Privacy policy

Last updated: November 6, 2026

1. Who we are

Data controller: Damla Ayakkabı A.Ş. ("Sandela", "we"), İOSB Mah., Aykosan San. Sit., 7. Ada, 2. Kısım, A Blok, Başakşehir / İstanbul, Türkiye. For any question or request about your personal data: [email protected]

2. What we collect

• Order request form: your name, email, phone (optional), note and the items you chose (color, size, quantity).
• Wholesale form: company name, contact name, email, phone, country/city, estimated quantity and your message.
• Account: name, email, password (stored only as an irreversible hash), phone and address; a session cookie (sandela_sess) keeps you signed in.
• Newsletter: your email address.
• Technical data: IP address, browser and device information, pages visited; kept in server security logs.
• Cookies and browser storage: one cookie (sandela_lang) remembers your language. Items you add to an order request stay in your own browser's storage and are not sent to us until you submit the request. We use no advertising or tracking cookies.

3. Why we use it

• To review your order or wholesale request, contact you, prepare and deliver the order.
• To send the newsletter (only with your consent; you can unsubscribe from any email).
• To keep the site secure, prevent abuse and meet legal obligations.

Legal bases: performance of a contract or steps before entering one, our legitimate interests, legal obligations, and your consent for the newsletter (Turkish Personal Data Protection Law no. 6698 and, where applicable, the GDPR).

4. Who we share it with

Only as needed to provide the service: our email provider (request and confirmation emails), our hosting provider, the carrier that delivers your order, and authorities where the law requires. We never sell your data or pass it to third parties for advertising.

5. How long we keep it

Order and wholesale requests: up to 2 years after our last contact, or as long as commercial and tax law requires once an order is placed. Newsletter data: until you unsubscribe. Server logs: up to 90 days.

6. Your rights

You can ask whether we process your data, request a copy, ask for correction or deletion, object to processing and, where applicable, request portability or lodge a complaint with a supervisory authority. Write to [email protected]; we reply within 30 days.

7. Security

The site uses HTTPS. Form data is stored on systems that only authorised people can access, and submissions are protected against automated abuse by rate limits and bot checks.

8. Changes

When we update this policy we change the date above. Newsletter subscribers are informed of material changes.