Personal Data Protection Notice
Last updated: 8 October 2026
1. Data controller and scope
Anthos Jewellery Kuyumculuk Sanayi ve Ticaret Ltd. Şti., operating under the D’Evin Jewellery brand
Harbiye, Bostan Street, No. 15, Orjin Apartment, Floor 5, Şişli, Istanbul 34367
E-mail: info@devinjewellery.com · Telephone: +90 212 373 94 64 · WhatsApp: +90 530 909 19 34
Under the Personal Data Protection Law No. 6698 (KVKK), the data controller is Anthos Jewellery Kuyumculuk Sanayi ve Ticaret Ltd. Şti. D’Evin Jewellery is the company’s brand. This notice explains the personal data processed on the corporate site devinjewellery.com, in the online store shop.devinjewellery.com and in the request, order and after-sales processes conducted through these channels. No sales transactions take place on the corporate site; membership, order and payment data arise only in the store processes in which you use those functions.
2. Collection methods
Data are collected, wholly or partly by automated means, through the electronic forms you fill in, membership and order screens, payment and delivery records, requests you send by e-mail, telephone and messaging, transaction notifications from service providers, technical server logs and, to the extent you have opted in, cookies and similar technologies; and by non-automated means through documents and correspondence that form part of the data filing system. D’Evin’s obligations in respect of data it receives through messaging services are separate from the data processing activities of the platform concerned.
3. Data, purposes and legal bases
| Process and personal data | Purpose of processing | Legal basis |
|---|---|---|
| Contact: name and surname, e-mail, optional telephone, subject and message | Assessing and answering the request | KVKK Art. 5/2-f: legitimate interest that does not harm fundamental rights; Art. 5/2-c for requests directly related to a contract |
| Showroom appointment: name and surname, e-mail, telephone, date/time, area of interest and optional note | Arranging and confirming the appointment | Art. 5/2-c in preparation for a purchase or bespoke consultation; proportionate legitimate interest, Art. 5/2-f, for appointment management not directly related to a sale |
| Be-Spoke request: name and surname, e-mail or telephone; optional category, occasion and design notes | Quotation, design consultation and assessment of the request | Art. 5/2-c: necessity for the establishment or performance of a contract |
| Membership: identity and contact details, account and security records | Creating, using and protecting the account | Art. 5/2-c; Art. 5/2-f for security |
| Order: name and surname, contact details, billing and delivery address, recipient details, order and payment transaction status | Sale, collection of payment, delivery, invoicing and returns | Art. 5/2-c; Art. 5/2-a and ç for statutory invoicing and record-keeping obligations |
| After-sales: purchase details, request, photographs, service and repair correspondence | Warranty, care, returns, complaints and the protection of rights | Art. 5/2-c, ç and, where required, e |
| Identity and transaction details and verification documents required by legislation | Identity verification, record-keeping and reporting obligations under Law No. 5549 and related regulations | Art. 5/2-a and ç; only in transactions where the obligation arises |
| IP address, device/browser, access, error, transaction time and security logs | Operating the site, troubleshooting and preventing abuse | Art. 5/2-f; Art. 5/2-a and ç where a specific statutory record-keeping obligation exists |
| Contact address and marketing preferences | Optional communication about collections, events and campaigns | Separate explicit consent under KVKK for marketing, Art. 5/1; Art. 5/2-a and ç for proving message consent and for IYS records |
| Analytics and advertising identifiers and visit interactions | Site analytics or advertising measurement, where opted in | Separate purpose-based explicit consent, Art. 5/1; details in the Cookie Policy |
You are not obliged to fill in fields that are not required. Do not add unnecessary personal data of third parties, or health, belief, biometric or other special categories of data, to the Be-Spoke or message fields. Such data are not a necessary element of a design request. If such information is nevertheless sent, the parts that are not needed are separated and deleted unless there is a legal obligation to retain them.
We do not ask for information such as a full card number or card security code through the contact form, e-mail or WhatsApp. Payments are processed through the provider on the payment screen; the payment transaction status and accounting information that D’Evin has access to are separate from card security data.
4. Domestic recipient groups and purposes of transfer
Data limited to what the purpose requires may be transferred to carriers for delivery and returns; to banks and payment institutions for collection and refunds; to the financial adviser and the relevant service providers for invoicing and statutory records; to legal advisers for disputes and the protection of rights; to technical infrastructure and maintenance providers for the operation of the site and store; to IYS (the Message Management System) and authorised messaging service providers for the management of commercial message preferences; and to authorised public bodies for the fulfilment of lawful requests. Transfers are made under KVKK Art. 8 and the specific processing conditions stated in the table; data are not sold.
The corporate site maintenance provider, Lumina Spark Digital, provides services limited to our instructions. Access by D’Evin’s authorised employees in the course of their work is not regarded as a transfer to third parties outside the company. Technical providers’ access is limited to their task. Transfers to service providers processing marketing data are limited to the scope of the relevant marketing consent and to Art. 8.
5. Recipients abroad and transfers
The corporate site is hosted by Vercel Inc. (USA), and form e-mails are delivered through the infrastructure of Brevo / Sendinblue SAS (France). If you opt in, technical data about your visit may be processed in Google services for site analytics and in Meta services for advertising measurement. Choosing to load the Google map may also result in technical data being sent to Google. The provider’s contracting entity, the countries from which data are accessed and sub-providers are taken into account in relation to the transaction concerned.
The online store infrastructure is provided by Shopify, based in Canada; account, order, delivery and payment transaction status data are processed on servers abroad for the purpose of operating the store. The corporate e-mail service runs on the Microsoft 365 infrastructure of Microsoft, based in the USA; the requests and correspondence you send us by e-mail fall within this scope. Messages you send via WhatsApp are processed in the WhatsApp service of Meta, based in the USA. The payment service is provided by PayTR, a payment institution established in Turkey; payment data are not transferred abroad within this scope.
The KVKK Art. 9 transfer mechanism on which these transfers will rely for each recipient is being determined by the data controller and will be explained in this section once completed. Where an adequacy decision under the Law is relied on, its scope is stated; where appropriate safeguards are used, the safeguard applied is explained. Where a standard contract is used, the Authority must be notified within five working days of the completion of signatures. Regular and continuous infrastructure transfers are not made lawful merely by a general “consent to transfer abroad”.
6. Retention and erasure
Data are kept for as long as the purpose of processing requires and for the retention obligations laid down in the applicable legislation; once the purpose and legal basis cease, they are erased, destroyed or anonymised. No single indefinite retention rule is applied to all data. The record-keeping obligation of at least three years for contract and distance-transaction records, the ten-year periods applicable to commercial and accounting records and the periods under tax legislation, and the eight-year retention obligation for MASAK documents are also taken into account. Where more than one obligation applies to a record, the longest applicable mandatory period prevails; that period does not automatically extend to all form data.
Retention period for contact and appointment requests after closure: after the request is closed, the limited period needed to follow it up and to answer any subsequent application. Be-Spoke requests that do not become a contract: on the same basis, the limited period needed after the consultation is concluded. Account and technical records: account records for as long as the account remains open and, after closure, for the period required by legal obligations; technical access and error logs limited to the retention period of the infrastructure provider concerned. The duration of cookies on your device is explained in the Cookie Policy; retention periods in analytics and advertising measurement systems are limited to the period set in the provider’s account settings. Records needed for a specific ongoing dispute may be kept to the extent required to protect the right concerned.
7. Rights and applications
You may learn whether your personal data are processed; request information if they are; learn the purpose of processing and whether the data are used in line with that purpose; know the third parties to whom the data are transferred in Turkey or abroad; request the correction of incomplete or inaccurate data; request erasure or destruction under the conditions of Article 7 of the Law; and request that correction, erasure or destruction be notified to the third parties to whom the data have been transferred. You may object to a result arising to your detriment from analysis carried out exclusively by automated systems, and claim compensation for damage suffered as a result of unlawful processing.
You may send your requests in writing to the address above, or to info@devinjewellery.com from the e-mail address you have previously notified to us and which is registered in our system. Your rights to apply by registered electronic mail (KEP), secure electronic signature, mobile signature and the other methods set out in the Communiqué are reserved. An application must contain your name and surname and, for written applications, your signature; the Turkish Republic identity number for Turkish citizens or, for foreign nationals, nationality and passport number or identity number if any; your address for notification; e-mail address, telephone and fax number for notification, if any; and your request. You may attach the relevant information and documents. Only the necessary and proportionate information is requested for identity verification.
Applications are concluded as soon as possible according to their nature and within 30 days at the latest, free of charge as a rule; where a cost is incurred, only the tariff set by the Board may be applied. If the application is rejected, the reply is insufficient or no reply is given in time, you have the right to lodge a complaint with the Board within 30 days of learning of the reply and in any case within 60 days of the date of application.
8. Notice and preferences
This notice is for information purposes; reading it or requesting a service does not amount to general explicit consent. Choices for optional marketing and for analytics/advertising purposes are obtained separately; declining them does not affect your right to membership, an appointment or a purchase. When this notice or the data processing procedures change, an up-to-date notice is provided at the relevant data collection points.