you are reading.
• For significant changes, separate information is provided where the legislation requires it.

Contact