Privacy policy
Last updated: 26 October 2026
Here we explain which of your information is processed when you browse the site, write to us, shop and work with us, why it is processed, who it is shared with, and what your rights are.
In short
- The site runs on Shopify: the pages, site chat, customer account, cart and checkout page are on Shopify. When you write to us through the chat or the contact form, your name, contact details and message reach us through Shopify.
- The cookies needed for the site to work are always on. Shopify's measurement and marketing cookies are set only if you allow them in the cookie panel. The list is below.
- If you have become a member, placed an order or started a subscription, Section B is for you.
- Your card details do not reach us. We do not sell your information; we do not send newsletters or campaign messages.
This page is the privacy notice prepared under Article 10 of KVKK (Turkish Personal Data Protection Law, Law No. 6698). Cookies and your rights are common to all sections. Version 26.10.2026.
1. Data controller
- Legal name
- Yiğit CENGİZ, sole proprietorship
- Tax office and number
- Şirinyer Vergi Dairesi (İzmir) · 2061110714
- Legal address
- Adalet Mah. Manas Bulvarı Folkart Towers B Kule No:39 Kat:25 Kapı No:2511, 35530 Bayraklı / İzmir
- Registered electronic mail (KEP) address
- yigit.cengiz@hs01.kep.tr
- ETBİS registration
- 3240921671 · See the Ministry of Trade record
- hello@wyvup.com
- KVKK applications
- kvkk@wyvup.com
- Phone
- 0545 510 84 75
Our legal address is a virtual office; our team works online. The fastest way to reach us for correspondence and applications is e-mail.
A. For everyone who browses the site and writes to us
What information do we receive, and how?
- When you browse the site. Shopify, which hosts the site, processes your IP address, browser information, the page you open and the time with each request; it serves the pages through its own infrastructure and content delivery network. The site's fonts load from Google Fonts, and the code libraries for page animations load from cdnjs and jsDelivr; these servers also see your browser's request and your IP address. These records are created automatically; they are necessary to show you the site and to block attacks.
- When you write through the site chat. The chat runs on Shopify Inbox. Your name, e-mail address and messages are kept in our Shopify account. Shopify's artificial intelligence assistant may give the first replies using the information on the site; our team sees the conversation and takes it over.
- When you write through the contact or preliminary meeting form. Your name, your e-mail address, your phone number and website if you entered them, the topic you selected and your message. Shopify's contact form forwards the message to our e-mail address.
- When you contact us by WhatsApp, e-mail or phone. Your phone number or e-mail address, your name and your message.
- When you request a free preliminary meeting. You send your request through the contact form, WhatsApp or e-mail; in addition to the information above, the day and time that suit you. We send you the meeting link by e-mail.
- In a job application. In addition to the above, your portfolio link and the CV you send.
- If you have allowed measurement and marketing cookies. For store statistics, Shopify writes a visitor ID to your browser and records the pages you open, the page or link you came from, and browser and device information. We see this information in aggregate in the reports in the Shopify admin panel. Today the site has no Google Analytics or advertising tags (Google Ads, Meta, TikTok); if any are added, they will load only with your permission and this notice will be updated.
- If you came through an advertising or sharing link. The source tag in the link (e.g. which ad you came from) is kept only in your browser, for as long as the tab stays open. If you write to us on WhatsApp, it appears as a short code at the end of the prefilled message; you can delete it before sending if you wish.
Why do we process it?
- To answer your question, prepare appointments and quotes, and let you know when a theme is released. Legal basis: it is directly related to the formation of a contract (KVKK Art. 5/2-c).
- To evaluate your job application. Legal basis: it is directly related to the formation of a working relationship (Art. 5/2-c). If you would like us to keep your application so that we can contact you in the future, we ask you about this separately; the basis for that is your explicit consent (Art. 5/1).
- To run the site securely. Legal basis: our legitimate interest, provided that it does not harm your fundamental rights and freedoms (Art. 5/2-f).
- To measure the site. To count which pages are read and where visitors come to the site from. Legal basis: your explicit consent (Art. 5/1), which you give through the cookie panel. To change your decision, you only need to delete this site's cookies from your browser; the panel will appear again.
How long do we keep it?
- Messages and appointment records that do not turn into work: deleted 2 years after the last correspondence.
- Correspondence that turns into work: as commercial correspondence, 10 years from the end of the year of the correspondence (Turkish Commercial Code Art. 82).
- Job applications: deleted within 6 months after the evaluation ends; 2 years if you have consented to our keeping them.
- Measurement data: in Shopify's store statistics, for the period set by Shopify. In the reports we see visitors in aggregate, not one by one.
B. Members, orders, subscriptions and appointments
This section also applies when you become a member of the site, place an order from the store, start a monthly service subscription, or receive a service from us based on a quote.
| Information | What for | Legal basis (KVKK Art. 5/2) | How long it is kept |
|---|---|---|---|
| Membership: name, e-mail, sign-in times (sign-in is through the Shopify customer account, with a one-time code sent to your e-mail; no password is kept). | To open your account and to enable you to sign in and see your orders, subscriptions and invoices in My Account. | Formation and performance of the contract (c). | For as long as your membership continues. If you want to close it, the membership is deleted; the records below remain for their own periods. |
| Order: products, amount, the billing information you give on the checkout page (name or company name, address, phone, e-mail; tax details for corporate customers). | To take the order, deliver it and issue an invoice. | Performance of the contract (c), legal obligation (ç). | 10 years from the end of the year in which the document was created. |
| Subscription: first name, last name, e-mail, mobile phone, city and address, the service and term you selected, confirmation checkboxes and the time of confirmation. | To start the subscription, collect the monthly payment, invoice, and prove your confirmation. | Formation and performance of the contract (c), legal obligation (ç), protection of a right (e). | 10 years after the subscription ends. |
| Payment: payment record, amount, card provider and the last 4 digits of the card. The card number does not reach us; it is entered on the checkout page. | To verify that the payment was received, refunds, accounting. | Performance of the contract (c), legal obligation (ç). | 10 years. |
| Quote, invoice and project content: the content and acceptance of the quote, the text, images and files you send, delivery records. | To do the work, deliver it, and prove what was delivered and when. | Performance of the contract (c), protection of a right (e). | 10 years from the completion of the work. |
| E-mails sent to you: order, payment, subscription, appointment and invoice notifications. | Information related to the work, and proof. They contain no promotional content. | Performance of the contract (c). | 10 years. |
| Reference permission: your answer, whether you gave permission or not. | If you gave permission, to show the work and your name in our portfolio. | Your explicit consent (Art. 5/1); you can withdraw it at any time. | Removed from the portfolio when permission is withdrawn; the permission record is kept for 10 years as proof. |
The matters for which we ask for explicit consent are measurement cookies and reference permission; both are asked separately and are optional. No decision is made about you, to your detriment, by an automated system.
Who do we share it with?
| Recipient | What for | Where |
|---|---|---|
| Shopify International Ltd. (Shopify Inc. group) | Hosting and serving the site; site chat (Shopify Inbox), contact form, customer account, cart, order, checkout page, invoice records and store statistics. | Company headquartered in Ireland; data centers in Canada, the US and the EU. |
| Google Fonts, cdnjs and jsDelivr | Sending the site's fonts and code libraries to your browser. Only your browser's request and your IP address. | Services of US-headquartered companies; servers in more than one country. |
| iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) | Card payment and subscription: name, e-mail, mobile phone, address, IP address, order or subscription information. Card details are entered in iyzico's payment form. iyzico also processes this information under its own privacy notice. | Türkiye. |
| Google (Workspace) | Corporate e-mail and its archive. | US-headquartered company; data centers in more than one country. |
| WhatsApp (Meta) | Your messages, when you choose to write on WhatsApp. | US-headquartered company. |
| The member of our team working abroad | Access to the Shopify panel and project files in order to carry out your work. | Indonesia. |
| Banks, accountant and e-invoice service provider | Bank transfers and EFT, accounting and official invoicing. | Türkiye. |
| Competent authorities | Only where the law makes it mandatory, and only to the extent requested. | Türkiye. |
The content of the work (text, images) may be processed in artificial intelligence tools during design; we do not enter your identity, contact or billing information into these tools.
Transfer abroad
The servers of the Shopify, Google, WhatsApp and code library services, and one member of our team, are abroad. Under Article 9 of KVKK, personal data may be transferred abroad on the basis of an adequacy decision of the Personal Data Protection Board, an appropriate safeguard such as a standard contract announced by the Board, or, for occasional transfers only, the exceptions in the law. For ongoing services we follow the standard contract route: we accept the standard contracts offered by providers and notify them to the Board, and we request them in writing from providers that do not offer them. Each contract is notified to the Board within 5 business days after it is signed. We keep the data transferred to a minimum. If you have questions, write to us.
C. Cookies and records kept in the browser
A cookie is a small record that a site leaves in your browser. The cookies needed for the site to work are always on. Measurement and marketing cookies are set only with your permission: when you first enter the site, Shopify's cookie panel appears; you accept, reject or choose your preferences one by one. To change your decision, delete this site's cookies from your browser; the panel will appear again.
| Name | What it does | Duration | Whose? Required? |
|---|---|---|---|
_shopify_essential |
Operation of the site, the cart, customer sign-in and security. | 1 year | Shopify's. Required. |
localization |
Remembers the country and language you selected. | 1 year | Shopify's. Required. |
_tracking_consent |
Remembers your choice in the cookie panel. | 1 year | Shopify's. Required. |
_shop_app_essential (shop.app) |
Operation of the quick sign-in and payment feature with Shop. | 1 year | Shopify's. Required. |
_shopify_analytics |
Store statistics: counting visits and telling when the same browser comes back. | 1 year | Shopify's. Optional: only with measurement permission. |
_shopify_marketing |
Measuring which link or campaign the visitor came from. | 1 year | Shopify's. Optional: only with marketing permission. |
The items below are not cookies; they sit in your browser's storage. Those marked "When the tab closes" are deleted automatically when you close the tab.
| Name | What it does | Duration |
|---|---|---|
Shopify session records (such as shopify-chat-…, wpm-…, consentHeader) |
Operation of the chat window and Shopify's page events. | When the tab closes |
signInWithShop:…, shopify:…
|
Operation of the sign-in with Shop feature. | Until you delete them |
wyv_perde |
Makes the page transition animation finish correctly on the new page. | When the tab closes |
wyv_kaynak |
The source tags in the link, if you came through an advertising or sharing link. They are not sent anywhere automatically. | When the tab closes |
wyv_onz_cihaz |
The device view you selected in the theme preview. | When the tab closes |
wyvup_vitrin_tema |
The theme you last looked at in the theme showcase. | Until you delete them |
g_dil, wyv_dil_oneri
|
Remembers that you closed the language suggestion ("This page is also in English") or selected a language. The suggestion appears according to your browser's language. | Until you delete them |
You can also delete or block cookies in your browser settings; if you block required cookies, the cart and member sign-in will not work.
2. Your rights
Under Article 11 of KVKK, you may request the following:
- To learn whether information about you is processed and, if it is, to request information about it,
- To learn the purpose for which it is processed and whether it is used in line with that purpose,
- To learn who it has been transferred to, in Türkiye or abroad,
- To have it corrected if it is incomplete or incorrect, and to have it deleted or destroyed if it is not needed,
- To have this correction and deletion also notified to the persons to whom we transferred your information,
- To object to an analysis carried out solely by automated systems producing a result against you,
- To have the damage compensated if you suffered damage because of unlawful processing.
How do you apply? Write to kvkk@wyvup.com with the subject "KVKK application". If you are a member, writing from the e-mail address registered to your membership makes it easier for us to verify your identity. You can also apply in writing to our registered electronic mail (KEP) address (yigit.cengiz@hs01.kep.tr) or to our legal address. We answer your application free of charge within 30 days at the latest. If you do not find our answer sufficient, you may file a complaint with the Personal Data Protection Board within 30 days from the date you received the answer; if you receive no answer at all, within 60 days from the date of your application.
To close your membership or get a copy of your information, write to the same address as well. The order, invoice and payment records that we are legally required to keep are deleted when the periods above expire.
3. Changes to this notice
If we add a new tool to the site or the way we process information changes, we update this page and change the version date. Previous versions are sent on request. Version in force: 26.10.2026. Turkish version: Gizlilik politikası.