Privacy Policy (English)

This policy explains how your personal data is processed when you use the 34Pazar service and the 34pazar.com website. It provides the information required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and Article 13 of the EU General Data Protection Regulation (GDPR). This is an English translation of the Turkish original; if the two differ, the Turkish version prevails.

1. Controller

34Devs — Ahmet Hamdi Kilic
Hedwigstraße 27, 41352 Korschenbroich, Almanya
Email: info@34devs.com
Phone: +49 176 76798125

A data protection officer has not been appointed because this is not legally required. Please use the contact details above for any questions about your personal data.

2. What data we process

2.1. When you visit the website

To display the website and keep it secure, our server processes technical information with every request: IP address, date and time of the request, the requested address, and browser and operating system information (user agent). Only cookies that are strictly necessary for sessions and security are used; see the cookie policy (Turkish). No analytics, advertising or tracking tools are used on the website.

2.2. When you create an account

• Identity and contact: full name, email address, company or store name.
• Account security: your password (stored only as an irreversible hash) and session records (IP address, browser information, last activity time).

No payment information is requested at sign-up.

2.3. When you use the service

• Channel connection details: API keys and access tokens of the sales channels you connect (for example Shopify, WooCommerce). These are stored encrypted in the database and are never written to log files.
• Catalog and stock data: products, variants, SKUs, stock movements and prices.
• Shopify app: when you install the app from Shopify, your store domain (xxx.myshopify.com), store name and store email address are collected to create your account and connect your store.
• Order data: the number, date, status, line items, amounts and shipment tracking information of orders from your channels. The buyer's name, email, phone and address are not kept in the order record; only a reference such as the customer ID provided by the channel is stored. When raw notifications from a channel are stored, these personal fields are masked.

2.4. When you upgrade to a paid plan

Payment is taken on the checkout page of our payment provider Stripe. Your card details are processed by Stripe; they never reach our servers and are not stored by us. We only store the subscription status, the plan, the Stripe customer and subscription IDs, and billing information.

If you use 34Pazar as a Shopify app, the subscription fee is added to your Shopify bill and collected by Shopify (Shopify Billing). In that case your payment details are processed only by Shopify; we store the subscription ID, plan and status.

2.5. When you contact us

When you reach us by email or phone, your name, contact details and the content of your message are processed to answer your request.

3. Purposes and legal bases

Purpose	KVKK	GDPR
Providing and securing the website, preventing abuse	Art. 5/2-f (legitimate interest)	Art. 6(1)(f)
Creating your account, providing the service, syncing with your channels	Art. 5/2-c (conclusion and performance of a contract)	Art. 6(1)(b)
Subscriptions, payments and invoicing	Art. 5/2-c and Art. 5/2-ç (legal obligation)	Art. 6(1)(b) and 6(1)(c)
Keeping accounting and tax records	Art. 5/2-ç	Art. 6(1)(c)
Answering support requests	Art. 5/2-c or Art. 5/2-f	Art. 6(1)(b) or 6(1)(f)
Establishing, exercising and defending legal claims	Art. 5/2-e (establishing, exercising or protecting a right)	Art. 6(1)(f)

Your personal data is not used for automated decision-making or profiling. We do not send marketing emails; if we ever do, we will ask for your explicit consent first.

4. Data processed on behalf of the merchant

For order and customer reference data coming from your channels, you, as the merchant making the sale, are the controller. 34Pazar processes this data only on your instructions and only to provide the service, on your behalf (as a processor under KVKK and under Art. 28 GDPR). Informing your buyers through your own privacy notice is your responsibility.

5. Who we share data with

Your personal data is never sold or shared for advertising. It is shared only with the following parties, as needed to provide the service:

• Hosting — IONOS SE (Germany): the website and database run on servers in Germany (EU). IONOS acts as a processor under contract.
• Payments — Stripe: paid subscriptions are charged through Stripe. For users in Europe the contracting party is Stripe Payments Europe, Ltd. (Ireland); data may also be transferred to Stripe, Inc. in the USA. Such transfers are made under appropriate safeguards such as the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses. Stripe is subject to its own privacy policy for payment services and fraud prevention.
• Email delivery — Google (Google Ireland Ltd.): service emails such as account verification and password reset are sent via Google Workspace; the recipient's email address and the email content are processed by Google for this purpose. Data may also be transferred to Google LLC in the USA under the EU-US Data Privacy Framework and/or standard contractual clauses.
• Shopify (Shopify International Ltd., Ireland): when you use the app through Shopify, the subscription fee is collected by Shopify and data is exchanged with your store through Shopify's API.
• Sales channels you connect: stock, price, product and shipping information is sent via API to the channels you connect on your instructions (for example your Shopify or WooCommerce store or your marketplace account). This transfer is the service itself; the channels' data processing is subject to their own policies.
• Authorities: only where legally required, to the competent public authorities.

Transfers abroad

Because the controller is established in Germany and the servers are located in Germany, your personal data is processed in Germany when you use the service from Türkiye. This transfer is made under Art. 9 KVKK, to the extent necessary to conclude and perform the service contract and with the safeguards required by law. The explanation above applies to transfers to Stripe and Google.

6. Retention

• Account, catalog and order data: as long as your account is open. When you close your account, data without a statutory retention obligation is deleted or anonymised within a reasonable time. You can request account closure by writing to info@34devs.com.
• Channel connection details: deleted when your account is closed.
• When you uninstall the Shopify app: your store's access token is revoked and the connection is closed. When Shopify's store data erasure request arrives (about 48 hours after uninstalling), customer references and raw notification content in orders from that store are deleted. Customer data access and erasure requests forwarded by Shopify are answered within 30 days.
• Invoices and payment records: for the statutory retention periods under tax and commercial law.
• Server and session records: for a limited time for security purposes; session records expire when your session ends.
• Support correspondence: for a reasonable time after your request is resolved, so that follow-up questions can be answered.

7. Security

Connections are encrypted (HTTPS); channel credentials are stored encrypted; passwords are irreversibly hashed; credentials and personal fields are masked in log files. Each account's data is processed separately from other accounts.

8. Your rights

Under Art. 11 KVKK you have the right to apply to the controller to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties in Türkiye or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under the conditions of Art. 7 KVKK,
• request that third parties to whom the data was transferred be notified of such correction, deletion or destruction,
• object to a result against you arising from analysis exclusively by automated systems,
• claim compensation if you suffer damage due to unlawful processing.

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You also have the right to lodge a complaint with a supervisory authority (Art. 77); the authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen). Your right to complain to the Turkish Personal Data Protection Authority is reserved.

How to apply

Send your request to info@34devs.com from the email address registered to your account. We may ask for additional information to verify your identity. Requests are handled free of charge within thirty days at the latest; if handling requires additional cost, the fee provided by law may be charged.

9. Changes

We update this policy when a new feature or service provider is added. The current version is always published on this page; the date at the top shows the latest change. We will notify registered users separately of significant changes.