Privacy Policy

Last updated: 23 October 2026

MOONCORN TEKSTİL ÜRÜNLERİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ
Trading name: Mooncorn
Central Registration System (MERSIS) number: 0622234245000001
Tax office and tax number: İlyasbey, 6222342450
Address: Çayırova Mah. Yavuz Sultan Selim Cad. No:19 İç Kapı No:2, Çayırova / Kocaeli, Türkiye
Email: [email protected]
Registered electronic mail (KEP): [email protected]
WhatsApp (messages only): +90 850 309 30 57
Chamber of commerce: Gebze Chamber of Commerce
Customer service hours: Monday to Friday 08:00-18:00, Saturday 08:00-12:00 (Turkey time, GMT+3)

This policy explains how we handle the personal data of visitors, members and customers of our English-language website (mooncorn.com.tr/en) and of people who contact us. Because we are based in Turkey and offer goods to customers in the European Union, Norway and Switzerland, we apply Turkish Law No. 6698 on the Protection of Personal Data (KVKK), the EU General Data Protection Regulation (GDPR), which also applies in Norway, and the Swiss Federal Act on Data Protection (FADP), as far as each of them applies.

1. Who is responsible for your data

The controller of your personal data is MOONCORN TEKSTİL ÜRÜNLERİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ (Mooncorn), whose details are shown above. For any question about your data, email [email protected].

2. What data we collect

Account data: name, email address, phone number and login details.
Order data: products, prices, delivery and billing address, phone number, email address and order history.
Payment data: transaction details such as amount, date and result. Card details are entered on the secure payment page of our payment provider PayTR; we do not receive or store your full card number.
Delivery and customs data: name, delivery address, phone number and the contents and value of your parcel.
Communication data: messages you send us by email, WhatsApp or social media, and our replies.
Technical and usage data: IP address, device and browser information and the pages you visit, collected through cookies and similar technologies (see our Cookie Policy).
Marketing preferences: whether and when you agreed to receive marketing emails or withdrew your consent.

3. Why we use your data and our legal basis

Your account, orders, payment, delivery, returns and refunds: performing our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
Export, customs clearance, invoicing and records we must keep by law: our legitimate interest in complying with the Turkish tax, customs and commercial law that applies to us (GDPR Art. 6(1)(f)) and, under the KVKK, processing that is expressly provided for by law and necessary to comply with our legal obligations (KVKK Art. 5(2)).
Answering your questions and complaints and handling disputes: performing our contract, complying with legal obligations, or establishing, exercising or defending legal claims (GDPR Art. 6(1)(b), (c) and (f); KVKK Art. 5(2)).
Site and account security and preventing fraud and misuse: our legitimate interest in keeping our website secure (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
Measuring how our website is used and measuring our advertising: our legitimate interest in understanding how visitors use our website and how our advertising performs (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). You can object at any time, as explained in our Cookie Policy.
Marketing emails: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). See our Marketing Consent page.

We do not ask for special categories of personal data, such as health data or data about religious beliefs, and we do not use your purchases to draw conclusions about your religious or philosophical beliefs. Please do not include unnecessary sensitive information in your messages to us.

Giving us the data needed for your order is necessary to conclude the contract; without it we cannot accept or deliver your order. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

4. Who we share your data with

We share personal data only as far as needed for the purposes above, with the following recipients:

ikas (Turkey): the e-commerce platform that runs our website, accounts and orders;
PayTR (Turkey): card payments and refunds;
Yurtici Kargo and its international partners: delivery, customs clearance and returns;
Qpien: the customer messaging platform we use to answer your messages;
our e-invoicing and e-archive invoice provider and our order management system (Turkey): invoices and order processing;
Google (Analytics, Ads, Merchant Center): website analytics and advertising measurement;
Meta (Facebook and Instagram): advertising measurement;
Microsoft (Clarity): website usage analytics;
banks, our legal and accounting advisers, and public authorities, including customs and tax authorities, where the law requires or allows it.

5. International transfers

Your data is processed in Turkey, where we and our main service providers are based. Some providers, such as Google, Meta and Microsoft, may process data in other countries, including the United States. Where we transfer personal data outside your country, we rely on the safeguards permitted by applicable law (such as standard contractual clauses) where required. The same applies to transfers of personal data out of Turkey under Article 9 of the KVKK. You can contact us for more information about these safeguards.

6. How long we keep your data

Commercial books and records, including invoices and order documents: 10 years (Article 82 of the Turkish Commercial Code).
Tax records: 5 years (Article 253 of the Turkish Tax Procedure Law).
Account data: until you close your account.
Marketing consent: until you withdraw it. Records showing when you gave or withdrew consent are kept for 3 years after the consent ends, as required by Turkish law.
Customer messages and correspondence: 2 years.
Security and traffic logs: for the period required by law, including Turkish Law No. 5651, and no longer than necessary.

If a dispute or legal claim is ongoing, we keep the related data until it is resolved. When a retention period ends, we delete, destroy or anonymise the data.

7. Security

We take appropriate technical and organisational measures to protect your data against unlawful access, loss and misuse, as required by the KVKK (Article 12) and the GDPR (Article 32). Using service providers does not remove this responsibility from us.

8. Your rights

Depending on the law that applies to you, you have the right to:

find out whether we process your data and get a copy of it;
know why we process it and whether it is used for that purpose;
know the third parties in Turkey or abroad to whom your data is transferred;
have incomplete or inaccurate data corrected;
have your data erased where the legal conditions are met;
ask us to restrict processing;
receive the data you gave us in a structured, machine-readable format and have it sent to another controller;
object to processing based on our legitimate interests, and object at any time to direct marketing;
withdraw your consent at any time, without affecting processing carried out before you withdrew it;
have corrections and erasures notified to third parties who received your data;
object to a result against you produced solely by automated analysis;
claim compensation for damage caused by unlawful processing.

To use your rights, email [email protected] from the email address you have registered with us, write to our address or send a message to our registered electronic mail address. We ask only for the information needed to confirm your identity. We reply as soon as possible and at the latest within 30 days, free of charge.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where an alleged breach took place: in the EU, the authority of your country; in Norway, Datatilsynet; in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in Turkey, the Personal Data Protection Authority.

9. Cookies

How we use cookies and similar technologies is explained in our Cookie Policy.

10. Marketing emails

Marketing emails are optional and are sent only with your consent. You can unsubscribe at any time. Details are on our Marketing Consent page.

11. Children

Our website is not aimed at children under 16, and we do not knowingly collect their data.

12. Changes to this policy

When the way we process data changes, we update this policy and change the date at the top of this page. Where the law requires it, we inform you or ask for your consent before the new processing starts.