1. Data Controller
This Privacy Notice is issued by Denim Moon Tekstil İthalat ve İhracat Sanayi Ticaret Limited Şirketi as data controller under Article 10 of the Turkish Law No. 6698 on the Protection of Personal Data and, for individuals located in the European Union or the United Kingdom, under Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the UK GDPR.
- Company Name: Denim Moon Tekstil İthalat ve İhracat Sanayi Ticaret Limited Şirketi
- Central Registry (MERSİS) No: 0291196456700001
- Trade Registry: Istanbul Trade Registry, Registration No 486908-5
- Tax Office / Tax No: Atışalanı / 2911964567
- Address: Oruçreis Mahallesi, Giyimkent 10. Sokak, Giyimkent B108 Blok, No: 36 A, Esenler / Istanbul, Türkiye
- Telephone: +90 212 438 72 37
- E-mail: contact@denimmoon.com
- Registered Electronic Mail (KEP): denimmoontekstil@hs01.kep.tr
- Website: denimmoon.com
- Authorised Representative / Contact Person: Yılmaz Beytaş
2. Scope
This notice explains how we process the personal data of individuals who visit denimmoon.com, use the forms on the site, create an individual or corporate membership, submit a quotation request, submit a review, apply for a position, or contact us by e-mail, telephone or at trade fairs. It sets out the purposes and legal bases of processing, the recipients of the data, how the data is collected, how long it is kept, and the rights available to you.
No direct sales are made and no payments are collected through our website. The "Quotation List" and "Request a Quote" functions only transmit a quotation request; a commercial relationship is established outside the website upon your acceptance of the final quotation sent to you.
3. Personal Data Processed, Purposes and Legal Bases
| Process | Data Processed | Purposes | Legal Basis (Law No. 6698 / GDPR) |
|---|
| Website visit | IP address, browser and device information, date and time of visit, pages viewed, language preference | Operating and securing the website, keeping statutory traffic records | Law No. 6698 Art. 5/2-ç: legal obligation of the controller (Law No. 5651); Art. 5/2-f: legitimate interest. GDPR Art. 6(1)(c) and 6(1)(f) |
| Contact, meeting request and production partnership forms | Full name, position, telephone, e-mail, company name, city, country, company profile, subject and message content, uploaded files | Routing the request to the responsible unit, responding, scheduling a meeting, pre-contractual assessment | Law No. 6698 Art. 5/2-c: directly related to the conclusion or performance of a contract; Art. 5/2-f: legitimate interest. GDPR Art. 6(1)(b) and 6(1)(f) |
| Individual and corporate membership | Full name, e-mail, telephone, password (stored in encrypted form); for corporate membership, company name, tax office and number, invoicing details, authorised person details | Creating and managing the membership account, authentication, account security | Law No. 6698 Art. 5/2-c: conclusion or performance of a contract. GDPR Art. 6(1)(b) |
| Quotation request | Products added to the quotation list, quantities, regional fit, size and length selections, request notes, contact details | Receiving and assessing the quotation request, preparing and sending the quotation, recording the quotation process | Law No. 6698 Art. 5/2-c: steps taken at your request prior to a contract; Art. 5/2-e: establishment, exercise or protection of a right. GDPR Art. 6(1)(b) |
| Social sign-in (Google, Facebook) | Full name, e-mail and account identifier transmitted by the provider | Facilitating membership login and authentication | Law No. 6698 Art. 5/2-c; GDPR Art. 6(1)(b). The provider's own processing is governed by the provider's privacy policy. |
| Commercial electronic messages | Full name, e-mail, telephone, date and channel of consent | Sending information on products, services and campaigns | Law No. 6698 Art. 5/1: explicit consent, obtained separately through the Commercial Electronic Message Consent; for merchant recipients, consent is not required under Law No. 6563 and the right to opt out is reserved. GDPR Art. 6(1)(a) |
| Customer and supplier reviews | Full name, position, company name, duration of cooperation, ratings and review text | Collecting feedback and measuring service quality; where consent is given, publishing the review on the website under the signature "Full Name, Position - Company" | Law No. 6698 Art. 5/2-f: legitimate interest (collection); Art. 5/1: explicit consent (publication). GDPR Art. 6(1)(f) and 6(1)(a) |
| Job applications and talent pool | Full name, contact details, city and country, LinkedIn address, CV, languages and levels, industry experience, last employer and title, application statement | Assessing applications for open positions; where consent is given, keeping the application in the talent pool for future positions | Law No. 6698 Art. 5/2-c: steps taken at your request prior to a contract (assessment); Art. 5/1: explicit consent (talent pool). GDPR Art. 6(1)(b) and 6(1)(a) |
| Design, sample and company presentation files | Personal data contained in uploaded briefs, technical files, images and presentation documents | Assessing the request and preparing a sample or production quotation | Law No. 6698 Art. 5/2-c: steps taken at your request prior to a contract. GDPR Art. 6(1)(b) |
| Data subject requests | Full name, contact details, content of the request, information required to verify identity | Receiving, assessing and concluding the request within the statutory period | Law No. 6698 Art. 5/2-ç: legal obligation of the controller. GDPR Art. 6(1)(c) |
No credit card, bank account or other payment data is collected or processed through our website.
Providing the data marked as required in our forms is necessary to respond to your request or to create your membership; without it we cannot process the request or open the account. Providing consent for commercial electronic messages, review publication or the talent pool is voluntary and is never a condition for our services. We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.
4. How Personal Data Is Collected
Your personal data is collected by fully or partly automated means through the forms on the website, the membership and quotation request screens, social sign-in, cookies and server logs, and by non-automated means through e-mail, telephone, trade fair meetings and written correspondence, and is processed as part of our data filing system.
5. Recipients of Personal Data and International Transfers
Your personal data is shared only for the purposes below and in accordance with Articles 8 and 9 of Law No. 6698 and Chapter V of the GDPR:
- Hosting and infrastructure providers: Our website and database are hosted on Amazon Web Services. As the data centres of this infrastructure are located outside Türkiye, your data is transferred abroad under the appropriate safeguards required by Article 9 of Law No. 6698. Transfers from the European Union or the United Kingdom to Türkiye are made under standard contractual clauses or equivalent safeguards; a copy of the applicable safeguards can be requested at contact@denimmoon.com.
- E-mail and communication service providers: For the delivery of form notifications, automatic replies and, where you have given consent, commercial electronic messages.
- Authentication providers: Google and Facebook, where you choose to sign in with these accounts, for the purpose of completing the login.
- Competent public authorities: Where required by law and for the fulfilment of our legal obligations.
- Legal, accounting and audit service providers: For the protection of our legal rights and the fulfilment of our legal obligations.
- Business partners and suppliers: After acceptance of a quotation, limited to the information necessary for production, sampling and shipment.
- Analytics and marketing service providers: Only where you have consented to the relevant category in your cookie preferences; details are set out in the Cookie Policy.
6. Retention Periods
Your personal data is kept for as long as the purpose of processing requires and until the retention and limitation periods provided by applicable law have expired; it is then deleted, destroyed or anonymised.
| Data Category | Retention Period or Criterion |
|---|
| Cookie consent records | 365 days; consent is requested again at the end of this period |
| Commercial electronic message consent and opt-out records | 3 years from the date the consent ends (Regulation on Commercial Communication and Commercial Electronic Messages) |
| Talent pool applications | 24 months from the date of consent |
| Membership account records | For the duration of the membership and for 10 years after it ends |
| Quotation request and quotation records | 10 years from the date the quotation request is submitted |
| Form submissions and correspondence | 10 years from the date of submission |
| Website traffic records | For the period provided by Law No. 5651 and the related regulation |
7. Your Rights
Under Article 11 of Law No. 6698 you have the right to apply to the data controller to:
- Learn whether your personal data is processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing and whether the data is used in line with that purpose,
- Know the third parties to whom your personal data is transferred, in Türkiye or abroad,
- Request the rectification of incomplete or inaccurate personal data,
- Request the erasure or destruction of your personal data under the conditions set out in Article 7 of the Law,
- Request that rectification, erasure and destruction be notified to the third parties to whom the data has been transferred,
- Object to a result arising against you from the analysis of processed data exclusively by automated systems,
- Claim compensation for damage suffered as a result of unlawful processing of your personal data.
If you are located in the European Union or the United Kingdom, you additionally have the rights of access, rectification, erasure, restriction of processing, data portability and objection under Articles 15 to 21 of the GDPR, the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal, and the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement.
8. How to Exercise Your Rights
You may submit your requests through the following channels in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
- E-mail: to contact@denimmoon.com, from the e-mail address registered in our system or with a secure electronic signature
- Registered Electronic Mail (KEP): by registered electronic mail to denimmoontekstil@hs01.kep.tr
- Written application: to Oruçreis Mahallesi, Giyimkent 10. Sokak, Giyimkent B108 Blok, No: 36 A, Esenler / Istanbul, Türkiye, in person or through a notary, together with documents verifying your identity
Your application must include your full name, your signature if the application is in writing, your Turkish identity number or, for foreign nationals, your nationality and passport or identity number, your address for notification, your e-mail or telephone for communication, and the subject of your request. Applications are concluded free of charge as soon as possible and within 30 days at the latest; where the request requires an additional cost, the fee set by the Personal Data Protection Board may be applied. Requests from individuals in the European Union or the United Kingdom are answered within one month, which may be extended by two further months where necessary.
9. Data Security
To prevent unlawful processing of and access to your personal data and to ensure its safekeeping, we apply the technical and organisational measures required by Article 12 of Law No. 6698 and Article 32 of the GDPR, including encrypted connections (SSL/TLS), encrypted password storage, authorisation and access controls, logging, regular backups and confidentiality obligations for our staff.
10. Cookies
The cookies used on our website, their categories, purposes and durations, and how you can manage your preferences are explained in the Cookie Policy. Cookies other than strictly necessary cookies are set only with your explicit consent.
11. Updates
This Privacy Notice may be updated as a result of changes in legislation or in our processing activities. The current version is always published on this page; material changes are additionally notified to our members.
Effective Date: 13.09.2026 · Version: 1.0
