1. Who is the data controller?
Personal data you share through this site is processed by GiftGame, the owner of this site and the seller, as the data controller. Your order, account and contact details are kept in the seller's own customer records.
2. Which data is processed?
When you place an order: your full name, phone number and, if provided, your email address; your delivery address if you choose shipping; the order contents, amount, payment method and payment status; any note you add to the order. When you sign in: your phone number for phone sign-in, or the name, email address and basic profile information shared by Google for Google sign-in. If you choose online payment: the transaction result returned by the payment institution (your card details are not stored on this site). When you use the site: IP address, device/browser type and operating system. If you allowed push notifications: your browser's notification subscription details. If you chatted with the AI assistant: the content of the conversation.
3. For what purposes?
To receive, confirm, prepare and deliver your order; to collect and verify your payment; to notify you of changes in your order status; to create your account and verify your sign-in; to answer your questions; to keep the seller's customer records and order history; to send campaigns and announcements if you have consented; to keep the service running and secure (detection of abuse, fake orders and spam); and to comply with legal obligations.
4. What is the legal basis?
Your data is processed under Article 5 of the KVKK on the following grounds: (a) it is directly related to the conclusion or performance of a contract — opening your account and handling your orders fall within this scope; (b) the legitimate interest of the data controller — service security, prevention of abuse and measurement of service quality; (c) compliance with a legal obligation; (d) your explicit consent — obtained only for commercial communications such as campaigns/announcements and for non-essential cookies. You may withdraw your consent at any time for processing based on explicit consent.
5. To whom is your data transferred?
Your data is not sold to third parties. For the service to work, data is shared only with the following categories: GiftGame, which provides the website infrastructure (as a data processor), and its hosting provider; SMS, email and push notification providers for order and account notifications; the payment institution the seller works with, if you choose online payment; the carrier delivering your order, if you choose shipping; Google for authentication if you sign in with Google; the AI service provider when the AI assistant is used; and competent public authorities where legally required.
6. How long is it kept?
Your personal data is deleted when the purpose of processing no longer exists or when legal retention periods expire. In practice: AI assistant conversations are deleted automatically 90 days after the last message; IP addresses kept for security purposes are deleted 540 days after the account was last used; unused or invalid notification subscriptions are removed automatically after a certain period. Account, order and customer records are kept for as long as our relationship continues and legal retention obligations require.
7. Your rights under the KVKK
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in accordance with that purpose; to know the third parties to whom it is transferred domestically or abroad; to request correction if it is incomplete or inaccurate; to request its deletion or destruction under the conditions set out in the law; to request that correction/deletion be notified to the third parties to whom it was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing. You can submit your requests through the contact channel below; your application will be concluded within thirty days at the latest.
8. Data security
Your data is transmitted over an encrypted connection (HTTPS) to protect it against unauthorised access, and access is limited to authorised users only. Each brand's data is separated from other brands at the software level; one brand cannot see another brand's customer and order records. Access keys for external services are stored encrypted.
9. Changes
This notice may be updated from time to time due to changes in legislation or updates to the service. The current version is always published on this page; the date at the top of the page shows when it was last updated.
You can submit requests and applications regarding this document from the Support screen of the management panel after signing in to your account.