As HUPALUPA, within the scope of the services we provide to you, we process your personal data with the utmost care and diligence in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”). In order to prevent the unlawful processing of your personal data and to ensure that your personal data is securely protected, we take all necessary technical and administrative measures to the extent permitted by available technological means.
Within this framework, we would like to inform you about how your personal data is processed, with whom it may be shared, and under which principles.
These Principles (“Principles”) govern the collection, use, and sharing of Personal Data by HUPALUPA MAĞAZA İŞLETMECİLİĞİ TİCARET A.Ş. through the websites “http://hupalupa.com/tr” and “www.hupalupa.store”, as well as through applications published by HUPALUPA, its affiliates, or third-party Franchisees authorized by HUPALUPA, in accordance with the Personal Data Protection Law No. 6698.
By using the “http://hupalupa.com/tr” and/or “www.hupalupa.store” websites and/or any HUPALUPA application, you are deemed to have accepted the terms of these Principles.
These Principles apply solely to Personal Data. “Personal Data” refers to information that can be used to contact or identify an individual. This includes, but is not limited to, a person’s name and surname, physical address, email address, telephone number, photograph, or other identifying information. Personal Data may also include non-identifying information that can be stored together with Personal Data.
Information that does not identify an individual, such as anonymous, aggregated, or de-identified data, is not covered by these Principles. Such information may be collected, used, and disclosed to communicate with our sponsors, advertisers, and HUPALUPA Franchisees, and to evaluate and improve our service offerings.
Anonymization: Rendering personal data impossible to associate with an identified or identifiable natural person, even when matched with other data.
Privacy Notice: Information provided to the data subject regarding the purpose of processing personal data, the retention period, the method of collection, storage practices, and whether the data is shared with third parties.
Authority: Personal Data Protection Authority.
Data Inventory: A record created by data controllers detailing personal data processing activities, purposes, data categories, recipient groups, retention periods, data transfers abroad, and data security measures.
Data Subject: The natural person whose personal data is processed.
Destruction: Deletion, destruction, or anonymization of personal data.
Law / KVKK: Turkish Personal Data Protection Law No. 6698.
Personal Data: Any information relating to an identified or identifiable natural person (e.g., name, national ID number, email address, address, date of birth, bank account number). Data relating to legal entities is not considered personal data under KVKK.
Processing of Personal Data: Any operation performed on personal data, such as collection, recording, storage, preservation, alteration, disclosure, transfer, classification, or prevention of use.
Board: Personal Data Protection Board.
Institution: Personal Data Protection Authority.
Special Categories of Personal Data: Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect, appearance, association or union membership, health, sexual life, criminal convictions, security measures, biometric and genetic data.
VERBIS: The Data Controllers’ Registry Information System.
Data Processor: A natural or legal person who processes personal data on behalf of the data controller.
Data Controller: A natural or legal person who determines the purposes and means of processing personal data.
Data Controllers’ Registry: The registry maintained by the Authority.
Data Controller Contact Person: The individual designated for communication with the Authority.
Deletion: Making personal data inaccessible and unusable for authorized users.
Destruction: Making personal data permanently inaccessible, irretrievable, and unusable by anyone.
These Principles apply to the “http://hupalupa.com/tr” and “www.hupalupa.store” websites and HUPALUPA applications. HUPALUPA may provide links to third-party websites not owned or controlled by HUPALUPA or its Franchisees. Such third-party websites may collect personal information from visitors and are governed by their own privacy policies. HUPALUPA does not endorse or assume responsibility for the practices of these websites. We recommend reviewing the privacy policies of any website before providing personal data.
You are not required to provide personal data or register to browse “http://hupalupa.com/tr” and “www.hupalupa.store”. If you contact us with questions or requests for information, any personal data you provide is shared on a voluntary basis.
Personal data provided via email or postal mail may be used to respond to inquiries, provide information about our services, fulfill requests, improve customer service, and for other internal purposes. Such data will not be used for marketing purposes.
Personal data shared for communication purposes will be destroyed after the request is fulfilled and, in any case, after the expiration of legally required retention periods.
When using a HUPALUPA application on a mobile device, minimal personal information may be requested. Unless data is uploaded to a HUPALUPA website, online service, or third-party service, such data remains stored on the device and is not collected by HUPALUPA.
HUPALUPA may use cookies and similar technologies to collect non-identifiable technical information. Anonymous data collected together with Personal Data is not combined.
Personal data may be processed for purposes including but not limited to: provision of services, legal and commercial security, communication activities, management of company operations, event organization, informing users about products and services, billing and accounting, legal compliance, service improvement, risk management, security, audits, business continuity, occupational health and safety, public authority obligations, management of relationships with sponsors, suppliers, and business partners, prevention of fraud, complaint management, and execution of company strategies and human resources policies.
Personal data may be shared with suppliers, sponsors, business partners, public authorities, courts, legal and financial advisors, auditors, regulatory bodies, and HUPALUPA group companies, limited to the purposes stated above.
Personal data is stored for the duration required by the processing purposes or legal obligations and is subsequently destroyed in accordance with the Law.
Personal data is processed based on the legal grounds set out in Article 5/2 of KVKK, including legal obligation, contractual necessity, legitimate interest, public disclosure by the data subject, and protection of life or physical integrity.
Cookies and similar technologies are used to analyze user interaction. Users may disable cookies via browser settings. Persistent cookies are not used after users leave the site.
Personal data may be shared with service providers acting on behalf of HUPALUPA, provided they comply with these Principles. Personal data will not be sold, rented, or disclosed to third parties without prior consent, except as required by law.
HUPALUPA implements commercially reasonable safeguards to protect personal data. Third parties receiving personal data are required to apply equivalent security measures.
CCTV recordings are conducted in compliance with KVKK Article 12 for security purposes. Recordings are retained for 90 days and accessed only by authorized personnel.
Under Article 11 of KVKK, you may request information regarding your personal data, request correction or deletion, object to processing, and claim compensation for unlawful processing.
Requests may be submitted via the forms available at “hupalupa.com.tr” and “www.hupalupa.store”, or by email at [email protected].
HUPALUPA may update these Principles from time to time. Updates will be published on “http://www.hupalupa.com/tr” and “www.hupalupa.store”.
Email: [email protected]
Address: Ataşehir Atatürk, 34758 Ataşehir / Istanbul
Phone: +90 850 255 5588
HUPALUPA collects and processes children’s personal data only with parental consent and in accordance with applicable laws. Parents may withdraw consent at any time and request deletion of their child’s data by contacting [email protected].
