Privacy Policy
This policy explains what personal data we collect when you order from eratoscare.com, why, who receives it and what rights you have under the General Data Protection Regulation (GDPR).
Who is responsible
The controller for your personal data is the seller named in the Legal Notice (a company in Istanbul, Türkiye). Our contact details, including our EU contact address in Amsterdam, are in the Legal Notice. You can contact us about your data at the e-mail address shown there.
What we collect and why
The site collects no personal data when you merely browse. Data is processed only when you place an order, contact us or subscribe to the newsletter.
| Data | Where it comes from | Purpose and legal basis (GDPR art. 6) |
|---|---|---|
| Name, delivery address, phone number, e-mail | Checkout form | To take, pay for, deliver and confirm your order and handle questions about it: performance of the contract (art. 6(1)(b)) |
| Order contents and personalisation text (name or symbol for engraving) | Basket and product page | To prepare and make your order: performance of the contract (art. 6(1)(b)). Engraving text is often a child’s name; it is used only to make the product and is not used for marketing. |
| Invoice, accounting and payment records | Order | Bookkeeping, tax and legal retention: legal obligation (art. 6(1)(c)) |
| IP address and device data sent with the payment | Your connection | Payment security and fraud prevention: our legitimate interest (art. 6(1)(f)) |
| Withdrawal, return and complaint correspondence | You | To handle your request: performance of the contract and legal obligation (art. 6(1)(b), (c)) |
| E-mail address (newsletter) | Newsletter form on the home page | Only if you consent: newsletter (art. 6(1)(a)). You can withdraw consent at any time; every newsletter has an unsubscribe link. |
Your order data is not used for profiling or automated decision-making. Your card details never reach us: they are entered on the payment provider’s own secure screen.
Who receives your data
We share personal data only with those who need it to fulfil your order, and only as much as they need:
- The seller itself (our company in Türkiye), which receives your order, prepares and ships it, and issues the invoice: name, delivery address, phone, e-mail, order contents, personalisation text.
- Payment provider PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (Türkiye): name, e-mail, phone, address, amount and IP address, to take the payment securely and prevent fraud.
- Carriers and customs: name, delivery address and phone, to deliver the parcel and clear it through customs.
- Hosting provider of this website and the order records.
We do not sell your data and do not share it for advertising.
Where your data is processed
Our company is established in Türkiye, which is outside the EU/EEA, and the European Commission has not issued an adequacy decision for Türkiye. The data you enter at checkout is collected directly by us and processed in Türkiye; we treat it in line with the GDPR, which applies to us when we offer goods to people in the EU. Our payment provider is also established in Türkiye.
How long we keep data
Order and invoice records are kept for the period required by Turkish accounting and tax law (currently five years) and then deleted or irreversibly anonymised. Correspondence is kept for as long as needed to handle your matter and for the legal limitation period. Your newsletter subscription is kept until you withdraw consent; we then keep only a suppression record so that you are not contacted again. Engraving text is kept only as part of the order record.
Your rights
Under the GDPR you have the right to access your data, have it rectified or erased, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To use these rights, contact us at the e-mail address in the Legal Notice; we respond within one month.
You also have the right to lodge a complaint with a supervisory authority, in particular in the member state where you live or work. In the Netherlands the authority is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Cookies and browser storage
The site does not use cookies for tracking, advertising or statistics. See the Cookie Policy.
Changes
We may update this policy; the current version is always on this page. Version: 18 October 2026.