Privacy Policy
This notice explains how Deniz Askeroğlu ("Gambú") processes your personal data on this website, under Turkish Personal Data Protection Law No. 6698 (KVKK).
Data controller
Deniz Askeroğlu ("Gambú") Address: Çekmece Mahallesi, 446. Sokak, No: 3, Defne, Hatay, Türkiye Email: info@thegambu.com Phone: +90 501 320 97 04
Data we process
Identity and contact: full name, email address, phone number. Delivery: country, city, district, full address. Orders: order history, amounts, payment method, payment status and payment reference, shipping status, return requests and their stated reason. Security: sign-in records, IP address. Support: the content of messages you send us. Reviews: the star rating, the review text and your account name at the time of writing. Reviews are public on the product page and the reviews page, with your account name shown beside them. When you submit a review, the IP address, source port, date and time, page address and browser string are recorded separately as traffic data, as required by Turkish Law No. 5651. Gift note: the note you write when you choose the gift option. We pass it on inside the parcel; if you name a third person, that information is held by us and travels with the parcel. Consent record: your cookie and AI choices, a random visitor identifier generated in your browser, your browser string and the date.
Purposes
Creating, preparing and delivering your order. Running payments and issuing documents where required. Answering support requests. Meeting record-keeping obligations under applicable legislation. Keeping the site secure and preventing abuse.
Legal basis
We process your data to enter into and perform a contract, to comply with legal obligations, and on the basis of legitimate interest. Marketing communication requires your separate explicit consent.
Who we share with
Carrier: to create the shipment we share your name, address, phone and email with our logistics provider Navlungo, which passes them to the carrier that physically transports the parcel. For international shipments the same details are also presented to the customs authority of the destination country for the customs declaration. Email: order confirmations, shipping notices and support replies are sent from the brand mailbox (Hostinger mail server); your email address and the message content pass through that server. Infrastructure providers: our hosting and database vendors. Backups are also stored, encrypted, on Cloudflare R2 (Europe) so that data is not lost if the server fails; we hold the encryption key and the provider cannot read the contents. Payment: if you pay by card, the transaction runs through iyzico. Your card number never reaches us — it goes directly to iyzico. We keep only a payment reference, the amount and the payment status. AI assistant: only after your separate explicit consent, the messages you type into the chat widget, your selected language and — so that suggestions can fit you — the names of the products in your cart and of products you previously bought are sent to Google (Gemini API). Your name, email address, phone number, delivery address, order number, dates and amounts are NOT sent to this service — only product names. Card and payment data are never sent; messages containing email, phone, address, card, ID or order information are technically blocked. Analytics: Google Analytics is disabled by default; no usage data is sent to Google while it remains unconfigured. Public authorities: where legally required.
Where your data is processed
The website and database are hosted in Türkiye, and our payment provider iyzico is also in Türkiye. The AI assistant is enabled only with your separate explicit consent. When enabled, the messages you type into it, your selected language and, for recommendations, the names of products in your cart and previously purchased are sent to Google (Gemini API) outside Türkiye to generate a reply. Google Analytics is disabled by default. Backups: so that data is not lost if the server fails, the database backup and product images are stored on Cloudflare R2 in the European region. Backups are encrypted with AES-256 before leaving the server and the decryption key stays with us; the provider cannot read the contents. Backups include your account and order data. You can withdraw the AI consent at any time from the chat window; after withdrawal, no new message is sent. If you order from the European Economic Area, note that your data is processed in Türkiye, which is outside the EEA.
Retention
Order and payment records are kept for as long as Turkish tax and consumer legislation requires. Account data is kept while your account is open; support conversations for 2 years after the request is closed. Traffic data for reviews is kept for 2 years, the upper limit set by Law No. 5651; it remains for that period even if the review is deleted and is disclosed only at the request of competent authorities. After these periods data is deleted or anonymised.
Cookies and similar technologies
Strictly necessary: keeping you signed in and remembering your language and currency. These need no consent. Your cart and currency choice are held in your browser's local storage and never sent to our server. Analytics: Google Analytics loads only if you allow analytics cookies in the banner, and only then is usage data sent to Google. Without consent no Google Analytics request is made at all. Marketing: no advertising cookies run without your consent. Consent record: for accountability we store your choice itself (analytics/marketing), a random visitor identifier generated in your browser, your browser string and the date. This record contains no IP address. You can change or withdraw your choice at any time via "Cookie settings" in the footer.
Your rights
You may ask whether we process your data, request information, correction or deletion, object to processing, and claim compensation for damages. Send requests to info@thegambu.com; we respond within 30 days.