Privacy & Security Policy


Data Controller: Modalco (“Modalco”)
Address: Karşıyaka mh. Odabaşı cd. No:4089/3 Mamak/Ankara
E-mail: info@modalco.com
Web: modalco.com

This Policy explains our principles regarding the protection of personal data and information security on www.modalco.com (“Site”) in accordance with the Law No. 6698 on the Protection of Personal Data (KVKK) and relevant legislation. It should be read together with the KVKK Clarification Text and the Cookie Policy.

1) Scope and Definitions

  • The Policy covers visitors, customers, members, and all natural persons who communicate with us.

  • “Personal data” is any information relating to an identified or identifiable natural person.

  • “Processing” covers operations such as the collection, recording, storage, modification, and transfer of data.

2) Data We Collect and Methods

  • Identity & Contact: Full name, e-mail, phone, address (account/delivery processes).

  • Customer Transaction: Cart/order, return/cancellation, support records.

  • Payment: Payments are received through licensed payment institutions/banks; card details are not stored on Modalco/Shopify systems.

  • Marketing: Newsletter subscription, permission/rejection records, campaign interactions (with explicit consent).

  • Technical & Security: IP, device/browser information, sessions and logs, error/crash data.

  • Cookies: Essential/performance/functional/advertising cookies (details: Cookie Policy).
    Methods: Site forms and transactions, cookies/pixels, call center, suppliers.

3) Purposes of Processing and Legal Grounds

  • Establishment/performance of a contract (KVKK Art. 5/2-c): Order, delivery, return, support.

  • Legal obligation (Art. 5/2-ç): Tax/commercial records, audits.

  • Legitimate interest (Art. 5/2-f): Security, fraud prevention, product/service development.

  • Explicit consent (Art. 5/1): Commercial electronic messages, advertising/targeting cookies, and other necessary cases.

4) Data Sharing / Transfers

Sharing may be carried out with the following recipients, limited to the purpose:

  • E-commerce and hosting infrastructure (Shopify)

  • Payment institutions/banks, shipping/logistics companies

  • IT/Cloud providers, analytics and communication services (e-mail/SMS)

  • Call center, legally authorized public institutions
    If international transfer is required, the provisions of KVKK Art. 9 are followed; if necessary, explicit consent is obtained or adequate protection/commitment mechanisms are applied.

5) Storage Periods and Disposal

Data is stored for the minimum period required for the purpose and legal provisions; at the end of the period, it is deleted, destroyed, or anonymized. Example:

  • Order/invoice: 10 years

  • Support records: 3 years

  • Marketing permission/rejection: Validity of permission + 3 years

6) Our Security Measures

Technical: TLS/HTTPS, HSTS; password hashing; access controls (least-privilege, MFA); WAF and rate limiting; DDoS/anti-bot measures; backup; logging/audit; vulnerability scans; periodic penetration tests.
Administrative: Authority matrix; confidentiality commitments; KVKK provisions in supplier contracts (DPA); staff awareness training; incident response and business continuity procedures.
Payment security: Card data is processed by the payment institution; PCI DSS compliance is the responsibility of the payment providers.

7) Data of Minors

The site is intended for adult use. Data of persons under the age of 18 is not processed without parental/guardian consent; if detected, records are deleted.

8) Your Rights and Application

In accordance with KVKK Art. 11, you have the rights to request information, correction/deletion, to learn about transferred parties, to object to processing, and to request compensation in case of damages.
Application channels:

  • E-mail: info@modalco.com

  • Mail: Karşıyaka mh. Odabaşı cd. No:4089/3 Mamak/Ankara – “KVKK Information Request”
    Requests are concluded within at most 30 days, depending on their nature.

9) Cookies and Marketing Preferences

See the Cookie Policy for cookie types, storage periods, and preference management. Advertising/targeting cookies and commercial electronic messages are subject to explicit consent; you may withdraw your consent at any time.

10) Third-Party Links

The site may contain links to third-party sites/applications (e.g., shipment tracking, social media). Modalco is not responsible for the content and privacy practices of these parties; we recommend you review their respective policies.

11) Data Breach Notification

In the event of a security breach affecting personal data, notifications will be made to the Board and the affected individuals within a reasonable time in accordance with the KVKK; risk-mitigation measures will be implemented.

12) Updates

The Policy may be updated as necessary. The most current version is published on the Site; significant changes may also be announced separately.