KVKK notice

Turkish data protection law requires a service to say certain things in a certain order, whether or not anybody reads them. This is that page. The plainer version is on the privacy page, and the two say the same thing.

Privacy →

Not published yet · Who is behind this service has not been entered yet, so this page cannot name them. Until it does, treat it as a draft rather than as a notice you can rely on.

1. Who the controller is

The business behind this service has not been published yet.

This is the controller for the accounts of the florists who use PetalDesk.

For a flower shop's own customers it is the other way round. The shop is the controller of its customers' details; we are the processor, holding them on the shop's instruction and doing nothing else with them. If you are a customer of a flower shop, your request goes to that shop.

2. What is processed

Identity and contact: the name, e-mail address and telephone number of the person who opens a shop and of the staff they invite.
Account security: the password, held only in scrambled form, and the record of signed-in sessions.
Business records: the shop's own customers, orders, recipients, card messages, suppliers, products, photographs, payments and cash book.
Payment: what was paid for the subscription, when, and by which method. Card numbers are never processed here; they go to the payment provider.
Technical records: the address a browser connects from and the page requested, in short-lived server logs.

3. Why

To open and run the shop you asked for
To let you sign in, and to keep someone else out
To take payment for the subscription and keep the records a business must keep
To answer you when you write to us
To keep the service standing up and to find out what went wrong when it does not

4. On what legal basis

Mostly because it is necessary for the agreement between us — you cannot have a shop without an account, and the account is the data. Keeping payment records is a legal obligation. Keeping the service secure and working rests on a legitimate interest, weighed against the fact that it needs very little about you.

Nothing here rests on consent, because nothing here is optional extra processing. There is no marketing profile, no advertising and no sharing to build one.

5. Who it is transferred to

Not to anyone, except where you switch something on yourself:

The payment provider you choose, so it can take the money
The mail server you enter, if you switch on notifications to your customers
The company that provides the server, as part of holding the disk
A court or authority, where a lawful order requires it

It is not sold, rented or shared for advertising. There is nobody we would sell it to and nothing we would gain.

6. How it is collected

Entirely through this website, from what you type into it. Nothing is bought from a data broker, nothing is scraped and nothing arrives from anywhere else.

7. How long it is kept

While the shop exists. Payment records are kept for as long as the law requires them, which is longer. Server logs are short-lived. Ask for the shop to be deleted and everything in it goes, photographs included; the backup taken before the last update holds a copy until it is rotated out.

8. Your rights

Turkish law gives you the right to ask whether your data is processed, to be told what and why, to learn who it has been transferred to, to have mistakes corrected, to have it deleted, to have those corrections passed on, to object to a conclusion drawn only by a machine, and to claim for damage.

Nothing here draws conclusions by machine. There is no scoring, no profiling and no automatic decision about anyone.

An address to write to has not been published yet.

This page exists in every language the site speaks. The translations are provided so that it can be read; where they differ, the Turkish text is the one that applies.

Still want to try it?

Sign up, add a few products, and put a real order through. If it does not save you time, walk away — there is nothing to cancel.

Start your 14-day free trial