Data controller
| Item | Details |
|---|---|
| Registered company name | [Ticari Unvan] |
| MERSİS no. | 0000-0000-0000-0000 |
| Address | [Merkez adres] |
| info@stormgarage.com.tr | |
| KEP address (registered email) | [kep-adresi]@hs01.kep.tr |
| Phone | 0216 706 96 82 |
Personal data processed
Depending on how you use our services, we may process the following categories of personal data:
| Category | Example data | Where it is collected |
|---|---|---|
| Identity | Full name; date of birth for dealership applications | Forms, membership, orders, service bookings |
| Contact | Phone number, email, delivery and billing address | Forms, membership, orders, WhatsApp |
| Customer transactions | Order and service records; device make, model, mileage and fault information; requests and complaints | Shop, service, valuation, pre-owned |
| Visual | Photos of your device that you upload for valuations and listings | Valuation and listing forms |
| Financial | Billing details, payment records (card details are not stored by Storm Garage) | Orders and payments |
| Professional / company | Company name, date of incorporation, company address, investment budget range | Dealership application |
| Transaction security | IP address, access logs, security and error logs | Site infrastructure |
| Marketing | Your commercial message preferences (only if you have given consent) | Consent to commercial electronic messages |
Purposes of processing
- Carrying out technical service, maintenance, repair and warranty processes
- Taking orders and handling payment, delivery, return and invoicing processes
- Creating and managing membership accounts
- Reviewing valuation requests and communicating prices and offers; publishing and moderating pre-owned listings
- Responding to contact enquiries and dealership applications
- Tracking requests and complaints, and measuring customer satisfaction
- Carrying out information security processes and preventing misuse
- Fulfilling obligations arising from legislation and providing information to the competent authorities
- Sending promotions and announcements, if you have given your consent
Legal grounds
Your personal data is processed on the basis of the following legal grounds set out in Article 5 of the KVKK:
- Establishment or performance of a contract (Art. 5(2)(c)): service, sales, delivery, warranty and membership transactions
- Compliance with a legal obligation (Art. 5(2)(ç)): obligations arising from tax, commercial and consumer legislation
- Establishment, exercise or protection of a right (Art. 5(2)(e)): retention as evidence in potential disputes
- Legitimate interest (Art. 5(2)(f)): service quality, information security and fraud prevention
- Explicit consent (Art. 5(1)): commercial electronic messages and other processing that depends on explicit consent
Transfer of personal data
Your personal data may be transferred to the following groups of recipients, limited to the purposes set out above:
- Shipping and logistics companies (delivery and mail-in service)
- Payment institutions and banks (payment and refund transactions)
- The manufacturer or distributor of the relevant brand, in warranty processes
- Persons from whom we obtain accounting, financial advisory and legal counsel services
- Public institutions and organisations authorised by law
- Service providers supplying hosting, content delivery, security and email infrastructure
The servers of infrastructure service providers (e.g. the content delivery network and the email service) may be located abroad. In that case, the transfer is carried out in accordance with the conditions laid down in Article 9 of the KVKK.
When you press the “Translate” button on a pre-owned listing, only the listing text is sent to the translation service provider; this process is initiated at your request.
Method of collection
Your personal data is collected through the forms and membership procedures on our website, WhatsApp, email and telephone conversations, the service intake processes at our branches and our social media accounts, by wholly or partly automated means, or by non-automated means as part of a data recording system.
Retention period
Your personal data is retained for the period required by the purpose of processing and for the retention periods laid down in the relevant legislation; when that period ends, it is erased, destroyed or anonymised.
[A personal data retention and destruction policy will be prepared and a link to it will be added to this section.]
Your rights under KVKK Art. 11
You have the right to:
- learn whether your personal data is being processed;
- request information about the processing if it has been processed;
- learn the purpose of the processing and whether the data is being used in line with that purpose;
- know the third parties, in Türkiye or abroad, to whom your personal data has been transferred;
- request rectification if your data has been processed incompletely or inaccurately;
- request erasure or destruction of your data under the conditions set out in Article 7 of the KVKK;
- request that the third parties to whom your data has been transferred be notified of any rectification, erasure or destruction;
- object to any outcome detrimental to you that arises from the analysis of the processed data exclusively by automated systems;
- claim compensation if you suffer damage as a result of unlawful processing.
You can exercise these rights by applying to the data controller.
Application procedure
In accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can submit your requests in writing to [Merkez adres], via KEP to [kep-adresi]@hs01.kep.tr, or by email to info@stormgarage.com.tr from the email address registered in our system.
Your application must include your full name, your signature (for written applications), your Turkish ID number (T.C. Kimlik No) (for foreign nationals, your nationality and passport number), your address for notifications, your email address and phone number if any, and the subject of your request.
Your application will be concluded free of charge as soon as possible, depending on its nature, and within thirty days at the latest. If the process involves an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board. If your application is rejected or you find the response insufficient, you may lodge a complaint with the Board.