Privacy Notice for Platform Users

1. Controller and Contact

For personal data relating to Intsell platform users, the controller is Yılmaz Kok, the provider of Intsell ("Intsell"). Questions and data-subject requests may be sent to info@intsell.co.uk.

For an optional customer name or note entered by a store into a selection, the relevant store is the controller and Intsell processes that data on the store's documented instructions as processor.

2. Scope and Data Subjects

This notice applies to store owners and staff who use Intsell through Shopify Admin, and to people who contact Intsell about support or security.

Customers do not create an Intsell account and there is no required field for a customer's email address or telephone number. Processing of optional customer labels or notes is addressed separately under the Store's controller responsibility.

3. Personal Data We Process

Identity and authorization data: Shopify store and user identifiers, name and business email where Shopify provides them, store name, installation state, granted scopes, and access records. Transaction data: Shopify product and variant references, selection content, publication, QR, cart, and service events. Security data: identity claims verified from short-lived session tokens, webhook identifiers, and technical logs.

Intsell does not create or retain a separate password; staff access is managed by Shopify. Special-category data, card data, identity numbers, and unnecessary contact details must not be entered into free-text fields.

4. Purposes and Legal Bases

Personal data is processed to verify the Shopify installation, manage store and staff access, provide the selection and cart service, respond to requests, secure the platform, prevent abuse, and monitor service continuity.

Depending on the processing activity, the legal bases are steps requested before entering into a contract or performance of a contract, compliance with legal obligations, establishment or exercise of legal claims, and legitimate interests that do not override the rights and freedoms of the data subject. Intsell does not seek marketing consent and does not send promotional communications.

5. Collection Methods

Data is collected electronically through Shopify app installation, Shopify session identity and APIs, actions performed in Intsell, support correspondence, webhooks, security records, and technical records generated by service providers.

6. Recipients and International Transfers

Where necessary to provide the service, data may be disclosed to Shopify, Vercel for hosting and server functions, and Supabase for PostgreSQL database services. Data is disclosed to public authorities only where required by law or a valid binding request.

These providers may operate infrastructure or support services outside Turkey. International transfers are limited to what is necessary to provide the service and are managed with regard to KVKK Article 9 and, where applicable, GDPR Chapter V. Current providers are listed on the Subprocessors page.

7. Retention

Shopify installation and staff-identity records remain while the installation is active; security and abuse records for up to 90 days; and contractual or legal records for the applicable retention period. Optional customer labels or notes in expired selections are purged after 30 days. Store data is deleted within applicable Shopify and legal deadlines after a verified shop-redaction request.

When a retention period ends, data is deleted, destroyed, or anonymized subject to applicable technical and legal obligations. Further details appear in the Retention and Store Deletion Policy.

8. Rights and Requests

Subject to applicable KVKK and GDPR provisions, you may request confirmation and access, correction, deletion, restriction, information about recipients, objection to certain processing, data portability where applicable, and review of a decision based solely on automated processing. You may also seek compensation where unlawful processing causes damage.

A request should state your name, the relevant Shopify store domain, the scope of the request, and sufficient information to verify identity or store authority. Requests may be sent to info@intsell.co.uk. Intsell responds within the period required by applicable law, normally no later than 30 days under KVKK or one month under GDPR.

9. Updates

This notice may be updated when processing activities or applicable law change. Material changes are communicated through an appropriate channel before taking effect; the current version and effective date are published on this page.