Privacy policy

PERSONAL DATA PROTECTION, PROCESSING, AND PRIVACY POLICY

1. INTRODUCTION

SAMKO KAFE TİC. LTD. ŞTİ. Tax No: (7421056240) (“3DiiD”, “Company”) attaches

maximum importance to protecting the fundamental rights and freedoms of individuals, particularly the privacy of private life regulated under Article 20 of the Constitution, in the protection and processing of personal data. Within this framework, in accordance with the Law No. 6698 on the Protection of Personal Data (“Law” or “KVKK”), it pays utmost attention to protecting and processing personal data in accordance with the law and acts with this understanding in all its planning and activities.

Our Company does not evaluate the protection and processing of personal data, which is the foundation of the privacy of private life, merely within the scope of regulatory compliance, but places the value it attaches to human beings at the core of its approach. Acting with this awareness, our Company takes all necessary administrative and technical measures for the protection and lawful processing of personal data.

2. PURPOSE

The purpose of this Personal Data Protection and Processing Policy (“Policy”) is to protect the fundamental rights and freedoms of individuals, primarily the privacy of private life set forth in Article 20 of the Constitution, during the protection and processing of personal data processed through fully or partially automated means or non-automated means provided that they form part of any data filing system, in line with the purpose of the Law. It also aims to inform personal data subjects (data subjects) about the obligations of our Company as well as the procedures and principles to be complied with under the Law. In line with the purpose of the Policy, the goal is to ensure full compliance with the legislation in the personal data protection and processing activities carried out by our Company, and to protect personal data subjects' rights to privacy of private life and data security.

3. SCOPE OF THE POLICY

This policy has been established due to the use of services accessed through 3DİİD. It has been prepared regarding all our services accessed via our website www.3diid.com, through social media, by calling our communication lines, via email, by filling out return forms, or through any other means. The Policy is prepared for our customers, potential customers, and their employees/officials, persons to whom products are delivered, and our website visitors. It will apply to the persons specified within this scope. The Company informs these personal data subjects about the Law by publishing this Policy on its website. This Policy shall not apply to legal entities, regardless of their capacity.

This Policy shall apply to the aforementioned data subjects in cases where their personal data is processed by our Company through fully or partially automated means or non-automated means provided that it forms part of any data filing system. If the data does not fall within the

scope of "Personal Data" as defined below, or if the personal data processing activity carried out by our Company does not occur through the specified methods, this Policy shall not apply.

4. COLLECTION OF PERSONAL DATA

We collect, process, and store your personal data when you create a membership account on our site, perform membership transactions via social media, contact us through our social media accounts, fill out a form on www.3diid.com or any contact form we publish, update your account information or add details, purchase products and/or services, during product delivery, when you hold discussions/create orders through our order and support line, fill out a return form, communicate via email, and visit our website address.

Your personal data collected when you create a membership account on our site, perform membership transactions and communicate via social media, fill out a form on www.3diid.com, update your account information or add details, and purchase products and/or services are listed below:

Name Surname, email, and mobile phone details,
Products added to the cart, products ordered, past order details, and custom design order visuals,
Turkish Republic ID Number (TR Identity Number), information indicating non-TR nationality if applicable, or Tax Identification Number,
Date of birth and gender information,
Address details, work phone details, preferred communication language,
Member shopping list, price alert list, and stock alert list,
Gift Voucher and Point details,
Financial information such as IBAN and account number obtained according to your purchase option,
Member order tracking code, tracking code required for shipping operations, and tracking information,
Profile details, profile photo, and similar information you grant permission for during membership transactions via social media,
Profile details, shared photos, reviews, and requests when contacted via social media,
Information contained in forms on the website, updated user information,
Addresses provided when purchasing products (delivery address, billing address),
Information required to be obtained within the scope of applicable legislation for identity verification.

Your personal data collected during transactions made through our communication lines are listed below:

Phone call voice recordings,
Name Surname, email, phone details,
Billing and delivery address details,
Product information,
Products added to the cart, products ordered, past order details, and custom design order visuals,
Financial information such as IBAN and account number obtained according to your purchase option,

Member order tracking code, tracking code required for shipping operations, and tracking information,

Profile details you grant permission for during membership transactions via social media,
Information required to be obtained within the scope of applicable legislation for identity verification.

Your personal data collected when you fill out a return form are listed below:

Returned and requested products,
Name Surname and IBAN belonging to the account holder to whom the refund will be provided,
Name Surname, phone, address, and signature details of the returning person, and the reason for return.

Your personal data collected when you communicate via electronic mail (email) are listed below:

Electronic mail (email) address,
Request and order details,
Other information provided by the person communicating.

Regarding data collected when you visit our website address and mobile application, you can review the Cookie Policy and Clarification Text available on www.3diid.com.

You undertake that explicit consent has been obtained from third parties for transferring personal data that does not belong to you (such as delivery and billing addresses belonging to another person, information regarding a cardholder that is not yours, third-party bank and account details) to Our Company.

5. LEGAL GROUNDS FOR PERSONAL DATA COLLECTION

Our Company does not process personal data without the explicit consent of the data subject. Personal data may only be processed without seeking the explicit consent of the data subject in the presence of one of the following conditions:

Explicitly provided for by law;
Personal data having been made public by the data subject themselves;
Processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the establishment or performance of that contract;
It being mandatory for our Company to fulfill its legal obligations;
Data processing being mandatory for the establishment, exercise, or protection of a right;
Data processing being mandatory for the legitimate interests pursued by our Company, provided that it does not harm the fundamental rights and freedoms of the data subjects.

6. PURPOSES OF PROCESSING PERSONAL DATA

Our Company pays utmost attention to ensuring that your personal data listed above complies with relevant legislation and the principles of good faith, and is accurate and up to date. Our Company clearly and precisely determines the data processing purpose and ensures that this purpose is legitimate. Our Company does not process data for purposes other than those specified. In this regard, it demonstrates sensitivity in adhering to the principle of clarity and determinacy in legal transactions and documents where personal data processing purposes are stated.

Our Company ensures that the processed personal data is suitable for achieving the determined purposes and avoids processing data that is irrelevant or not needed for achieving the purpose. Our Company does not collect or process personal data for non-existent purposes intended for the future. To process data to meet needs that may arise later, it fulfills the processing conditions regulated in the Law as if starting processing for the first time. Furthermore, it keeps the processed data limited strictly to what is necessary for achieving the purpose. Within the scope of the proportionality principle, it establishes a reasonable balance between data processing and the target purpose.

If a retention period is stipulated in the relevant legislation, our Company complies with these periods; otherwise, it retains personal data only for as long as required for the purpose for which they were processed. In the event that there is no valid reason for our Company to store personal data any longer, the data in question is deleted, destroyed, or anonymized. Procedures regarding the retention and destruction of personal data are detailed in our Company's Personal Data Retention and Destruction Policy.

Within this framework, your personal data described above are processed and stored for the following purposes:

Execution of goods/services sales processes,
Execution of goods/services post-sales support activities,
Execution of customer relationship management processes,
Execution of activities aimed at customer satisfaction,
Execution of goods/services/production and operational processes,
Execution of contract processes,
Execution/audit of business activities,
Execution of communication activities,
Execution of logistics activities,
Execution of finance and accounting affairs,
Conducting activities in accordance with the legislation,
Execution of marketing analysis studies,
Execution of advertising/campaign/promotion processes,
Execution of supply chain management processes,
Execution of product/service marketing processes,
Follow-up of requests/complaints,
Execution of audit/ethical activities,
Providing information to authorized persons, institutions, and organizations,
Creation and tracking of visitor records.

7. PURPOSES AND RECIPIENTS OF PERSONAL DATA TRANSFERS

Our Company transfers personal data within the framework of the conditions specified in Articles 8 and 9 of the Law, limited to the following purposes:

Conducting activities in accordance with the legislation,
Execution of finance and accounting affairs,
Execution of communication activities,
Execution of goods/services sales processes,
Execution of customer relationship management processes,
Execution of activities aimed at customer satisfaction,
Execution of goods/services/production and operational processes,
Follow-up and execution of Legal Affairs,
Execution of goods/services production and operational processes,
Execution of marketing analysis studies,
Execution of advertising/campaign/promotion processes,
Execution of product/service marketing processes,
Execution of contract processes,
Follow-up of requests and complaints,
Providing information to authorized persons, institutions, and organizations,
Execution of management activities,
Execution of logistics activities,
Execution of audit/ethical activities.

Our Company may transfer personal data, limited to the data subject groups and data required by the purpose of transfer, to the persons and entities specified below:

Business partners,
Suppliers,
Authorized public institutions and organizations (including foreign authorities when necessary),
Real persons or private law legal entities (Collaborating entities: Cargo companies, Independent audit firms, insurance companies, law firms, banks, etc.).

8. PURPOSES AND RECIPIENTS OF PERSONAL DATA TRANSFERS

8.1 Destruction of Personal Data

Without prejudice to the provisions on the destruction of personal data in other laws, if the reasons requiring its processing cease to exist, our Company deletes, destroys, or anonymizes personal data—which it processed in accordance with this Law and other provisions of law—ex officio or upon the request of the data subject in accordance with the Personal Data Retention and Destruction Policy.

Deletion of personal data refers to the process of making personal data inaccessible and un-reusable in any way for the relevant users.

Destruction of data refers to the process of making personal data completely inaccessible, unrecoverable, and un-reusable by anyone in any way.

Anonymization of data refers to the process of rendering personal data impossible to associate with an identified or identifiable natural person under any circumstances, even if matched with other data using techniques such as masking, variable removal, generalization, etc.

8.2 Retention Periods of Personal Data

Our Company retains personal data in accordance with the periods provided for in laws and other relevant legislation. If no retention period is specified in laws and other legislation, personal data is retained for the period required to achieve the purpose of processing that data, in accordance with our Company's Personal Data Retention and Destruction Policy, and is subsequently deleted, destroyed, or anonymized within the framework of periodic destruction intervals.

8.3 Informing the Data Subject and Data Subject Rights

Our Company informs data subjects during the collection of personal data in accordance with Article 10 of the KVKK. Within this scope, it clarifies the identity of the Company representative (if any), the purpose for which personal data will be processed, to whom and for what purpose processed personal data may be transferred, the method and legal grounds for collecting personal data, and the rights held by the data subject.

9. INFORMING THE DATA SUBJECT AND DATA SUBJECT RIGHTS

9.1 Cases Where the Policy and Law Will Not Be Applied Fully or Partially

The provisions of this Policy and the Law shall not apply in the following cases:

Processing of personal data by natural persons within the scope of activities purely related to themselves or family members living in the same household, provided that data is not disclosed to third parties and data security obligations are complied with,
Processing of personal data for purposes such as research, planning, and statistics by anonymizing them with official statistics,
Processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public security, public order, economic security, privacy of private life, or personal rights, or constitute a crime,
Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security,
Processing of personal data by judicial authorities or execution organs in relation to investigation, prosecution, trial, or execution proceedings.

Provided that it is suitable and proportionate to the purpose and basic principles of this Policy and the Law, Article 10 regulating the data controller's obligation to inform, Article 11 regulating the rights of the data subject (excluding the right to demand compensation for damages), and Article 16 regulating the obligation to register with the Data Controllers Registry shall not apply in the following cases:

Data processing being necessary for the prevention of crime or for criminal investigation,
Processing of personal data that has been made public by the data subject themselves,
Data processing being necessary for the performance of supervision or regulatory duties or for disciplinary investigation or prosecution carried out by authorized public institutions and organizations and public professional organizations based on authority granted by law,
Data processing being necessary for the protection of the economic and financial interests of the State concerning budget, tax, and financial matters.

9.2 Rights of the Data Subject Pursuant to the KVKK

Our Company informs data subjects of their rights pursuant to Article 10 of the Law, provides guidance on how to exercise these rights, and carries out the necessary internal procedures, administrative, and technical arrangements for all of these. Persons whose personal data are processed hold the following rights pursuant to Article 11 of the Law:

To learn whether their personal data is being processed,
To request information if their personal data has been processed,
To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
To know the third parties to whom personal data is transferred domestically or abroad,
To request correction of personal data if it is incomplete or incorrectly processed,
To request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
To request that transactions carried out (correction and destruction) pursuant to sub-paragraphs (d) and (e) of Article 11 of the Law be notified to third parties to whom personal data has been transferred,
To object to the occurrence of a result against the person themselves through analysis of processed data exclusively via automated systems,
To demand compensation for damages in case of incurring damage due to unlawful processing of personal data.

Requests and applications regarding the implementation of the Law may be delivered in person in writing to the address “Emek Mahallesi Bişkek Caddesi no: 72/A Çankaya/Ankara”, sent via Notary Public, or transmitted electronically using a registered electronic mail (KEP) address (samkokafe@hs01.kep.tr), secure electronic signature, or mobile signature.

In requests and applications, it is mandatory to include:

Name, surname, and signature if the application is written,
T.C. identity number for citizens of the Republic of Türkiye; nationality, passport number, or identity number (if any) for foreigners,
Residential or workplace address for notification,

Electronic mail address, phone, and fax numbers (if any) for notification,

Subject of the request.

Relevant information and documents regarding the topic must be attached to the application.

Our Company concludes the requests contained in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, a fee according to the tariff determined by the Board may be charged.

Our Company may accept the request submitted to it or reject it by explaining its reason, and communicates its response to the data subject in writing or electronically. If the request in the application is accepted, our Company fulfills its requirements as soon as possible and informs the data subject. If the application originates from an error by our Company, the collected fee shall be refunded to the data subject.

In cases where the application is rejected, the response given is deemed insufficient, or no response is given within the due time, the data subject has the right to lodge a complaint with the Board within thirty days from the date they learn of the response and, in any case, within sixty days from the date of application.

10. DATA SECURITY MEASURES

SSL/TLS encryption, firewall, IDS/IPS
Role-based access control (RBAC)
Regular penetration testing
Employee confidentiality undertakings and awareness trainings

11. COOKIE POLICY

Necessary, performance, functional, and advertising cookies are used. You can change your cookie preferences via your browser settings. Cookies requiring explicit consent only operate if you give your approval.

12. POLICY CHANGES

This policy may be updated as needed. Updates shall enter into force on the date they are published on the web/mobile application.

13. EFFECTIVE DATE

This Privacy Policy was approved and published on 22/07/2026.

COOKIE POLICY

This Cookie Policy has been prepared to explain the types, purposes, and management rights of cookies used on the www.3diid.com website operated by Samko Kafe Ticaret Limited Şirketi ("3DiiD").

1. What is a Cookie?

Websites you visit can store small pieces of information on your computer or phone and read this information when you visit the same site again. The files in which this small information is saved are called cookies or identification information ("cookies"). Cookies generally serve to improve your browsing experience on the internet and personalize websites. For example, if you check the "remember me" option when logging into a site, that site saves a cookie containing your username (or unique ID number) to your browser. Only the site that created the cookie can read it. The site also determines how long the cookie will be stored.

2. Use of Cookies

The www.3diid.com website collects, processes, shares with third parties, and securely stores your browsing information in order to provide better service to its visitors, members, and other persons benefiting from 3D printing, manufacturing, and custom design services, to increase service quality, to enable its visitors and members to benefit from the platform's advantages, and within the framework of its legal obligations, provided that it is not used outside the purposes and scope determined by this Privacy Policy and Clarification Text Regarding Personal Data.

Cookies are text files containing small bits of information downloaded by your internet browser and stored on your computer, mobile phone, or tablet when you visit the www.3diid.com website or connect from your mobile devices. The www.3diid.com website tracks your browsing information on the site and/or your membership and order usage history on the site in order to make customized promotions for you, offer promotions and marketing offers, improve the website's content and 3D design/order flows according to your usage behavior, and/or determine your preferences.

The www.3diid.com website may match information collected from you on the site at different times or through different methods, such as information collected online and offline, and may use this information together with information obtained from other sources such as third parties. Said matching and usage will remain strictly within the purposes and scope determined by this Privacy Policy and Clarification Text Regarding Personal Data.

3. Types of Cookies

3diid.com uses session cookies and persistent cookies on its website. A session ID cookie expires when you close your browser. A persistent cookie remains on your hard drive for a long time. You can remove persistent cookies and reject both session cookies and persistent cookies by following the instructions provided in your internet browser's "help" file or by visiting www.allaboutcookies.org or www.youronlinechoices.eu. If you reject persistent cookies or session cookies, you may continue to use the website, but you may not be able to access all

functions of the website (cart transactions, 3D model upload screens, etc.) or your access may be limited.

4. How are 3diid.com Cookies Used?

3diid.com uses cookies to:

Remember your preferences and personalize your use of the website. This use includes:

Cookies that save your password and keep your website session open continuously, saving you the hassle of entering your password multiple times during each visit, and
Cookies that remember and recognize you on your subsequent visits to the website.

Determine how you use the website, including tracking how you use the website such as where you connect to 3diid.com from, what content or 3D product group you view on the website, and the duration of your visit.
Present content and advertisements more suitable for your interests and to you, in other words, for targeted advertising/promotion purposes. In this way, when you use the 3diid.com website, it offers you more suitable content, custom campaigns, and products, and does not re-offer content or opportunities you previously indicated you did not want. 3diid.com matches the information obtained through cookies with the personal data collected from our members.

5. How Does 3diid.com Use Third-Party Cookies for Advertising and Retargeting?

3diid.com may also use cookies to activate "advertising technology" in order to present advertisements it thinks may interest you when you visit search engines, the 3diid.com website, and/or websites where 3diid.com advertises. Advertising technology uses information about your previous visits to the website and to websites where 3diid.com advertises in order to offer you customized advertisements. While serving these advertisements, a unique third-party cookie may be placed on your browser so that 3diid.com can recognize you.

3diid.com's website also uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses cookies to analyze how visitors use the website. Information about your use of this website (including your IP address) is transmitted to Google and stored by Google on servers in the USA. Google will use this information to evaluate your use of the website, compile website activity for 3diid.com, and provide other services related to website activity and internet usage. However, it will not match your IP address with other data stored by Google. For more information about the use of Google Analytics (including opt-out options), you can visit: https://www.google.com/policies/privacy/

In addition, in order to present advertisements that may interest you, by accepting this Privacy Policy and Clarification Text Regarding Personal Data to create custom audiences with Facebook (Meta), your email address from the personal data you shared with 3diid.com is shared with Facebook. Before uploading and transmitting your email address to Facebook, it is encrypted locally on our system using the hash method. Your Hash-Encrypted email address shared with Facebook will be used solely for the matching process. They are not shared with

third parties or other advertisers and are deleted from Facebook systems as soon as possible after the matching process is completed.

Facebook will ensure the confidentiality and security of the Hash-Encrypted Data and Facebook User ID collection forming your custom audience ("your custom audience"), including technical and physical security measures developed to (a) protect data security and integrity as long as your personal data remains in Facebook systems, and (b) protect against accidental or unauthorized access to and accidental or unauthorized use, alteration, or disclosure of your personal data in Facebook systems. Furthermore, without your permission or unless required by law, Facebook will not grant access or information to third parties or other advertisers for your custom audience, will not add your custom audience information to information about our users or create interest-based profiles, nor use your custom audience for any purpose other than providing services to you. For Facebook custom audience terms, you can visit https://www.facebook.com/ads/manage/customaudiences/tos.php, and for Facebook Privacy Principles, https://www.facebook.com/privacy/explanation.

6. Cookie List

Cookies are small data pieces (text files) that a website asks your browser to store on your device when visited by a user to remember information about you, such as your language preference or login details. Cookies stored by us are called first-party cookies. In addition, for our advertising and marketing efforts, we also use third-party cookies, which are cookies coming from a domain different from the domain of the website you visit. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in, uploading 3D files, or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not work then.

Cookie Subgroup	Cookie	Cookies Used
3diid.com	csrftoken, OptanonAlertBoxClosed, OptanonConsent, sessionid	First-Party
cdn.3diid.com	cookietest	First-Party
onetrust.com	cfduid	Third-Party

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and

therefore anonymous. If you do not allow these cookies we will not know when you have visited our site.

Cookie Subgroup	Cookie	Cookies Used
3diid.com	_ga, _ga_xxxxxxx, _gat, _gid	First-Party
nr-data.net	JSESSIONID	Third-Party

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They work by uniquely identifying your browser and device. If you do not allow these cookies, you will not experience our targeted advertising across different websites.

Cookie Subgroup	Cookie	Cooki es Used
3diid.com	atrfs, gads, _gat_gtag_xxxxxx, GoogleAdServingTest	First-Party
adnxs.com	uuid2	Third-Party
lijit.com	ljt_reader	Third-Party
ads.programattik.c om	tuuid_lu, tuuid, c	Third-Party
openx.net	i	Third-Party
google.com	NID, CONSENT	Third-Party
sportradarserving. com	zuuid_lu, zuuid, c	Third-Party
yahoo.com	A1S, APIDTS, APID, A3, A1, B, GUC	Third-Party
pubmatic.com	KADUSERCOOKIE, KTPCACOOKIE	Third-Party

Cookie Subgroup	Cookie	Cooki es Used
m6r.eu	id, test	Third-Party
adservice.google.co m	GoogleAdServingTest	Third-Party
analytics.yahoo.co m	IDSYNC	Third-Party
turn.com	uid	Third-Party
3lift.com	tluuid	Third-Party
smartadserver.com	csync, TestIfCookieP, pid	Third-Party
adform.net	uid	Third-Party
advertising.com	APID	Third-Party
doubleclick.net	test_cookie, DSID, IDE	Third-Party
spotxchange.com	audience	Third-Party
addthis.com	uvc, loc, xtc	Third-Party
volvelle.tech	ouuid_lu, ouuid, c	Third-Party
blismedia.com	b	Third-Party
youtube.com	DEVICE_INFO, YSC, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, CONSENT, GPS	Third-Party

Cookie Subgroup	Cookie	Cooki es Used
www.google.com	_GRECAPTCHA	Third-Party
mathtag.com	mt_mop, uuid	Third-Party
quantserve.com	mc, d	Third-Party
ctnsnet.com	cid_XXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXX, cid	Third-Party
simpli.fi	suid, suid_legacy	Third-Party
w55c.net	wfivefivec, matchgoogle	Third-Party
pool.admedo.com	c, tuuid_lu, tuuid	Third-Party
bidswitch.net	bsw_origin_init, tuuid_lu, c, google_push, tuuid	Third-Party
casalemedia.com	CMID, CMRUM3, CMPS, CMST, CMPRO	Third-Party

Language

Privacy policy