Privacy Policy

1. Data Controller and Company Identity

This Privacy Policy has been prepared by STARTUP CREATIVE TEKNOLOJİ VE DANIŞMANLIK LİMİTED ŞİRKETİ ("My Tiny Garden", "we", "us", "our"). We act as the data controller in respect of the personal data processed through our website and associated digital channels. For customers located in the European Economic Area (EEA) or the United Kingdom, this Policy is also intended to meet the requirements of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and equivalent UK data protection legislation.

This Privacy Policy covers all personal data processing activities carried out through the website at www.mytinygarden.com.tr and all related digital channels operated by My Tiny Garden.

Company Name: STARTUP CREATIVE TEKNOLOJİ VE DANIŞMANLIK LİMİTED ŞİRKETİ
Brand: My Tiny Garden
Registered Address: Eğitim Mah. Poyraz Sok. No:1/68, Kadıköy, İstanbul, Türkiye
Email: info@mytinygarden.com

2. Personal Data We Collect and How We Collect It

We collect the following categories of personal data through the channels described below.

2.1 Categories of Personal Data Collected

Identity Data: First name and last name.
Contact Data: Email address, telephone number, delivery address, and billing address.
Order and Transaction Data: Order number, products purchased, order value, billing details, and delivery information.
Payment Data: Payment method type. Sensitive financial data such as full card numbers are processed and stored exclusively by our third-party secure payment infrastructure provider and are never stored on our own systems.
Account Data: Login credentials (email address and password-protected account), and any saved preferences or notes.
Technical and Usage Data: IP address, browser type, operating system, access date and time, pages visited, and click and navigation behaviour.
Marketing Preferences: Newsletter subscription status and communication consent records.
Gift Packaging and Message Card Information: The message content you provide for gift cards and any information you share about the intended recipient.

2.2 How We Collect Your Data

Account registration and order forms on our website.
Contact and customer support forms, and email correspondence.
Cookies, pixel tags, and similar automated tracking technologies.
Social media integrations and advertising platforms.
Partner notifications from third-party payment and delivery service providers.

3. Purposes of Processing and Legal Bases

We process your personal data on the following legal bases under the GDPR (Article 6) and, where applicable, equivalent provisions under Turkish data protection law.

3.1 Performance of a Contract (GDPR Art. 6(1)(b))

Creating, confirming, and fulfilling your order, including arranging delivery.
Issuing invoices and maintaining accounting records.
Providing our complimentary gift packaging and message card service.
Managing order, return, and exchange processes.

3.2 Compliance with a Legal Obligation (GDPR Art. 6(1)(c))

Meeting our obligations under tax, accounting, and commercial legislation.
Responding to lawful requests from competent public authorities.
Fulfilling obligations arising under applicable consumer protection and distance selling regulations.

3.3 Legitimate Interests (GDPR Art. 6(1)(f))

Ensuring website security and preventing fraud.
Conducting analytics activities to improve our products and services.
Personalising and enhancing the customer experience.

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see Section 9).

3.4 Consent (GDPR Art. 6(1)(a))

Sending commercial electronic communications by email, SMS, or other channels.
Using marketing and retargeting cookies.
Delivering personalised advertisements and content.

Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal. To withdraw your consent, please contact us at the details provided in Section 12 or use the opt-out mechanism included in each marketing communication.

4. Cookies and Tracking Technologies

Our website uses various types of cookies and tracking technologies to improve your experience and develop our services.

4.1 Strictly Necessary Cookies

These cookies are required for the basic operation of the website, including shopping basket management, session authentication, and maintaining a secure connection. They do not require your consent.

4.2 Analytical Cookies

These cookies help us understand visitor behaviour and site traffic. We may use third-party tools such as Google Analytics for this purpose. Your explicit consent is obtained before these cookies are placed.

4.3 Marketing and Targeting Cookies

These cookies are used to serve relevant advertisements and to track conversion events. Tools such as Meta Pixel (Facebook/Instagram) may fall within this category. Your explicit consent is obtained before these cookies are placed.

4.4 Functionality Cookies

These cookies remember your preferences, such as language selection and currency choice, to provide you with a more personalised experience.

You may manage your cookie preferences at any time through the Cookie Preference Centre available on our website. You may also disable cookies via your browser settings; however, please note that doing so may affect the functionality of certain parts of the website.

5. Sharing of Personal Data with Third Parties

We may share your personal data with the third parties listed below, strictly for the purposes stated and within the limits imposed by applicable law. Your personal data is never sold, rented, or commercially transferred to third parties outside these categories.

5.1 Delivery and Logistics Providers

In order to fulfil and deliver your order, we share necessary information — such as your name, delivery address, and telephone number — with the relevant courier or logistics company.

5.2 Payment Service Providers

Payments are processed through third-party payment service providers operating a secure payment infrastructure. Sensitive payment data, including card details, is processed and stored on the systems of those providers and is not recorded by us.

5.3 Analytics and Marketing Platforms

Platforms such as Google Analytics and Meta (Facebook/Instagram) may receive anonymised or pseudonymised technical and behavioural data. Such sharing takes place only within the scope of the cookie consent you have provided.

5.4 Legal and Regulatory Authorities

We may disclose personal data to competent courts, regulatory bodies, or public authorities where required to do so by law, court order, or other binding legal process.

5.5 Data Processors and Service Providers

Third-party vendors engaged for infrastructure, software, or support services act as data processors on our behalf. They are permitted to process your personal data only for specified purposes and under contractual obligations that include appropriate data protection commitments.

6. International Data Transfers

My Tiny Garden is based in Türkiye and sells globally. As a consequence of this business model, some personal data may be transferred to countries outside Türkiye and, where relevant, outside the EEA or the UK.

Such transfers may take place for purposes including order processing, payment and delivery management, and the provision of analytics services by overseas service providers. Any international transfer of personal data is carried out with appropriate safeguards in place, which may include:

Transfers to countries recognised as providing an adequate level of protection by the relevant supervisory authority (e.g., an adequacy decision under GDPR or a declaration by the Turkish Personal Data Protection Authority).
Where an adequacy decision is not in place, the use of appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent binding commitments under applicable law.
Your explicit consent, where required and appropriate.

You may request further information about the safeguards applied to international transfers by contacting us using the details set out in Section 12.

7. Retention Periods

We retain your personal data only for as long as is necessary for the purpose for which it was collected and as required by applicable law.

Order and invoice records: Retained for a minimum of 10 years in accordance with applicable tax and commercial legislation.
Customer account data: Retained for the duration the account remains active and for a reasonable period following a request to delete the account.
Marketing data: Retained until consent is withdrawn; following withdrawal, removed from the relevant channels within a reasonable period not exceeding 3 months.
Technical log records: Retained for the periods prescribed by applicable law governing electronic communications and internet activity.
Cookie and analytics data: Retention varies according to the platform's own retention policy and the scope of the consent provided.

Once the applicable retention period has expired, personal data is securely deleted, destroyed, or anonymised to the extent technically feasible.

8. Data Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, alteration, or destruction, in accordance with our obligations under the GDPR and applicable data protection law.

8.1 Technical Measures

Encryption of data in transit using SSL/TLS protocols.
Protection of payment data through a secure, PCI-DSS compliant payment infrastructure.
Firewalls and intrusion monitoring systems to guard against unauthorised access.
Access controls and authentication mechanisms.
Regular software updates and security patching.

8.2 Organisational Measures

Restricting access to personal data to authorised staff and service providers on a need-to-know basis.
Providing data protection awareness training to employees.
Entering into data processing agreements with processors that include appropriate confidentiality and security obligations.
In the event of a personal data breach, notifying the relevant supervisory authority and, where required, affected individuals within the timeframes prescribed by applicable law.

9. Your Rights as a Data Subject

Under the GDPR and equivalent applicable data protection law, you have the following rights in relation to your personal data:

Right of access: The right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data.
Right to rectification: The right to request correction of inaccurate or incomplete personal data.
Right to erasure ("right to be forgotten"): The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected or where other grounds apply.
Right to restriction of processing: The right to request that we limit the processing of your personal data in certain circumstances.
Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.
Right to object: The right to object to processing based on legitimate interests or carried out for direct marketing purposes, including profiling.
Right to withdraw consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
Right not to be subject to automated decision-making: The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you.
Right to lodge a complaint: The right to lodge a complaint with the competent supervisory authority in your country of residence (e.g., the UK Information Commissioner's Office, or the relevant EU data protection authority).

To exercise any of these rights, please contact us using the details set out in Section 12. We will respond to your request without undue delay and, in any event, within one month of receipt (extendable by a further two months where necessary, with notice to you). We will not charge a fee for handling your request unless it is manifestly unfounded or excessive.

Please include sufficient information to allow us to verify your identity when submitting a request. This helps us ensure that personal data is not disclosed to any person who has no right to receive it.

10. Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children under 18. If you are a parent or legal guardian and become aware that a minor has provided us with personal data, please contact us immediately at info@mytinygarden.com.tr. Upon verification, we will promptly delete the relevant data from our systems.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in applicable law, our business operations, or technological developments. When we make material changes, the updated Policy will be published on our website with a revised effective date. Where changes are significant, we may also notify you by email to the address registered on your account.

We encourage you to review this Policy periodically. Your continued use of our website following the posting of changes constitutes your acknowledgement of the updated Policy.

Last updated: This date will be set as of the date of publication of this document.

12. Contact and Requests

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have any other privacy-related enquiry, please contact us through the following channels:

Company: STARTUP CREATIVE TEKNOLOJİ VE DANIŞMANLIK LİMİTED ŞİRKETİ (My Tiny Garden)
Address: Eğitim Mah. Poyraz Sok. No:1/68, Kadıköy, İstanbul, Türkiye
Email: info@mytinygarden.com

To help us handle your request efficiently and accurately, please include sufficient details to verify your identity and clearly describe the nature of your request. We are committed to responding within the timeframe prescribed by applicable data protection law.

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority competent for your place of residence or establishment.