Privacy
Policy.

This policy applies to personal data processed by THERZY in connection with this website, our registration and ordering platform, and our production and sourcing services for fashion brands. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) for the European brands we work with, and Turkey's Law on the Protection of Personal Data (KVKK) as the entity processing that data.

THERZY is a textile production and sourcing company based in Istanbul, Turkey, acting as the data controller for the personal data described in this policy. Questions about this policy or your data can be sent to privacy@therzy.com.

Account and registration data: full name or company title, country, email address, a hashed password, and the referral code used to join a company account.

Order data: order titles, product details, quantities, specifications, notes, uploaded files and images, and the status history connected to your company's orders.

Company data: company name, registered code, address, phone number, tax office and tax number, provided when a company account is set up.

Communications: messages you send us through the contact form, email, or during a consultation, including anything you choose to share about a product or programme.

Technical data: IP address, browser and device information, and the session identifier needed to keep you signed in securely.

Most data comes directly from you — when you register, place an order, or write to us. Some technical data is collected automatically when you use the site, through standard web server logs and the session cookie that keeps you signed in.

To provide the service you asked for — creating your account, processing orders, and communicating about production — under Article 6(1)(b) GDPR, performance of a contract.

To secure accounts and prevent misuse of the registration and referral system, under Article 6(1)(f), our legitimate interest in a working platform.

To meet accounting, tax and export documentation obligations, under Article 6(1)(c), legal obligation.

To send you information you have asked for, such as a quote or a reply to an enquiry, under Article 6(1)(b) or, before an account exists, Article 6(1)(f).

We do not sell personal data. We share it only where necessary to run the service: with the hosting provider that stores our database and files, the email provider that sends account and order notifications, and — where you ask us to arrange it — freight forwarders and customs agents handling your shipment. Each of these processors is bound by a data processing agreement and may only use your data to provide that specific service.

THERZY is based in Turkey. Where personal data from an EU-based brand is processed here, we rely on the standard contractual clauses adopted by the European Commission, or an equivalent safeguard, to protect that transfer. Where a service provider we use is based outside Turkey or the EEA, the same safeguards apply.

Account and order data is kept for as long as your company's account is active, and for the period required afterwards by Turkish commercial and tax law — generally ten years for accounting records. Enquiries that do not lead to an account are kept for up to two years. You can ask us to delete data sooner where no legal retention period applies.

Passwords are stored as salted hashes, not in plain text. Access to order and company data is limited to the THERZY team members who need it to do their job, and file uploads are served only to the company that owns the order and to our administrators.

This site uses one essential cookie to keep you signed in after you log in, and your browser's local storage to remember your language preference. Neither is used for advertising or tracking, and no consent banner is shown because no non-essential cookies are set.

Under GDPR and KVKK, you have the right to:

• Access — ask what personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data where we have no legal reason to keep it.
• Restriction — ask us to limit how we use your data while a request is reviewed.
• Portability — ask for the data you gave us in a machine-readable format.
• Objection — object to processing based on our legitimate interest.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Complain — lodge a complaint with your national data protection authority, or with Turkey's Personal Data Protection Authority.

Our services are directed at businesses. We do not knowingly collect personal data from anyone under 18.

We may update this policy as our services or the law change. Material changes will be noted with a new date at the top of this page.

THERZY — Istanbul, Turkey. For any question about this policy, your data, or to exercise any of the rights above, write to privacy@therzy.com. We respond within 30 days.