GDPR & KVKK

Two regimes, one standard

GOMUR is established in Türkiye and works with brands across Europe. That places us under two frameworks at once: Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK), and the EU General Data Protection Regulation (GDPR) where we process the data of people in the EEA.

Rather than run two standards, we apply the stricter of the two to everyone. This page sets out how each right works in practice and how to exercise it. What we collect and why is described in the Privacy Policy.

Controller and representative

Controller

GOMUR, GOMUR, Yeni Sk. No: 1, Bornova, İzmir, Türkiye

Contact point

[email protected]

VERBİS

Registration is maintained where the thresholds in KVKK secondary legislation apply to us.

We are not required to appoint a Data Protection Officer under Article 37 GDPR, as we do not carry out large-scale monitoring or process special categories at scale. Enquiries reach a named person directly at the address above.

Your rights in detail

The rights below exist under both regimes. KVKK Article 11 and GDPR Articles 15 to 22 use different wording for substantially the same protections.

Access

Learn whether we hold data about you, and receive a copy with an explanation of purpose, recipients and retention.

Rectification

Have inaccurate or incomplete data corrected, and have us notify third parties to whom it was disclosed.

Erasure

Have data deleted where the reason for holding it has ended, subject to statutory retention periods.

Restriction

Have us pause processing while a dispute about accuracy or legitimate interest is resolved.

Portability

Receive data you gave us in a structured, machine-readable format, or have it sent to another controller.

Objection

Object to processing based on legitimate interests, including any profiling — though we carry out none.

Automated decisions

Object to a decision produced solely by automated analysis. We make no such decisions.

Compensation

Claim damages where unlawful processing has caused you loss.

Making a request

Send your request to [email protected] with “Data subject request” in the subject line, or by post to the address above. Include your name, the email address you used to contact us, and what you would like us to do.

How we handle it

• We acknowledge receipt and, where we are not certain who you are, ask for enough information to verify identity. We do not use that verification for anything else.
• We respond within 30 days, which satisfies both the KVKK maximum and the GDPR one-month period.
• Complex requests may take longer. If so we tell you within the first 30 days and explain why.
• Responses are free. We may charge a reasonable fee only where a request is manifestly unfounded or repetitive, in line with the KVKK tariff.

Under KVKK, a request must be made to us first. Only after our reply, or after 30 days without one, may you take the matter further.

Complaints

If our answer does not satisfy you, you can escalate.

Türkiye

Personal Data Protection Board (KVKK), within 30 days of our reply and in any case within 60 days of learning of the issue.

EEA

The supervisory authority of the country where you live or work, or where the issue arose.

United Kingdom

The Information Commissioner’s Office.

We would rather resolve it directly, and we will engage with any authority that contacts us.

Transfers out of the EEA

Working with us means your data reaches Türkiye. Türkiye does not hold an EU adequacy decision, so the transfer needs a safeguard under Chapter V GDPR.

• For client relationships, we sign the European Commission’s Standard Contractual Clauses where a client requires them, and support a transfer impact assessment on request.
• For an initial enquiry, the transfer is necessary to take steps at your request before entering a contract, under Article 49(1)(b).
• Under KVKK Article 9, transfers abroad are made on the basis of explicit consent or the undertakings and mechanisms recognised by the Board.

Processors we use

We keep the list short on purpose. Each processor works under written terms that limit them to our instructions.

Hosting

Serving the website and keeping access logs.

Email

Receiving and storing correspondence.

Production partners

Tanneries, finishers and logistics providers, bound by confidentiality terms.

A current list with locations is available on request.

Breach notification

If a breach is likely to result in a risk to your rights, we notify the competent authority without undue delay and, under GDPR, within 72 hours of becoming aware. Under KVKK we notify the Board within 72 hours and inform affected individuals as soon as reasonably possible. Where the risk is high, we contact you directly.