Privacy Notice

Data controller and scope

The data controller is Bey&Co.; address and identifying details are on the Company information page.

This notice covers the personal data processed through the forms, member account and appointment calendar on our site, and when you reach us by WhatsApp, email or phone. We only ask for the data needed to answer your request; no payments are taken on this site.

Appointments (Calendly)

Our appointment calendar runs on Calendly and loads only when you open it. The name, contact details and notes you give when booking are processed by Calendly to schedule and hold your appointment, and may be transferred to the United States. Your appointment is recorded in our calendar (Google Calendar).

Appointment records that do not lead to a purchase are deleted within 12 months.

Forms

Information you send through our appointment request, bespoke and jewel inquiry forms (your first and last name, phone number, message and the options you choose) is processed to answer your request.

Photographs or sketches you upload with a bespoke request are kept only to assess that request; they are deleted together with the request record after 12 months and are never published without your permission.

Records are stored on Cloudflare infrastructure in the European Union and forwarded to our inbox as a notification email so that we can reply. Both the record and the notification email are deleted after 12 months; access-restricted backups may keep them for up to 35 more days.

“Let me know” requests

If you ask to be told when a jewel is ready again, we keep your name, chosen channel and contact details for that jewel only, and write to you only about it. The record is deleted 6 months after we let you know, and in any case no later than 12 months after you sign up.

This request is based on the separate consent you give: Consent text (commercial messages).

Membership (My account)

If you create an account, we process your first and last name, phone number (WhatsApp), email address, the codes of the jewels you add to your favorites and the dates your account was created and last used, so that you can manage your account, see your favorites on every device and we can reply to you on WhatsApp. The legal ground is establishing and performing the membership contract (KVKK Art. 5/2-c).

Your password is never stored in plain text and is never sent to us: your browser derives a one-way key from it, and our database (Cloudflare D1) keeps only a salted digest of that key. This means we cannot see your password either. When you sign in, a record of your session (a digest of the random key in the cookie, how you signed in, and when the session started and ends) is also kept on our server; it is deleted when you sign out, or within a week after it expires. If you forget your password, write to us on WhatsApp: we will send a single-use password link, valid for 24 hours, to your registered number. If your account is connected to Google, sign in with Google and then set a new password in your profile.

We use “Sign in with Google” only if you choose it: we then receive your first and last name, email address, Google account identifier and whether Google has verified your email address. Your sign-in may be processed by Google outside Türkiye (for example in the United States; KVKK Art. 9).

Strictly necessary cookies recognize your session (see the Cookie Policy). Hearing about new jewels on WhatsApp is optional: we write to you only if you check the box on the sign-up form or in “My details” on the My account page, and you can withdraw your consent at any time by unchecking it there.

Your account is kept until you delete it or, if you do not sign in for 3 years, until that period ends; it is then deleted together with your favorites, and access-restricted backups may keep it for up to 35 more days. You can delete your account permanently at any time in the “Delete my account” section of the My account page.

Cookie-free interest counter

We count interest in our jewels only as daily totals, without knowing who you are; to avoid counting the same view twice, jewel codes are kept in your browser only while the tab is open. The counter does not identify you.

Security

To protect our site and forms against misuse we use Cloudflare’s security services and Cloudflare Turnstile, which process your connection details (IP address, browser information) for security purposes only.

To limit excessive requests your IP address is not stored; only a one-way digest of it is used in a short-lived counter. When someone tries to sign in to your account, a one-way digest of your email address is used in the same counter for the same purpose. Your IP address is not written to form records or server logs.

How we collect data and legal grounds

We collect your personal data electronically, partly by automated means, through the forms and appointment calendar on our site, or when you write to us by WhatsApp, email or phone.

For your appointments, requests and membership, the legal ground is that processing is directly related to establishing or performing a contract (KVKK Art. 5/2-c). Site and form security rests on our legitimate interest (Art. 5/2-f). “Let me know” requests and analytics and marketing cookies are processed only with your explicit consent (Art. 5/1).

Transfers and service providers

Your data is shared only for these purposes, with the providers we use: Cloudflare (hosting, security, form protection, record storage and email forwarding; cookie-free visit measurement), Google (notification emails and calendar; Sign in with Google, only if you choose it; with your permission, Google Analytics and Google Ads), Calendly (appointment calendar) and Meta (with your permission, Meta Pixel; WhatsApp, if you write to us there). Where the law requires, it may be shared with authorized public bodies.

Some of these providers process data outside Türkiye (for example in the United States); such transfers are made in line with Article 9 of the KVKK.

Your rights and requests

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether the data is used accordingly;
• know the third parties in Türkiye or abroad to whom your data is transferred;
• ask for incomplete or inaccurate data to be corrected, for your data to be erased or destroyed under Article 7 of the KVKK, and for these steps to be notified to the third parties who received it;
• object to an outcome against you that arises solely from automated analysis;
• claim compensation if you suffer damage because of unlawful processing.

You can email your request to beymucevherat@gmail.com from an email address you have previously shared with us.

You can also write to the address on our Company information page. We answer free of charge within 30 days at the latest; if you find our answer insufficient, you may complain to the Turkish Personal Data Protection Board.

The explicit consent text is separate from this notice: Consent text (commercial messages).