Privacy Policy

1. Data Controller

This Privacy Policy and KVKK Disclosure Notice has been prepared regarding the personal data processed within the scope of the ihashop.com website, customer panel, purchasing screens, support channels, and IHASHOP E-Commerce Software services operated by İha Bilişim Danışmanlık San. Tic. LTD. ŞTİ.

Data Controller Information

Company Name: İha Bilişim Danışmanlık San. Tic. LTD. ŞTİ.
Tax Office: Topçumeydanı
Tax Number: 6260579774
MERSIS Number: 0626057977400001
Address: Atakent Mh. 6213 Sk. No: 2/10 Karaköprü/Şanlıurfa, Türkiye
Telephone: 0850 885 2004
Email: [email protected]

2. Personal Data Processed

When you create an account, request a quotation, complete a purchase, use the customer panel, submit a support request, or contact us through ihashop.com, the following categories of personal data may be processed:

Identity information: first name, last name, company name, tax number, tax office, and MERSIS information
Contact information: email address, telephone number, billing address, and delivery or installation address
Customer transaction information: order details, subscription information, licence information, invoice information, and payment status
Technical data: IP address, transaction logs, device and browser information, session records, and security records
Support data: support requests, correspondence, screenshots, and error records
Domain and installation data: domain name, store URL, hosting or installation preference, and licence verification information
Marketing permissions: consent for commercial electronic communications and campaign preferences
Payment transaction data: payment amount, payment date, and payment provider transaction number. Your credit card information is not stored by İha Bilişim and is processed by the payment infrastructure provider.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

Creating and managing your membership account
Providing IHASHOP E-Commerce Software, premium themes, optional modules, digital licences, and related services
Conducting purchasing, payment, invoicing, and subscription processes
Performing licence verification, software activation, domain and store matching, and security checks
Allowing services to be viewed and managed through the customer panel
Receiving, responding to, and resolving support requests
Fulfilling statutory bookkeeping, invoicing, accounting, and tax obligations
Managing contractual processes
Improving service quality and conducting security and abuse prevention checks
Sending campaigns, announcements, and commercial electronic communications where you have provided explicit consent

4. Legal Grounds for Processing Personal Data

Your personal data is processed under Law No. 6698 on the Protection of Personal Data based on the following legal grounds:

Processing is necessary for the establishment or performance of a contract
Processing is necessary for the data controller to fulfil its legal obligations
Processing is necessary for the establishment, exercise, or protection of a right
Processing is necessary for our legitimate interests, provided that it does not prejudice the fundamental rights and freedoms of the data subject
Processing is expressly provided for by law
Your explicit consent has been obtained where required

5. Transfer of Personal Data

Your personal data may be shared, only to the extent necessary for the provision of services, with the following persons and organisations:

Payment infrastructure providers
Accounting and financial consultancy service providers
E-invoice and e-archive service providers
Hosting, server, email, SMS, and notification service providers
Domain registration and transfer service providers
Software, security, logging, and support infrastructure providers
Authorised public institutions and organisations
Courts, enforcement offices, and other legally authorised authorities
Legal advisers and auditors

Your personal data will not be shared with third parties for purposes other than those stated unless you have provided explicit consent or another legal ground specified under applicable legislation exists.

6. Retention Period

Your personal data is retained for as long as required by the purpose of processing and for the statutory retention periods prescribed under applicable legislation. Information classified as invoices, accounting records, contracts, payment records, or other legal records may be retained throughout the legally required periods.

When the retention period expires, your personal data is deleted, destroyed, or anonymised.

7. Data Security

İha Bilişim Danışmanlık San. Tic. LTD. ŞTİ. takes the necessary technical and administrative measures to prevent the unlawful processing, unauthorised access, loss, or destruction of personal data. The KVKK requires data controllers to prevent unlawful access to personal data and ensure that personal data is securely retained.

Within this scope, measures such as access controls, authorisation mechanisms, logging, secure connections, database security, backups, and system monitoring may be implemented.

8. Use of Google User Data

IHASHOP E-Commerce provides you with the option to connect your Google account in order to send your store’s products to Google Merchant Center. This connection is entirely optional and is established only with your explicit authorisation.

Data We Access

When you connect your Google account, we request only the following authorisation scope:

https://www.googleapis.com/auth/content — Google Content API for Shopping

This scope provides us with access only to your Merchant Center account identifier and the product records associated with that account. We do not access or request permission to access your personal data contained in Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service.

How We Use the Data

We use this access solely to send the products in your store to your Google Merchant Center account on your behalf and to keep those products up to date.

The product information that may be transferred includes:

Product title
Product description
Price
Stock and availability status
Product image
GTIN or MPN information
Product category

Access obtained through your Google account is not used for any other purpose.

Data Storage and Protection

The refresh token provided by Google is stored in encrypted form on our servers.
The refresh token is used solely to perform Google Merchant Center operations on your behalf.
Access tokens are short-lived and are not stored permanently.
Your Merchant Center account identifier is retained together with your connection record.
When you disconnect the integration, Google access is revoked and the refresh token is no longer used.
The date and reason for revoking the connection may be retained for security and audit purposes.

Data Sharing

With respect to data obtained from Google, we:

Do not sell it.
Do not use it for advertising or profiling.
Do not transfer it to third parties for marketing purposes.
Do not process it for any purpose other than operating the integration.

Human access to this data may occur only where you explicitly request support or troubleshooting assistance and only to the extent necessary to provide that assistance.

Limited Use Disclosure

IHASHOP E-Commerce’s use and transfer to any other application of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy:

https://developers.google.com/terms/api-services-user-data-policy

Revoking Google Access

You may revoke your Google Merchant Center connection at any time using one of the following methods:

Disconnect the integration through the Google Merchant Center integration screen in your store panel.
Remove IHASHOP E-Commerce’s access through the application permissions section of your Google account.

Google Account Permissions:

https://myaccount.google.com/permissions

After the connection is revoked, IHASHOP E-Commerce can no longer access your Google Merchant Center account. Products previously submitted to Google Merchant Center may remain on Google’s systems and may be managed through your Merchant Center account.

9. Rights of the Data Subject

Under Article 11 of the KVKK, individuals whose personal data is processed have the right to:

Learn whether their personal data is being processed
Request information where their personal data has been processed
Learn the purpose for which their personal data is processed
Learn the third parties to whom their personal data has been transferred
Request the correction of incomplete or inaccurate personal data
Request the deletion or destruction of personal data where the applicable conditions are met
Object to an adverse outcome arising from the processing of personal data exclusively through automated systems
Request compensation for damages arising from the unlawful processing of personal data

You may contact us through the following communication channels to exercise these rights:

Email: [email protected]
Telephone: 0850 885 2004
Address: Atakent Mh. 6213 Sk. No: 2/10 Karaköprü/Şanlıurfa, Türkiye

Your applications will be concluded as soon as possible and within the applicable statutory period, depending on the nature of your request.

10. Cookies

Cookies may be used on ihashop.com to improve the user experience, ensure session security, measure website performance, and fulfil legal obligations.

Strictly necessary cookies are required for the website to function. Analytics and marketing cookies may be used subject to your consent where required under applicable legislation.

11. Amendments

İha Bilişim Danışmanlık San. Tic. LTD. ŞTİ. may amend this Privacy Policy and KVKK Disclosure Notice in response to changes in legislation, the scope of services, or operational requirements.

The updated text enters into force on the date it is published on ihashop.com.

Last Updated: 6 August 2026