Last updated:
This Privacy Policy explains how Origela ("Origela", "we") processes personal data when you visit https://origela.com/, sign up for Origela or use our Service as a store owner. It is written to meet the EU/UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK); for KVKK, this policy is also our information notice (aydınlatma metni) under article 10.
1. Our two roles
- Controller for account data. For the data described in this policy (website visitors, people who sign up, store owners and their staff as our customers, billing and support), the data controller is Origela, Türkiye. Contact for privacy questions: hello@origela.com.
- Processor for store data. For personal data of the customers of a store (buyers, newsletter subscribers, visitors of the store), the store owner is the controller and we only process that data on the store owner's behalf and instructions. That processing is governed by our Data Processing Agreement, and each store's own privacy notice informs its customers. If you are a customer of a store, please send requests about your data to that store; if you contact us, we forward your request to the store owner.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR / KVKK) |
|---|---|---|
| Signup details: store name, store domain, email, language, country | Creating your store and account, contacting you about it | Contract (Art. 6(1)(b) GDPR; KVKK art. 5(2)(c)) |
| Acceptance record: date and time, IP address, account email, version of the Terms and policies accepted | Proving the conclusion and content of the contract | Contract, legal obligation and the establishment or defence of legal claims (Art. 6(1)(b),(c),(f); KVKK art. 5(2)(c),(ç),(e)) |
| Billing data: name, company, address, tax office and tax or VAT number, amount, currency, payment reference, the name and account of the payer and the payment status as shown by the bank, Wise or the payment provider | Matching payments, invoices, accounting, refunds | Contract and legal obligation (Art. 6(1)(b),(c); KVKK art. 5(2)(c),(ç)) |
| Account and usage data: logins, IP address, security logs, support messages | Running and securing the Service, support, fraud prevention | Legitimate interest and legal obligation (Art. 6(1)(f),(c); KVKK art. 5(2)(ç),(f)) |
| Website visit data: IP address, browser, pages requested, kept in server logs | Security, abuse and rate limiting, error analysis | Legitimate interest (Art. 6(1)(f); KVKK art. 5(2)(f)) |
| Product emails about features, offers and surveys | Keeping you informed | Consent, which you can withdraw at any time (Art. 6(1)(a); KVKK art. 5(1), Law 6563) |
We do not receive your card number: subscriptions are paid by bank transfer, Wise or, where offered, an online payment provider, which processes card payments on its own pages. We do not sell personal data and do not use it for automated decisions with legal effects. This website uses Google Analytics to count visits and see which pages are used (legal basis: our legitimate interest in understanding and improving our website); the Cookie Policy lists the cookies, what Google collects and how to block it.
3. Who receives data
- Hosting and infrastructure providers — the servers, storage and backups that hold the Service data.
- Cloudflare — DNS, TLS, content delivery and protection of the website and stores against attacks.
- Email delivery provider — sending transactional emails such as login links, payment instructions and invoices.
- Banks, Wise and online payment providers (including authorised resellers selling in their own name) — receiving your payment, preventing fraud and making refunds. They act as independent controllers under their own terms.
- Accountants, tax advisers and lawyers — where needed for invoicing, tax and legal claims, under a duty of confidentiality.
- Google (Google Ireland Limited and Google LLC) — website usage statistics with Google Analytics; data may be processed in the United States.
- Courts and authorities, where we are legally obliged.
Providers that process store data on our behalf are listed as sub-processors in the Data Processing Agreement.
4. International transfers
Some providers process data outside your country, including outside Türkiye, the EU or the UK (for example the global network of our security and content delivery provider). Where this happens we rely on adequacy decisions, the EU Standard Contractual Clauses or, for transfers from Türkiye, the appropriate safeguards under article 9 of KVKK, such as the standard contract published by the Personal Data Protection Board, which is notified to the Board as the law requires. Where none of these is available, a transfer takes place only in the cases the law allows, for example where it is necessary to perform the contract with you.
5. How long we keep data
- Account and store data: for the duration of the subscription, then deleted 60 days after the subscription ends or the store is suspended, as described in the Terms, unless you ask for earlier deletion.
- Acceptance records and billing records: as long as tax and commercial law requires and until limitation periods for claims expire (typically 10 years).
- Server and security logs: up to 12 months, unless needed longer to investigate an incident.
- Signups that are not completed: up to 90 days.
6. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time. Under KVKK article 11 you can also learn whether your data is processed, the purpose, and the third parties in Türkiye or abroad it is transferred to, object to a result against you arising solely from automated analysis, and request compensation for damage caused by unlawful processing.
Send requests to hello@origela.com. We answer within 30 days. You also have the right to complain to a supervisory authority: in Türkiye the Personal Data Protection Board (KVKK Kurulu), in the EU or UK the authority of your country of residence.
7. Security and breaches
We take reasonable technical and organisational measures to protect data; these include, for example, encryption in transit, separate databases per store, access control with two-factor authentication, encrypted secrets, security headers and protection against attacks; see section 10 of the Terms of Service. No system is completely secure, and we cannot guarantee that data will never be lost or accessed without authorisation. If a personal data breach affects data for which we are the controller, we notify the competent authority and, where required, the affected people, within the time limits the law sets (under KVKK and GDPR generally within 72 hours of becoming aware of it). For store data we inform the store owner without undue delay, as set out in the Data Processing Agreement.
8. Children
The Service is meant for businesses. We do not knowingly collect data from children under 16.
9. Changes
We update this policy when our processing changes. The date at the top shows the latest version; material changes are announced by email.