Privacy policy
Last updated: October 16, 2026
This policy explains how we process your personal data when you use roadscraft.com and shop with us. It fulfils our information obligations under the EU General Data Protection Regulation (GDPR), Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK) and US state laws (including California's CalOPPA).
1. Data controller
ROADS CRAFT — operated by Remziye Öztürk
Gökalp Mahallesi, 36. Sokak No:21, Kat:5, Daire:9, Zeytinburnu, Istanbul, Türkiye
info@roadscraft.com · +90 553 889 01 09
2. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR / KVKK) | Retention |
|---|---|---|---|
| Name, address, email, phone, order contents, personalisation details (name/date for the lining, exterior lettering) | Taking, making and shipping the order, communication, returns and warranty | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) | 3 years after delivery (warranty period and possible claims) |
| Invoice and payment records (name, address, amount, date) | Retention obligation under Turkish tax and commercial law | GDPR: legitimate interest (Art. 6(1)(f)); KVKK: legal obligation (Art. 5(2)(ç)) | 10 years |
| Card details | Taking payment | Performance of a contract | We do not see or store card details; the payment provider processes them |
| Account details (if you created an account) | Order history, saved addresses | Performance of a contract | Until you delete your account |
| Custom Made form (name, email, phone, images you upload, description) | Preparing a quote, discussing the design | Pre-contractual steps (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) | 2 years if no order is placed; with the order records if one is |
| Support correspondence | Answering your questions, returns and warranty | Performance of a contract; legitimate interest | 3 years |
| Email newsletter | News about new collections and campaigns | Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) | Until you withdraw your consent |
| Device, IP and site usage data (strictly necessary cookies) | Running the site, security, fraud prevention | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) | Up to 12 months |
| Analytics and advertising cookies (Google, Meta, Pinterest) | Site statistics, ad measurement and targeting | Consent (cookie banner) | The periods stated in the Cookie Policy |
If you do not provide the data required for your order, we cannot take the order. Other data is optional. We do not make decisions about you based solely on automated processing that significantly affect you.
3. Who we share data with
We do not sell your data. We share it only with those needed to do the work:
- Shopify (store platform; Canada, USA, Ireland),
- payment providers,
- carriers and customs brokers (delivery details),
- Google, Meta (Facebook/Instagram) and Pinterest: only if you consented in the cookie banner,
- Shop (Shopify): If you continue at checkout with "Continue with Shop" or Shop Pay, Shopify processes the data related to that account under its own privacy policy, as an independent controller (shopify.com/legal/privacy).
- email delivery service (newsletter),
- our accountant,
- competent public authorities, where required by law.
4. International transfers
Your data is processed in Türkiye and transferred to other countries through the service providers above.
- For transfers from the EU, we rely on European Commission adequacy decisions (e.g. Canada) or Standard Contractual Clauses.
- For transfers from Türkiye, we rely on the safeguards in KVKK Art. 9: standard contracts notified to the Board or, where necessary, your explicit consent.
5. Your rights
Wherever you live, you can ask us to:
- access your data and receive a copy,
- correct it,
- delete it,
- restrict processing,
- object to processing,
- port it,
- withdraw your consent at any time,
- object to direct marketing at any time.
This includes all rights under KVKK Art. 11. Write to info@roadscraft.com with your request. We may need to verify your identity. We respond within 30 days at the latest.
Right to complain: You can complain
- to the data protection authority of your country, if you live in the EU,
- to the Personal Data Protection Board, in Türkiye,
- to your state Attorney General, in the US.
6. Additional information for US residents
- Categories of personal information we collect: Listed in the table above (contact, order, payment, device and usage information).
- Parties we share with: Listed in section 3.
- Sale and targeted advertising: We do not sell your data for money. Advertising cookies may count as "sharing" under some state laws. You can opt out of this through the "Do Not Sell or Share My Personal Information" link on the site or through the cookie banner.
- Global Privacy Control: If your browser sends this signal, we automatically treat it as an opt-out request. We do not respond differently to other "Do Not Track" signals.
- Seeing or correcting your data: Simply write to info@roadscraft.com. We will not treat you differently for exercising your rights.
- SMS: We do not send marketing SMS.
7. Children
Our site is not intended for anyone under 18. We do not knowingly collect data from children.
8. Security
We take reasonable technical and organisational measures to protect your data. Payments are taken over an encrypted connection.
9. Changes
When we change this policy, we update the date at the top. We also notify important changes by email.