Polityka prywatności

Data controller: a registered natural-person merchant resident in Türkiye, trading under the BTB Promo name.

Contact: btb.promo2026@gmail.com

Location: İstanbul, Türkiye

We process the following categories only for the purposes stated here:

Identity: your name, surname and company name (for the proof and order, when you provide them).

Contact: your email address (for sign-in, sending your proof, quotes and status updates) and your order notes.

Order and design data: the order id, the shape, quantity and scent you choose, and the artwork, photos and text you create or upload in the configurator.

Technical data: your IP address and similar signals, held only temporarily for rate limiting and security.

We do not use cookie analytics, advertising tracking or third-party tracking cookies.

Fulfilling your order (design, print, production, packing, handover to the carrier) — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).

Customer communication (sign-in link, proof and quote, status updates, support) — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).

Legal obligations (tax and commercial record-keeping) — compliance with a legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).

Fraud prevention and service security (rate limiting, bot checks, session validation) — legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).

Your data is never sold for marketing. It is shared, only to the extent needed to run the service, with:

Vercel Inc. (USA) — hosting the web application.

Cloudflare, Inc. (USA) — domain management, bot protection and file storage (R2).

Supabase, Inc. (hosted in the EU region) — storing order, design and account data.

Upstash (USA) — rate limiting to prevent abuse.

Replicate (USA) — optional AI image tools, only when you use them.

Resend (USA) — transactional email. Google — only if you choose “Continue with Google”.

Print and logistics partners — the production files and information needed to make and print your card, and, for shipping, the carrier (ShipEntegra) and customs (micro-export from Türkiye). These partners use the data only to fulfil the order.

These providers act as “data processors” under their own privacy policies. Our obligation to respond to lawful requests from public authorities is reserved.

Some of the providers above are outside Türkiye (USA, EU). Transfers happen only as needed to run the service and rely on internationally accepted standard contractual clauses. Where KVKK Art. 9 requires Board authorisation or explicit consent, we obtain your consent separately for those categories.

Uploaded images and card designs: the raw images you upload are processed when the design is created. The final production files are kept for up to one month (30 days) after the order is completed — for possible shipping, damage or reprint claims — and then permanently deleted.

Order, design data and tax records: 5 years (record-keeping under Turkish Tax Procedure Law Art. 253).

Operational and security logs: up to 1 year.

IP address (rate limiting): at most 7 days, in temporary memory.

Under KVKK Art. 11 and GDPR Art. 15-22 you may ask whether your data is processed and for information about it, request correction, deletion or destruction, learn the third parties it was shared with, object to solely automated analysis, and claim compensation for unlawful processing.

Under GDPR you also have the right to data portability, restriction of processing, and to complain to a supervisory authority (in Türkiye, the Personal Data Protection Authority; in the EU, your country’s authority).

To exercise any of these, email btb.promo2026@gmail.com. We respond free of charge within 30 days at the latest.

The site uses only strictly-necessary cookies and local storage needed to work:

Session cookie: a server-only (httpOnly) cookie that keeps you signed in.

Bot check: a Cloudflare Turnstile cookie to prevent abuse.

Local storage: your language, your light/dark theme, and your acknowledgement of this cookie notice.

Admin area (/admin): session cookies for operator sign-in only (not exposed to customers).

We use no advertising, analytics or third-party tracking cookies. As these cookies are strictly necessary, they do not require prior consent.

All end-to-end traffic is encrypted with HTTPS (TLS 1.2+).

The database provider (Supabase) applies encryption at rest.

Service account keys are held only in server-side environment variables.

Our services are business-to-business and directed at people aged 18 and over. We do not knowingly collect data from children. If you believe we have, contact us at btb.promo2026@gmail.com.

We may update this policy as our services or the law change. The current version is always published here; the effective date at the top reflects the last change.

Email: btb.promo2026@gmail.com

Data controller: a registered natural-person merchant resident in Türkiye, trading under the BTB Promo name

Location: İstanbul, Türkiye