Privacy policy

Privacy Policy

Last updated: November 2025

Brand Dunyasi (“we”, “us”, or “our”) respects your privacy and is committed to protecting the personal data of our clients, visitors, and users.
This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit our website https://www.branddunyasi.com or use our services.

By using our website or services, you agree to this Privacy Policy.

1. Data Controller

Data Controller: Adel Alnajjar (Individual)
Brand Name: Brand Dunyasi
Address: Hirka-i Şerif Mahallesi, Koçeci Çeşmesi Sokak, No: 3, Fatih, İstanbul, 34091, Türkiye
Email: support@branddunyasi.com
Phone: +44 7400 754208

If you reside in the EU, UK, or US, Brand Dunyasi Ltd (UK) will act as the future controller once incorporated.

2. Scope of Policy

This Privacy Policy applies to all customers and users of Brand Dunyasi in:

• Türkiye
• The European Union
• The United Kingdom
• The United States

We follow and comply with:

• GDPR (EU Regulation 2016/679)
• UK GDPR
• CCPA (California Consumer Privacy Act)
• Law No. 6698 on the Protection of Personal Data (KVKK – Türkiye)

3. Personal Data We Collect

We collect the following types of data only when necessary to deliver our services:

a. Information You Provide Directly

• Full name
• Email address
• Billing address
• Business name (optional)
• Payment confirmation details (from iyzico or Stripe)
• Messages or inquiries submitted through forms

b. Automatically Collected Data

• IP address and device data (for analytics and security)
• Browser type and operating system
• Referring URL and usage behavior
• Cookie consent preferences (see Cookie Policy)

c. Data from Third Parties

• Payment processors (iyzico, Stripe, PayPal, Wise, WorldFirst)
• Analytics and advertising tools (Google Analytics, Meta Pixel, LinkedIn Insight, etc.)

We never store or directly access your payment card details.

4. Purpose and Legal Basis of Processing

We process personal data only when we have a lawful basis:

5. Data Sharing and Third Parties

We share limited personal data with secure and compliant third-party providers strictly for operational purposes:

Payment Processors

• iyzico (Türkiye): Licensed by CBRT; used for TRY and local payments.
• Stripe (Global): PCI DSS Level 1 certified.
• PayPal / Wise / WorldFirst: Regulated international processors (used if applicable).

Hosting & Infrastructure

• Namecheap (EU servers – Amsterdam): SSL-secured hosting.
• Cloudflare: DDoS protection and global CDN.
• Supabase: Database and authentication management.

Analytics & Marketing

• Google Analytics 4 (IP anonymization enabled)
• Meta Pixel (only with consent)
• Microsoft Clarity / Hotjar (heatmaps – optional, consent-based)
• Mailchimp: Email newsletters and updates.

We do not sell, rent, or exchange personal data for marketing purposes.

6. International Data Transfers

Where data is transferred outside Türkiye, the EU, or UK (e.g., via Mailchimp or Supabase), we ensure protection by:

• Standard Contractual Clauses (SCCs) under GDPR; and/or
• KVKK-compliant cross-border transfer permissions.

7. Data Retention

We retain personal data only for as long as necessary:

• Customer records: 5 years (legal requirement)
• Marketing lists: Until you unsubscribe
• Analytics data: 14 months (Google Analytics default)
  After expiry, data is securely deleted or anonymized.

8. Data Security

We apply technical and organizational security measures including:

• SSL encryption (HTTPS)
• Access controls and authentication
• Regular monitoring for security incidents
• No storage of raw card data
  All third-party partners (iyzico, Stripe, Supabase, Mailchimp) are PCI DSS or GDPR/KVKK-compliant.

9. Your Rights

You have the following rights under GDPR/KVKK:

• Access to your personal data
• Rectification or update of incorrect information
• Erasure (“right to be forgotten”)
• Restriction of processing
• Data portability
• Objection to processing (especially for marketing)
• Withdrawal of consent at any time

To exercise your rights, contact support@branddunyasi.com.

10. Marketing Communications

You will receive emails only if:

• You purchased a service; or
• You subscribed to newsletters by consent.

You can unsubscribe anytime via the link in emails or by contacting us directly.

11. Cookies and Tracking Technologies

Last updated: November 2025

Brand Dunyasi (“we,” “our,” “us”) uses cookies and similar tracking technologies on our website https://www.branddunyasi.com to improve your browsing experience, analyze website traffic, and personalize content.
This Cookie Policy explains what cookies are, how we use them, and how you can manage your preferences.

1. What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, or smartphone) when you visit a website.
They help websites recognize your device, remember your preferences, and enhance functionality and performance.

Cookies may be:

• Session cookies – deleted when you close your browser.
• Persistent cookies – remain on your device until deleted or expired.
• First-party cookies – placed by Brand Dunyasi.
• Third-party cookies – placed by trusted external services we use (like Google Analytics, Meta Pixel, or iyzico payment widgets).

2. How We Use Cookies

We use cookies for the following purposes:

3. Third-Party Cookies We Use

We rely on a small number of trusted third parties who may set cookies through our website. These cookies enable their services to function and are subject to their own privacy policies:

• Google Analytics 4 (GA4): Measures website traffic and usage (with IP anonymization).
• Google Tag Manager: Manages marketing and analytics tags.
• Meta Pixel (Facebook / Instagram): Tracks conversions for social media campaigns.
• Microsoft Clarity / Hotjar: Collects anonymous behavioral insights to improve UX.
• LinkedIn Insight Tag: Helps evaluate B2B marketing performance.
• iyzico Payment Widget: Enables secure local payments in Türkiye.
• Stripe Checkout Cookies: Used for secure payment verification (PCI-DSS Level 1).
• Google reCAPTCHA v3: Protects forms from spam and abuse.
• Cloudflare: Provides website security, CDN, and DDoS protection.

All third-party services comply with GDPR and KVKK standards.

4. Consent and Cookie Banner

When you first visit our website, a cookie banner will appear asking for your consent.

• Essential cookies are automatically enabled (for security and payments).
• Analytics and marketing cookies are activated only after consent.

You can modify or withdraw your consent at any time by clicking “Cookie Preferences” at the bottom of our site.

5. How to Manage or Delete Cookies

You can manage cookies directly in your browser settings.
Here are links for common browsers:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Blocking cookies may affect some features, such as secure checkout or remembering your login session.

6. Changes to This Cookie Policy

We may update this policy periodically to reflect changes in our technology, legal obligations, or services.
Any updates will appear on this page with a new “Last updated” date.

7. Contact

For questions or concerns about this Cookie Policy, contact us at:
📧 support@branddunyasi.com
📍 Hirka-i Şerif Mahallesi, Koçeci Çeşmesi Sokak, No: 3, Fatih, İstanbul, 34091, Türkiye

12. Children’s Privacy

Our services are not directed to individuals under 16 years of age, and we do not knowingly collect their data.

13. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be posted on this page with the revised “last updated” date.

14. Contact

If you have any questions or privacy concerns, contact us at:
📧 support@branddunyasi.com
📍 Hirka-i Şerif Mahallesi, Koçeci Çeşmesi Sokak, No: 3, Fatih, İstanbul, 34091, Türkiye