Privacy Notice

Your personal data is processed by BYC Otomotiv E-Ticaret İthalat ve İhracat Limited Şirketi ("BYC Performance" or "we") as the data controller. BYC Performance imports performance parts for cars and sells them online.

• Website: www.bycperformance.com
• Address: Fenerbahçe Mah, Iğrıp Sok, No: 13/1, Kadıköy / Istanbul, Türkiye
• Email: info@bycperformance.com
• Phone and WhatsApp: +90 505 995 55 11

Depending on your relationship with us, we may process the following personal data:

• Identity: first name, last name; where needed for an individual invoice, your Turkish ID number.
• Contact: email address, phone number, delivery and billing address.
• Invoice details: for a company invoice, the company name, tax office and tax number.
• Customer transactions: order number and contents, your order note, purchase history, shipping and delivery details, return, exchange and warranty records, your quote requests and, when you share them with us, details of your car.
• Unfinished orders: when you open the card form at checkout, your order is saved. If you do not complete the payment, the details you entered and the items in your cart stay in that record.
• Payment: payment method and payment status; for card payments, the card brand and its last four digits. Your full card number never reaches us, and we do not store it. You enter your card details in our payment provider's secure card form or on its payment page.
• Account: the name, email and phone in your account, your saved addresses, the parts you add to your favorites, your marketing preference and your password in an irreversibly coded (hashed) form. If you sign in with your Google or Facebook account, we receive your name, email address and account ID from that service, and from Google also whether your email address is verified. We do not use or keep the profile photo link or other profile details Google sends. Your Google or Facebook password never reaches us.
• Transaction security: IP address, session data, sign-in attempts, security logs, browser and device information.
• Visit data: the page you visit, only the domain of the site you came from, a summary (hash) of your IP address and browser details that is created anew every day, and these general details kept with it: country and city (Cloudflare's estimate from the IP address), device type (phone, tablet or computer) and where the visit came from (Google, Instagram, Facebook, an ad, direct or other). We do not keep your IP address or your browser details.
• Messages: the messages and attachments you send us by email, WhatsApp, Instagram, Messenger or the contact form.
• Reviews: your review and its title, your rating, the name published with it (the name you type in the form or, if you leave it empty while signed in, the first name in your account) and the order your review is based on. If you ordered without an account, we match your review to your order with the personal review link in your delivery email, or with the order number and email address you type in the review form; we do not publish these.
• Homepage customer quotes: with your explicit consent, the quote we show on our homepage, your name, car and city, the order the quote is linked to and the record of your consent.
• Photos and videos: the photos you add to a product review, and the photos and videos you send with a return request, a warranty claim or a damaged-delivery report. We remove location and device details from photos uploaded to our website.
• Partner workshop applications: the business and contact details you share in the application form.
• Marketing: only with your explicit consent; data from analytics and marketing cookies and similar technologies, and your marketing message preferences. If you allowed analytics cookies, the ad or link that brought you to our website is also saved with your order: the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content and utm_term) and whether the ad you clicked was a Google or a Meta ad. This record does not include the ad's click ID.

• Taking your order, concluding and performing the distance sales agreement and meeting the obligation to give preliminary information.
• Sourcing and packing the products and delivering them through our partner couriers.
• Taking and verifying payment, and issuing invoices and other financial documents.
• Handling withdrawals, returns, exchanges and warranty claims, and preparing documents such as the warranty certificate and the user manual.
• Creating, managing and securing your account, and letting you sign in with your Google or Facebook account if you choose.
• Receiving and answering your questions, quote requests, other requests and complaints.
• Matching reviews to orders, so that only people who bought a product from us can review it, and sending you a personal review link in the delivery email.
• Reviewing the product reviews you send and publishing the approved ones on the product page, together with the photos you add if you give your explicit consent.
• Being able to prove our decision and its reason for reviews we do not publish.
• With your explicit consent, showing a quote from your review or message on our homepage, with your name, car and city.
• Assessing partner workshop applications, contacting the applicant and publishing the name, address and contact details of approved workshops on our Partner Workshops page.
• Counting visits with our own visitor counter. The counter makes a summary (hash) of your IP address and browser details that changes every day; it is not used to identify you and is not shared with anyone. While a page is open and on screen, your browser sends a short signal once a minute, so we can see how many visitors are on the site right now. This live list is deleted after 24 hours.
• Meeting the record keeping and reporting obligations of tax, commercial and consumer law.
• Keeping our systems secure and preventing fraud and unlawful transactions.
• Establishing, exercising and defending legal claims, and answering requests from the authorities.
• With your explicit consent: sending marketing messages, measuring how the website is used and how our advertising performs with measurement and advertising services such as Google and Meta, and showing you personalized ads.
• Sending you at most two reminder emails about an order you did not complete at checkout. They go out within 7 days after you leave the order and contain the items in your cart, the total, a link that opens your cart again and sometimes a discount code. On our European store we send them only if you have agreed to receive marketing messages. The reminders stop when you place your order or opt out with the link in the email.
• With your explicit consent, measuring which of our ads and campaigns bring orders, using the campaign details saved with orders.

Your personal data is processed on the following legal grounds under Article 5 of the KVKK:

• Being directly related to the conclusion or performance of a contract (Art. 5/2-c): orders, payments, delivery, returns (including return request photos), warranty, your account (including Google or Facebook sign-in), partner workshop applications and showing approved workshops on our page.
• Compliance with our legal obligations (Art. 5/2-ç): invoicing, keeping records, providing information to the authorities, reporting your marketing consents and refusals to the Turkish national consent register (İYS) and checking, by matching it to an order, that each review comes from a buyer.
• Being necessary to establish, exercise or protect a right (Art. 5/2-e): handling disputes and claims, and proving our decision and its reason for reviews we do not publish.
• Being necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f): information security, fraud prevention, customer service, sending the review link in the delivery email, publishing product reviews and the name published with them, counting visits with our own visitor counter, and sending reminder emails about orders not completed at checkout (on our Turkish and US stores).
• Your explicit consent (Art. 5/1): analytics and marketing cookies and similar technologies, marketing messages, publishing the photos you add to a product review, and showing a quote from your review or message on our homepage.

Your personal data is collected through the order, account, contact, review, return, newsletter and application forms on our website, from Google or Facebook when you sign in with your account there, through email, phone, WhatsApp, Instagram and Messenger conversations, and through cookies and similar technologies, by fully or partly automated means or by non-automated means as part of a data filing system.

Your personal data may be transferred to the following groups of recipients, only for the purposes in section 3 and in line with Articles 8 and 9 of the KVKK:

• Server, hosting and backup providers: to run the website, keep your account and order records, and store backups of those records.
• Content delivery and security provider: to deliver traffic to the website and protect it against attacks; your IP address, browser information and the address of the page you visit are processed for this.
• Email service provider: to send and receive order, shipping, password reset and support emails.
• Our payment provider and banks: the details needed to make and verify a card payment or to match a bank transfer.
• Partner couriers: your name, phone number, delivery address and shipment details, to deliver your order and carry returns.
• Accountants, bookkeeping and e-invoice service providers: invoice and order details, to issue invoices and keep the statutory records.
• Messaging services (such as WhatsApp, Instagram and Messenger): when we write to each other on these channels, the messages and your profile details are processed on their platforms.
• Notification service provider: to alert our team's phones about new orders, payments, quotes, applications and messages.
• Software and technical support providers: to run the store and support customers.
• Measurement and advertising providers: only with your explicit consent, to measure how the website is used and how our advertising performs, and to show you personalized ads. If you allowed analytics cookies, the order amount and products are also sent from our server to Google when you place an order. If you allowed marketing cookies, the order amount and products are also sent from our server to Meta, together with your email address, phone number and country in coded (hashed) form, your IP address, your browser details and the identifiers in Meta's cookies. See the Cookie Policy for details.
• İleti Yönetim Sistemi A.Ş. (İYS): your email address, the date of your consent, where you gave it and whether you consented or refused, so that your consent or refusal is recorded in İYS as Law No. 6563 requires. We do not send your name to İYS.
• Competent public authorities, courts and administrative bodies: to meet our legal obligations and protect our rights.

Transfers abroad

The services below are provided by companies established outside Türkiye, and your data is processed on their servers abroad:

• the content delivery and security service (Cloudflare): every request to the website,
• the messaging services (Meta: WhatsApp, Instagram and Messenger): our messages with you on these channels,
• the notification service (Google Firebase): alerts sent to our team's phones,
• our email service: the emails we send you and receive from you,
• the storage service we use for backups: encrypted backup copies of our records,
• software and technical support services: the details a task needs,
• the measurement and advertising services that run only with your explicit consent (Google, Meta and, where used, Cloudflare Web Analytics),
• for orders shipped abroad, the courier network that delivers the parcel in the destination country: your name, address, phone number and shipment details.

For card payments, your payment details are processed on our payment provider's servers in Germany.

To learn more about a transfer, apply to us through the channels in section 10.

We keep your personal data only as long as the purpose of processing requires and for the periods set by law. The main periods are:

• Orders, quotes, invoices, the texts you read and accepted when ordering, return requests and the correspondence about them: 10 years (Turkish Commercial Code Art. 82 and Law No. 6563 Art. 11/3). We count the period from the end of the calendar year of the transaction.
• Account details and favorites: until you ask us to close your account. When we close it, we delete your account details, addresses, favorites and linked Google or Facebook sign-ins; we keep your order and return records for the period above.
• Messages not related to an order or quote: 2 years after the last message; spam 30 days.
• Return request photos: deleted 2 years after the request is closed. The request itself is kept with the order record.
• Published reviews and their photos: as long as the review is published. If you withdraw your consent to publishing the photos, we remove them.
• Reviews we do not publish and their photos: kept for 2 years from our decision, so that we can prove the decision and its reason, and then the review and its photos are deleted together.
• Customer quotes shown on our homepage: until you withdraw your consent. When you withdraw it, we remove the quote from the homepage.
• Cookie choices and consent records: the periods in the Cookie Policy (your cookie choice 12 months, consent records 24 months).
• Identifiers added to your order for ad measurement (IP address, browser details, ad cookie IDs): 8 days at most.
• Campaign details saved with your order: 2 years.
• Visit counter records: 12 months.
• Your marketing consent and opt-out record: 3 years after your consent ends (Turkish Regulation on Commercial Communication and Commercial Electronic Messages, Art. 13(2)).
• Records of the marketing messages we send you (including cart reminders): 3 years from sending (Turkish Regulation on Commercial Communication and Commercial Electronic Messages, Art. 13(2)).
• Backups: deleted data stays in our backup copies for at most 70 more days and is then removed automatically with them.

Processing based on your explicit consent lasts until you withdraw it. When the period ends, we delete, destroy or anonymize your data.

Apart from the cookies the website needs to work, analytics and marketing cookies run only with your explicit consent. You can change your choice or withdraw your consent at any time with the "Cookie settings" link at the bottom of every page. For details, please see our Cookie Policy.

You can withdraw your consent to marketing messages at any time under Contact preferences on your My Account page or with the link in the emails we send you. You can also withdraw it through İYS.

By applying to us, you have the right to:

• learn whether your personal data is processed,
• request information if your personal data has been processed,
• learn the purpose of processing and whether your data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom your personal data is transferred,
• request the correction of your personal data if it is incomplete or inaccurate,
• request the deletion or destruction of your personal data under the conditions of Article 7 of the KVKK,
• request that corrections, deletions and destructions be notified to the third parties to whom your data was transferred,
• object to a result against you that arises from the analysis of your data exclusively by automated systems,
• claim compensation if you suffer damage because your personal data was processed unlawfully.

To exercise your rights, you can send your application in line with the Communiqué on the Procedures and Principles of Application to the Data Controller in one of these ways:

• In writing: by handing in your application, signed by hand, at Fenerbahçe Mah, Iğrıp Sok, No: 13/1, Kadıköy / Istanbul, Türkiye, or by sending it there by post or through a notary,
• Electronically: by sending your application to info@bycperformance.com, signed with a secure electronic or mobile signature, or from the email address you gave us before and that is registered in our system.

Your application should include your first name, last name, your signature for written applications, your Turkish ID number (for foreign nationals, your nationality and passport or ID number), your address for notifications, your email address and phone number if any, and the subject of your request.

We will conclude your application free of charge as soon as possible depending on its nature, and within 30 days at the latest. We always send our answer in writing or by email, with reasons for any request we do not meet. If the process involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find our answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application.

If you live in the European Union, section 12 applies instead: an email from the address you use with us is enough, and we ask for proof of identity only if we have reasonable doubts.

We may update this notice when the law or our data processing changes. The current version is published on this page, and the version you confirmed you had read when placing your order is kept with your order records. If a change is important, we also show a notice on the website or email account holders before it applies.

When we sell to customers in the European Union, the EU General Data Protection Regulation (GDPR) applies to us as well as the KVKK.

• Controller: BYC Otomotiv E-Ticaret İthalat ve İhracat Limited Şirketi (BYC Performance), with the contact details in section 1.
• Legal bases (Article 6(1) GDPR): performing our contract with you, or steps you ask for before it, for orders, payment, delivery, returns, warranty and your account, including Google or Facebook sign-in (point b); a duty under the law of the EU or an EU country that applies to us, such as customs or VAT records for a delivery into the EU (point c); our legitimate interests (point f) in keeping the records that Turkish commercial and tax law requires of us, recording marketing consents in İYS as Turkish law requires and answering Turkish authorities, keeping the website secure, preventing fraud, answering your questions, publishing product reviews with the name you choose, keeping reviews we do not publish and their photos for 2 years to show that our decision was fair, counting visits with our cookie-free counter and defending legal claims; your consent (point a) for analytics and marketing cookies and tags, marketing emails, publishing the photos you add to a review and showing your review or a quote from your message on our homepage.
• Recipients: the groups listed in section 6.
• Data outside the EU: we are established in Türkiye, and you give your data to us there. When we pass data to providers in other countries outside the EU, such as the United States, we rely on the European Commission's standard contractual clauses in those providers' own terms, where their terms include them. Some of these providers are also certified under the EU-US Data Privacy Framework. You can ask us for a copy of these safeguards.
• Meta and Google tags: when the Meta Pixel or the Google Ads tags run on our website with your consent, we and Meta or Google decide together on collecting this data and sending it to them, so we are joint controllers for that step only. What Meta and Google do with the data afterwards is their responsibility, under their own privacy policies. You can ask us for the main points of our arrangement with Meta and Google. For Google Analytics, Google processes the data on our behalf as our service provider.
• Retention: as in section 7.
• Your rights: you can ask us for access to your data, to correct it, to delete it, to restrict its use and to receive the data you gave us in a common format (portability). Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before. To use your rights, email info@bycperformance.com from the address you use with us. We ask for more proof of identity only if we have reasonable doubts, and we answer within one month.
• Your right to object: you can object at any time to our use of your data based on legitimate interests, and to direct marketing. Email info@bycperformance.com.
• Complaints: you can complain to the data protection authority of the EU country where you live or work, or where you think the problem happened.
• Required data: we need your name, email, phone number and delivery and billing addresses to take and deliver your order. Without them we cannot sell to you. Everything else is optional.
• Automated decisions: we do not make decisions about you based only on automated processing.

• What we collect and who receives it: section 2 lists the categories of personal information we collect, and section 6 the categories of third parties we share it with.
• Reviewing and changing your information: you can see and change your account details and contact preferences on your My Account page, or email us at info@bycperformance.com.
• Tracking across websites: if you allow it in Cookie settings, Google and Meta can collect information about your activity on our website and on other websites over time, for analytics and advertising.
• Do Not Track and Global Privacy Control: if your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of marketing cookies, unless you turn marketing on yourself in Cookie settings. We do not respond to the older Do Not Track browser setting, because there is no agreed standard for it. You can turn analytics and marketing off at any time in Cookie settings.
• Selling personal information: we do not sell your personal information for money. If you live in Nevada, you can send a request about the sale of your information to info@bycperformance.com.
• Changes and effective date: when we change this notice, we publish the new version on this page with the date it takes effect. The date at the top of this page is the date this version took effect. If a change is important, we also show a notice on the website or email account holders before it applies.