Laleon Exclusive is a fine jewelry house based in Istanbul. This policy explains what personal data we collect when you visit our website or join our waitlist, why we collect it, what we do with it, and the rights you have over it.

We have written this policy to satisfy both the Turkish Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu, Law No. 6698, “KVKK”) and the European Union General Data Protection Regulation (“GDPR”). Where the two frameworks use different language for the same idea, we have tried to be clear rather than technical.

If anything here is unclear, please write to us at . hello@laleonexclusive.com We would rather explain than have you guess.

Data controller (veri sorumlusu):

METEKS TEKSTIL VE DOKUMA SANAYI TİCARET LTD. STI.

IMC 2. BLOK NO 2711 UNKAPANI ISTANBUL TURKIYE

MERSİS No: 0619007951200011

Tax office and number: HOCAPASA VD./6190079512

Email: office@metextextile.com

Telephone: +902125271382

This policy applies to hello@laleonexclusive.com  and to any communication you have with us by email or through our forms.

It does not cover third-party websites we link to, or our social media profiles, which are governed by the policies of the platforms that operate them.

4.1 Data you give us directly

4.2 Data collected automatically

We do not collect payment data at present because the site does not yet process transactions. When online sales begin, this policy will be updated before payment processing starts.

4.3 Data we do not collect

We do not collect special category data (health, religion, ethnicity, biometric or genetic data, political or philosophical views, trade union membership, sexual life, criminal record). Please do not send us this kind of information through our forms.

We do not knowingly collect data from anyone under 18.

The table below sets out each purpose, the GDPR legal basis, and the corresponding KVKK basis.

Where we rely on legitimate interests, our interest is in running a functional, secure website and responding to people who contact us. We have considered whether this overrides your rights and concluded it does not, because the processing is limited, expected, and low risk. You may object at any time, see section 11.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

We use cookies and similar technologies. Strictly necessary and functional cookies are set without consent because the site cannot work without them. Analytics and advertising cookies are set only after you consent through our cookie banner.

Full detail, including a live list of every cookie, its provider, purpose, and duration, is in our Cookie Policy at https://laleonexclusive.com/cookie-policy/.

You can change or withdraw your cookie choices at any time using the cookie settings link in our footer.

We do not sell your personal data. We share it only with service providers who help us operate, and only to the extent they need it.

When online sales begin, iyzico Ödeme Hizmetleri A.Ş. will process payment data as an independent controller. This policy will be updated accordingly.

Each provider acts on our documented instructions under a data processing agreement, except where they act as an independent controller for their own purposes, which is the case for Meta and Google in relation to certain advertising functions.

We are established in Türkiye. Türkiye is not currently the subject of an adequacy decision by the European Commission, and the European Union is not currently the subject of an adequacy decision by the Turkish Personal Data Protection Board. Data therefore moves in both directions under appropriate safeguards.

For transfers from the EEA to Türkiye and elsewhere: we rely on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supplemented where necessary by additional technical and organisational measures identified through a transfer impact assessment.

For transfers from Türkiye abroad: we rely on the mechanisms set out in Article 9 KVKK as amended, including standard contracts notified to the Personal Data Protection Authority within the statutory period.

Some of our service providers are established in the United States or process data there. Where they participate in the EU-US Data Privacy Framework, we rely on that. Where they do not, we rely on Standard Contractual Clauses.

You may request a copy of the safeguards we rely on by writing to hello@laleonexclusive.com

10.1 If you are in the EEA or UK (GDPR)

You have the right to:

• Access the personal data we hold about you, and receive a copy
• Rectification of inaccurate or incomplete data
• Erasure, in the circumstances set out in Article 17
• Restriction of processing, in the circumstances set out in Article 18
• Data portability, for data you provided to us where processing is based on consent or contract
• Object to processing based on legitimate interests. Where you object to direct marketing, we will stop, without exception
• Withdraw consent at any time, as easily as you gave it
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not carry out such processing
• Lodge a complaint with a supervisory authority in your country of residence, place of work, or the place of the alleged infringement

10.2 If you are in Türkiye (KVKK Article 11)

You have the right to:

• Learn whether your personal data is being processed
• Request information about it if it has been processed
• Learn the purpose of processing and whether the data is used in line with that purpose
• Know the third parties to whom the data is transferred, in Türkiye or abroad
• Request correction of incomplete or inaccurate data, and request that the correction be notified to third parties to whom the data was transferred
• Request deletion or destruction of the data where the reasons for processing no longer apply, and request that this be notified to third parties
• Object to a result arising from analysis of the data exclusively by automated systems, where that result is to your detriment
• Claim compensation for damage arising from unlawful processing

10.3 How to exercise your rights

Write to hello@laleonexclusive.com or by post to the address in section 2.

If you are in the EEA or UK, we will respond within one month. We may extend this by two further months for complex requests, and will tell you if we do.

If you are in Türkiye, applications must be made in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. This means in writing, or through your registered KEP address, secure electronic signature, mobile signature, or an email address previously notified to us and registered in our systems. We will conclude your request within 30 days.

We may need to verify your identity before acting on a request. We will ask only for what is proportionate.

10.4 Complaints

EEA: you may complain to the supervisory authority in your member state. A list is maintained by the European Data Protection Board.

UK: the Information Commissioner’s Office.

Türkiye: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). Under Article 14 KVKK, you must first apply to us. If your application is rejected, you receive an insufficient response, or we do not respond in time, you may complain to the Board within 30 days of learning the response and in any event within 60 days of the date of your application.

We would much rather you told us first, and we will try to fix it.

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit across the whole site
• Access control, with administrative access limited to named individuals
• Two-factor authentication on administrative accounts
• Regular software and plugin updates
• Regular backups, stored separately
• Data processing agreements with every provider that handles personal data on our behalf
• Assessment of any new tool before it is given access to personal data

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant authority within 72 hours and, where the risk is high, notify you directly.

Our website and products are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to hello@laleonexclusive.com and we will delete it.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Our advertising providers may use profiling to decide which advertisements are shown to you. This happens only where you have consented to advertising cookies, and you can withdraw that consent at any time through our cookie settings.

We may update this policy as our business, our tools, or the law changes. The date at the top always reflects the current version.

If we make a change that materially affects how we use your data, we will tell you directly by email before it takes effect, where we have your address and where the law requires it.