IKIKIZ SOCIEDAD LIMITADA
PRIVACY NOTICE FOR WEBSITE USERS AND INTERNATIONAL CUSTOMERS
www.ikikiz.com, international version. Last updated: 8 October 2026.
1. Who We Are
This Privacy Notice explains how personal data is processed when you visit the international version of www.ikikiz.com, create an account, place an order for delivery outside Türkiye, subscribe to our newsletter or contact our customer service. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD").
The controller of your personal data is IKIKIZ SOCIEDAD LIMITADA ("IKIKIZ", "we", "us"), Avenida La Luz 16, Local 18, 04638 Mojácar, Almería, Spain. IKIKIZ is the seller of products ordered through the international version of the website and issues the invoice to you. You can contact us about data protection at [email protected].
IKIKIZ belongs to the İKİKIZ group of companies. The companies below are referred to in this notice:
Company | Country | Role in relation to your data |
IKIKIZ SOCIEDAD LIMITADA | Spain | Controller: seller and invoicing entity for international online orders; operates the İKİKIZ stores in Spain |
MOSER TEKSTİL SANAYİ TİCARET ANONİM ŞİRKETİ | Türkiye | Manufacturer and supplier of İKİKIZ products. Processor when it manages our e-commerce, order and customer systems on our behalf; separate controller when it uses order data for its own sales reporting, customer relations and, only with your consent, marketing |
IKIKIZ S.R.L. | Italy | Operates the İKİKIZ stores in Italy; separate controller for in-store purchases in Italy and not a recipient of your online order data |
MERLEY USA INC. | United States | Sells İKİKIZ products through Etsy and Faire; separate controller for those sales and not a recipient of your online order data |
Purchases made on www.ikikiz.com for delivery within Türkiye are governed by the Turkish version of the website, where MOSER TEKSTİL SANAYİ TİCARET ANONİM ŞİRKETİ is the seller and controller. Purchases made in our physical stores are covered by the privacy information provided in the relevant store.
We have not appointed a Data Protection Officer, as the conditions of Article 37 GDPR and Article 34 LOPDGDD do not apply to our activities. All data protection requests are handled through the contact details in section 10.
2. Personal Data We Process
Category | Data | Source |
Identity | First name, surname, tax identification number where you request an invoice for a business | You (account, checkout and invoice forms) |
Contact | E-mail address, telephone number, billing and delivery address, country | You |
Order and transaction | Order number and content, order date and amount, invoices, returns and exchanges, order history, size and product preferences, discount codes used | Our e-commerce and order systems |
Payment | Payment method, transaction reference and status, refund details | Our payment service provider. We never see or store your full card number or bank credentials |
Account and security | Login credentials (password stored in encrypted form), IP address, device and browser data, log records | You and our systems |
Marketing | Newsletter subscription, consent and opt-out records, e-mail engagement (opens, clicks), customer segment | You and our e-mail marketing platform |
Cookies and online identifiers | Cookie identifiers, pages viewed, interactions, conversion events | Cookies and similar technologies (see our Cookie Policy) |
Communications | Content of your messages, requests and complaints | You (e-mail, contact form, messaging channels) |
We do not ask for, and do not wish to receive, special categories of personal data. If you send us such data spontaneously (for example health information in a message), we delete it once your request has been handled.
3. Purposes and Legal Bases
Purpose | Legal basis (GDPR Article 6) |
Creating and managing your customer account | Art. 6(1)(b) performance of a contract |
Processing your order, taking payment, preparing and shipping the products, handling returns, exchanges and the right of withdrawal | Art. 6(1)(b) performance of a contract |
Issuing invoices, keeping accounting and tax records, complying with consumer protection, commercial and customs law | Art. 6(1)(c) legal obligation |
Responding to your enquiries and complaints; sending service messages about your order (confirmation, shipping, delivery, returns) | Art. 6(1)(b) and Art. 6(1)(f) legitimate interest in providing good customer service |
Sharing order and sales data with our supplier MOSER Tekstil for sales tracking, product planning, reporting by country and channel, and customer relations | Art. 6(1)(f) legitimate interest in managing the supply and sales of İKİKIZ products within the group |
Website security, fraud prevention, error detection and system administration | Art. 6(1)(f) legitimate interest in keeping the website and your account secure |
Establishing, exercising or defending legal claims | Art. 6(1)(f) legitimate interest |
Sending newsletters and commercial communications about İKİKIZ collections, offers and events, and tailoring them to your purchase history | Art. 6(1)(a) consent. Where you are an existing customer, we may also send e-mails about similar İKİKIZ products under Article 21(2) of Spanish Law 34/2002 (LSSI); you can object at any time and in every message |
Analytics, advertising and social media cookies | Art. 6(1)(a) consent given through the cookie banner |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may obtain further information on this assessment and object to the processing as explained in section 9.
Providing your identity, contact, delivery and payment data is necessary to conclude and perform the purchase contract; without this data we cannot process your order. Providing data for marketing and non-essential cookies is optional.
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Segmentation for marketing purposes is carried out only with your consent and does not have such effects.
4. Recipients
We share your personal data only to the extent necessary for the purposes above, with:
– MOSER TEKSTİL SANAYİ TİCARET ANONİM ŞİRKETİ (Türkiye): as our processor for hosting, maintenance and administration of the e-commerce, order management, accounting and customer systems, and for preparing and dispatching your order; and as a separate controller for sales reporting, customer relations and, only where you have given consent covering this, marketing and CRM activities. The relationship is governed by a written agreement that includes the data processing terms required by Article 28 GDPR and the European Commission's Standard Contractual Clauses.
– Service providers acting as our processors: e-commerce platform providers (Mobim, Shopify), payment service provider, e-mail marketing platform (Mailchimp), cloud hosting and IT service providers, customer service tools, invoicing and accounting service providers.
– Carriers and logistics companies and, for deliveries outside the European Union, the customs authorities of the destination country.
– Payment institutions and banks to process payments and refunds.
– Advertising and analytics providers (Google, Meta, TikTok), only if you consent to the relevant cookies.
– Professional advisers, auditors, courts, public authorities and law enforcement bodies where required by law or necessary to defend our rights.
5. International Transfers
Some recipients are located outside the European Economic Area:
Recipient | Country | Safeguard |
MOSER TEKSTİL SANAYİ TİCARET ANONİM ŞİRKETİ | Türkiye | Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2 for processing on our behalf, Module 1 for its own purposes), supported by a transfer impact assessment and supplementary measures such as encryption, access restriction and logging |
Mailchimp (Intuit Inc.) | United States | EU-U.S. Data Privacy Framework where the recipient is certified; otherwise Standard Contractual Clauses |
Shopify | Canada and United States | Commission adequacy decision for Canada; EU-U.S. Data Privacy Framework or Standard Contractual Clauses for the United States |
Google, Meta, TikTok | United States and other countries | EU-U.S. Data Privacy Framework or Standard Contractual Clauses; only with your cookie consent |
Carriers and customs authorities in the destination country | Country of delivery | Article 49(1)(b) GDPR, where the transfer is necessary to deliver the order you have placed |
You may request a copy of the safeguards used for a transfer by contacting us at [email protected]. Commercially sensitive parts may be removed from the copy.
6. Retention
Data | Retention period |
Order, invoice and accounting records | 6 years from the end of the financial year (Article 30 Spanish Commercial Code), and at least 4 years for tax purposes |
Data needed to handle warranty, returns and consumer claims | For the legal warranty period and the applicable limitation periods for contractual claims |
Customer account data | While your account is active; inactive accounts are deleted after 3 years without login, except for data that must be kept for the periods above |
Newsletter and marketing data | Until you withdraw consent or object; proof of consent and opt-out is kept for 3 years afterwards |
Customer service communications | 3 years from the closing of the request |
Security and access logs | 12 months |
Cookies | As set out in the Cookie Policy, at most 13 months |
When a retention period ends, data is deleted or irreversibly anonymised. Where the law requires us to keep data for longer, it is blocked and kept only for that purpose, as required by Article 32 LOPDGDD.
7. Security
We and our group company MOSER Tekstil apply technical and organisational measures appropriate to the risk, including encrypted connections (TLS), encryption of stored data where appropriate, role-based access control, individual user accounts with access logging, multi-factor authentication for administrative access, regular backups and vulnerability testing. Payment data is processed only by our PCI DSS-compliant payment service provider.
8. Children
Our website and products are not directed at children for online purchasing. We do not knowingly collect personal data from persons under 14 years of age, the age at which a person may give consent in Spain under Article 7 LOPDGDD. If we become aware that we have collected such data, we delete it.
9. Your Rights
Under Articles 15 to 22 GDPR you have the right to:
– access your personal data and obtain a copy;
– rectify inaccurate or incomplete data;
– erase your data where there is no longer a legal ground to keep it;
– restrict processing in the cases provided by law;
– receive the data you provided to us in a structured, commonly used and machine-readable format and have it transmitted to another controller (data portability), where processing is based on consent or contract and carried out by automated means;
– object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to processing for direct marketing without giving any reason;
– withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To unsubscribe from marketing e-mails, use the link included in every message or write to us. To change your cookie choices, use the "Cookie Settings" link in the website footer.
10. How to Exercise Your Rights and Complain
Send your request by e-mail to [email protected] with the subject line "Data Protection Request", or by post to IKIKIZ SOCIEDAD LIMITADA, Avenida La Luz 16, Local 18, 04638 Mojácar, Almería, Spain. You may use the Data Subject Request Form available on the website. We will reply within one month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; we will inform you of any extension within the first month. We may ask for information to confirm your identity.
If a request concerns processing carried out by MOSER Tekstil as a separate controller, we will forward it and MOSER Tekstil will reply to you directly. You may also contact MOSER Tekstil at [email protected] or at Kınıklı Mah. 6021 Sk. No: 67 Pamukkale, Denizli, Türkiye.
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. Our lead supervisory authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
11. Changes to This Notice
We may update this Privacy Notice when our processing activities or the law change. The current version is always available on the website, with the date of the last update shown at the top. Significant changes will be brought to your attention by e-mail or a notice on the website.