Privacy Policy

Last updated: September 2026

This Privacy Policy and KVKK Information Notice has been prepared to explain how personal data relating to individuals who visit the ORNR Studios website, make purchases through the website, or communicate with ORNR Studios is processed and for what purposes.

This notice does not constitute a consent form. Where the processing of personal data requires explicit consent, such consent will be obtained separately.

Data Controller

Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by Bartu Öner, the sole proprietor operating under the ORNR Studios brand, in the capacity of data controller.

Data Controller: Bartu Öner
Brand: ORNR Studios
Address: [REGISTERED BUSINESS ADDRESS]
E-mail: [KVKK AND CUSTOMER SERVICE E-MAIL ADDRESS]
Telephone: [TELEPHONE NUMBER]

Personal Data We Process

Depending on your relationship with ORNR Studios and your use of the website, the following categories of personal data may be processed:

  • Identity information: First name and surname.
  • Contact information: E-mail address, telephone number, delivery address and billing address.
  • Order and customer transaction information: Products ordered, size and quantity information, order date, payment and refund status, and delivery, shipping and invoicing information.
  • Payment information: Payment method used, payment status and transaction number. ORNR Studios does not directly store full credit or debit card details; such information is processed by authorized payment service providers.
  • Customer service information: E-mail correspondence and information relating to requests, complaints, returns and exchanges.
  • Marketing information: Commercial communication preferences and information relating to campaign and newsletter subscriptions.
  • Digital transaction information: IP address, device and browser information, session information, transaction records and technical records relating to website security.
  • Cookie data: Cookie preferences and information obtained through analytics or advertising cookies where the required consent has been provided.

Purposes and Legal Grounds for Processing Personal Data

Your personal data may be processed for the following purposes and on the following legal grounds under the KVKK:

  • To create orders, process payments, deliver products and fulfil obligations arising from the sales contract, on the legal ground that processing is necessary for the establishment or performance of a contract pursuant to Article 5/2(c) of the KVKK;
  • To issue invoices, maintain accounting records and comply with obligations arising from tax, consumer and electronic commerce legislation, on the legal ground that processing is necessary for compliance with a legal obligation pursuant to Article 5/2(ç) of the KVKK;
  • To process returns, exchanges, complaints and customer support requests, on the legal grounds of performance of a contract and the establishment, exercise or protection of a right;
  • To prevent fraud and ensure transaction and website security, provided that the fundamental rights and freedoms of the data subject are not adversely affected, on the legal ground of legitimate interests pursuant to Article 5/2(f) of the KVKK;
  • To manage legal disputes and protect legal rights, on the legal ground that processing is necessary for the establishment, exercise or protection of a right pursuant to Article 5/2(e) of the KVKK;
  • To send campaigns, newsletters and commercial electronic communications, and to carry out analytics or advertising activities requiring consent, on the basis of the explicit consent of the data subject.

How Personal Data Is Collected

Your personal data may be collected through:

  • Membership, order, payment, contact and newsletter forms available on the website;
  • Technical records and cookies generated during the use of the website;
  • Communications with ORNR Studios by e-mail, telephone or social media;
  • Transaction information received from payment providers, shipping companies and other service providers.

Personal data is collected electronically through automated or partially automated means.

Transfer of Personal Data

Your personal data may be shared, in accordance with Articles 8 and 9 of the KVKK and only to the extent necessary for the relevant service, with the following persons and organizations:

  • Payment institutions, banks and financial service providers for the purpose of processing payments;
  • Shipping and logistics companies for the delivery of orders and processing of returns;
  • E-commerce infrastructure, software and technology providers for the operation of the website, order management, hosting, technical support and information security services;
  • E-invoicing providers, financial advisers and relevant service providers for invoicing, accounting and compliance with financial obligations;
  • Analytics, advertising and marketing service providers where explicit consent has been provided;
  • Advisers, authorized public authorities, courts and administrative authorities where necessary to comply with legal obligations or protect legal rights.

Personal data may be transferred abroad where e-commerce infrastructure, hosting, cloud services, analytics or technical support services are provided by service providers located outside Türkiye.

Such transfers will only be carried out where one of the mechanisms permitted under Article 9 of the KVKK applies, including an adequacy decision, appropriate safeguards, standard contracts or another transfer mechanism permitted by applicable law.

Where an international transfer relies on explicit consent, such consent will be obtained separately from this notice.

Your Rights Under the KVKK and How to Exercise Them

Under Article 11 of the KVKK, you have the right to:

  • Learn whether your personal data is being processed;
  • Request information if your personal data has been processed;
  • Learn the purpose for which your personal data is processed and whether it is being used in accordance with that purpose;
  • Learn the third parties in Türkiye or abroad to whom your personal data has been transferred;
  • Request correction of personal data that has been processed incompletely or inaccurately;
  • Request the deletion or destruction of your personal data where the conditions provided by law are met;
  • Request that correction, deletion or destruction of your personal data be communicated to third parties to whom the data has been transferred;
  • Object to a result arising against you as a result of the analysis of your personal data exclusively through automated systems;
  • Request compensation for damages where you have suffered loss as a result of the unlawful processing of your personal data.

You may submit your requests under the KVKK by clearly stating your identity and the nature of your request and sending your application from the e-mail address registered in our systems to [E-MAIL ADDRESS].

Applications will be processed as soon as possible and, in any event, within 30 days, depending on the nature of the request. Where the processing of an application incurs an additional cost, fees may be charged in accordance with the tariff determined by the Turkish Personal Data Protection Board.