Last updated: 20 August 2026

Data Protection Notice

Explains what personal data we collect through the Shopiyz website, why we process it, on what lawful basis, and what rights you have.

Data Protection Notice

This notice is provided under Articles 13 and 14 of the UK GDPR to tell you how Shopiyz handles the personal data you submit through this website.

It covers the contact form, demo requests, callback requests and quotation enquiries. It is written for sole traders and for the individual employees and representatives of business customers who complete these forms.

Information is not consent. Reading this notice means you have been informed; it does not mean you have agreed to anything. The processing that does require consent is listed separately in section 6 and is collected through separate, optional tick boxes on the form.

This notice does not cover personal data belonging to store customers processed through the Shopiyz platform. In that relationship Shopiyz acts as a processor and the Data Processing Agreement applies.

Company identity note. Shopiyz is in the process of establishing a company in the United Kingdom. Until that entity is registered, the controller is the Turkish entity named below. This section will be updated once registration is complete.

İNOVABİL TEKNOLOJİ SAN. VE TİC. A.Ş.

İOSB Mah. YTÜ Teknopark Sokak No: 1 İç No: Z11 Başakşehir / İstanbul PK: 34490

Vergi Dairesi: İkitelli, Vergi No: 4780558475

MERSİS No: 0478055847500014

Data protection enquiries: privacy@shopiyz.com

Registered e-⁠mail: inovabil@hs01.kep.tr

Phone: +90 850 259 23 23

A/Z

Definitions

Controller: The organisation that determines the purposes and means of processing personal data. For this notice, İnovabil Teknoloji San. ve Tic. A.Ş.
Data Subject: The identified or identifiable individual the personal data relates to; for this notice, the visitor completing a website form.
Personal Data: Any information relating to an identified or identifiable living individual.
Processing: Any operation performed on personal data, including collection, recording, storage, alteration, retrieval, transfer, restriction and erasure.
Consent: A freely given, specific, informed and unambiguous indication of agreement. It cannot be made a condition of receiving the service.
Electronic Marketing: Marketing sent by email, SMS or telephone, governed by the Privacy and Electronic Communications Regulations 2003 (PECR) in addition to the UK GDPR.
Legitimate Interests: A lawful basis under Article 6(1)(f) that applies where processing is necessary for our interests and not overridden by your rights and freedoms.
Supervisory Authority: The Information Commissioner's Office (ICO).

Who We Are

The controller responsible for the personal data described in this notice is the company set out below.

About the UK Entity

Shopiyz is in the process of establishing a company in the United Kingdom. Until that entity is registered, the controller is the Turkish company named above. This section will be updated once registration completes; the substance of this notice will not change.

What This Notice Covers

This notice applies to personal data collected through the following activities on the Shopiyz website:

Activities Covered

Messages and enquiries sent through the contact form
Demo requests and product walkthrough bookings
Callback requests submitted through pop-up and modal forms
Pricing and package enquiries
Handling complaints and measuring customer satisfaction
Marketing and electronic marketing, where you have consented

Not Covered by This Notice

Data belonging to merchants' own store customers, where Shopiyz is a processor and the Data Processing Agreement applies
Data collected through cookies and similar technologies, covered by the Cookie Policy
Activity inside the platform after you open a Shopiyz account, covered by the Privacy Policy

How We Collect Your Data

We collect personal data directly from you, by electronic means, when you choose to submit it.

Collection Channels

Web forms on shopiyz.com
Email and telephone correspondence
Complaint and support records
Server security logs (IP address, browser information)

We ask only for the minimum data the service requires. We do not request special category data (health, religious belief, biometric data and similar) and ask that you do not enter such data into our forms.

What We Process, Why, and on What Basis

The purposes and lawful bases are set out separately for each category of data below.

Identity data (name, job title)

Lawful basis: Article 6(1)(b) steps prior to entering a contract; Article 6(1)(f) legitimate interests.

Recording your enquiry and addressing you correctly
Carrying out our correspondence with you
Handling complaints and follow-up
Record keeping and archiving

Contact data (email address, telephone number)

Lawful basis: Article 6(1)(b) steps prior to entering a contract; Article 6(1)(f) legitimate interests.

Responding to your enquiry and arranging appointments
Fulfilling callback requests
Sending quotations and service information
Customer relationship management

Enquiry data (message content, company name, package selected)

Lawful basis: Article 6(1)(b) steps prior to entering a contract; Article 6(1)(f) legitimate interests.

Routing your enquiry to the right team
Preparing a suitable product or service proposal
Reviewing and improving our processes

Technical data (IP address, browser and device information, submission time)

Lawful basis: Article 6(1)(c) legal obligation; Article 6(1)(f) legitimate interests.

Maintaining information security
Preventing automated and abusive form submissions
Evidencing when a consent was given and against which version of this notice

Legal records (disputes, rights requests)

Lawful basis: Article 6(1)(c) legal obligation; Article 6(1)(f) establishment, exercise or defence of legal claims.

Managing legal matters and claims
Responding to competent authorities and courts
Demonstrating regulatory compliance

Marketing data (communication preferences, campaign interactions)

Lawful basis: Article 6(1)(a) consent. This category is processed only if you consent. Declining does not affect your ability to use our services.

Running advertising, campaign and promotion activities
Marketing our products and services
Marketing analysis and segmentation
Building and measuring engagement with our products

Processing That Relies on Your Consent

The activities below rely solely on your consent. If you do not tick the relevant box on the form, they will not take place, and this will not affect how we handle your enquiry.

Activities Requiring Consent

Processing your identity, contact and marketing data for marketing purposes
Sending campaigns, offers and announcements
Segmentation and targeting based on interaction data
Measuring and reporting on campaign performance
Sharing data with suppliers inside and outside the UK for these purposes

You can withdraw consent at any time, by writing to privacy@shopiyz.com or using the unsubscribe link in any message. Withdrawal does not affect the lawfulness of processing carried out before it.

Electronic Marketing

Marketing sent to you by email, SMS or telephone is governed by the Privacy and Electronic Communications Regulations 2003 (PECR) in addition to the UK GDPR, and requires its own separate consent. That is why the form presents it as a separate tick box.

Channels Covered by This Consent

Newsletters, campaigns and announcements sent by email
Information and campaign messages sent by SMS
Telephone calls for product introductions and offers

Every marketing message we send identifies us as the sender and includes a simple way to opt out at no cost. Opt-out requests are actioned without undue delay and recorded so that you are not contacted again through that channel.

Service messages (a reply to your enquiry, an appointment confirmation, invoices and service notices) are not marketing. You will continue to receive these even if you do not give this consent.

Who We Share Your Data With

Within Shopiyz, access is limited to authorised staff who need the data to do their job. We do not share your data with third parties except as set out below.

Categories of Recipient

IT infrastructure, cloud hosting and content delivery providers
Email and SMS delivery services, only where you have given the relevant consent
Customer relationship management and support software providers
Legal, accounting and independent audit advisers
Competent authorities and courts, where required by law

Because cloud infrastructure operates globally, your data may be processed in data centres outside the United Kingdom. Any such restricted transfer is made under an appropriate safeguard in Chapter V of the UK GDPR, such as UK adequacy regulations or the International Data Transfer Agreement.

How Long We Keep It

We keep personal data only for as long as the purpose requires and for any statutory limitation period, after which it is deleted, destroyed or anonymised.

Retention Periods

Enquiry records that do not progress1 year from closure of the enquiry

Records that become a customer relationship6 years from the end of the relationship

Marketing consentsUntil withdrawn; deleted in the next erasure cycle after withdrawal

Records of consent and opt-out3 years from withdrawal, as evidence of compliance

Server and security logs2 years

Your Rights

Under the UK GDPR you have the following rights in relation to your personal data:

The right to be informed about how your data is used
The right of access to a copy of your data
The right to rectification of inaccurate or incomplete data
The right to erasure where there is no longer a reason to keep it
The right to restrict processing in certain circumstances
The right to data portability for data you provided under consent or contract
The right to object to processing based on legitimate interests, and an absolute right to object to direct marketing
Rights relating to automated decision-making and profiling
The right to withdraw consent at any time, where processing relies on consent

How to Exercise Your Rights

You can exercise any of these rights by contacting us through the channels below. We may ask for information to verify your identity before we act.

Contact Channels

Emailprivacy@shopiyz.com

PostWritten request to our registered office address

We respond within one month of receiving your request, free of charge. Where a request is complex or you have made several requests, we may extend this by a further two months and will tell you why within the first month.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office at ico.org.uk. We would ask that you contact us first so we have the chance to put things right.

Changes to This Notice

We may update this notice to reflect changes in law or in how we process data. The current version is always published on this page and the effective date appears at the top.

For provisions covering personal data belonging to merchants' store customers, see our Data Processing Agreement page.

For our platform-wide data practices, see our Privacy Policy page.

Data protection team

Questions about your personal data?

Send your request to privacy@shopiyz.com and we will respond within one month.