Privacy Policy
This notice explains, in line with Art. 13 of the EU General Data Protection Regulation (GDPR) and Art. 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK), which personal data is processed when you visit parfumedia.net, for what purposes and on what legal basis.
Data controller
The data controller is Parfumedia. For any question or request about your personal data: [email protected].
In short
- Parfumedia has an optional account. You can use the whole site without one. Accounts are opened with your Google account only; we keep no passwords.
- We don’t sell or rent your personal data or share it for advertising.
- Analytics cookies are used only if you consent.
What we process, why, and on what legal basis
| Data | Service / source | Purpose | Legal basis |
|---|---|---|---|
| IP address, browser and device information, requested page, date and time | Cloudflare (content delivery and security) | Delivering the site quickly and securely; preventing attacks and abuse | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| IP address, requested page, date and time, error logs | Server logs | Operating the site, detecting and fixing errors, security | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Pages viewed, referring site, approximate location (country/city), device and browser type, cookie identifiers | Google Analytics 4 (gtag.js), only if you consent | Understanding and improving how the site is used | Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) |
| Your compare list, cookie choice, the Like / Not for me marks you give without signing in and the scent finder result you save, your riddle game and stats | Your browser’s local storage (localStorage). For the match score the marks and the finder result are sent to our server, the score is calculated and nothing is stored | Providing the features you use, remembering your choice and calculating the match score | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Your e-mail address and the content of your message | When you e-mail us | Answering your question or request | Legitimate interest; legal obligation for data subject requests (GDPR Art. 6(1)(f), 6(1)(c); KVKK Art. 5(2)(f), 5(2)(ç)) |
| Google account identifier, verified e-mail address, name, profile photo link | Sign in with Google (from Google, at sign-in) | Creating your account and recognising you | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Your collection lists (have, had, want, tried) and your own votes (overall, longevity, sillage, seasons) | What you enter | Providing the collection and voting features; showing the average of member votes on perfume pages (only from 10 votes, never per person) | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Username and public profile setting | What you enter | Showing your collection lists to everyone under a username, only if you turn it on | Consent, which you can withdraw at any time by turning the profile off (GDPR Art. 6(1)(a); KVKK Art. 5(1)) |
| Session cookie and session record (only a hashed form), time of last use | Our servers | Keeping you signed in and protecting your account from unauthorised access | Performance of a contract and legitimate interest (GDPR Art. 6(1)(b), 6(1)(f); KVKK Art. 5(2)(c), 5(2)(f)) |
| IP address of sign-in requests | Our servers | Preventing abuse (limiting attempts) | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Your Like / Not for me marks and the scent finder result you choose to save | What you enter | Showing you a personal match score and scent identity | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Results of the riddles you finish (riddle number, solved or not, number of guesses) | Your playing the riddle | Showing your streak and stats on any device | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
Data is collected automatically through the requests and cookies your browser sends when you visit the site, and from you directly when you e-mail us.
Public profile
Your profile is private by default. If you turn it on, only your username and your collection lists are shown; your name, e-mail and votes are not. These pages are closed to search engines. You can turn the profile off at any time A public profile also shows the scent identity calculated from your collection lists (leading accords and notes); your votes, marks and scent finder answers are not shown While your profile is public, other members whose profile is also public can compare their profile with yours. Only both sides’ public collection lists are used; your votes, marks and scent finder answers are not. The result (match percentage, shared notes, suggestions) is not stored and is shown only to the member who compares. That member may share an image showing both usernames, the match percentage and the shared notes. When you make your profile private, nobody can compare with you.
Riddle
When you are signed in, the number of each riddle you finish, whether you solved it and how many guesses you made are saved to your account; the perfumes you guessed are not saved. When you sign in, the riddle history in this browser is added to your account once. Your streak and stats are shown to you only. Deleting your account deletes these results too; your data download includes them.
Match score
When you sign in, the marks in your browser and the finder result you saved are copied to your account once. The match score is only shown in your own browser; it never enters the copy of the pages served to everyone and is never given to search engines. When you delete your account, the marks and the finder result are deleted too; the data download includes them.
Sign in with Google
To sign in you are sent to Google’s page. Google tells us that you signed in and passes the data listed above. Google’s own processing is covered by Google’s privacy policy. We ask for no other access to your Google account and keep no Google access token.
Service providers and transfers abroad
Personal data is processed by the following service providers, limited to the purposes stated above:
- Contabo GmbH (Germany, EU): rented servers on which the website and the API run; hosting and server logs.
- Cloudflare, Inc.: content delivery (CDN), security, DNS and e-mail routing; e-mails sent to [email protected] are forwarded via Cloudflare Email Routing.
- Google (Google Ireland Limited / Google LLC): authentication if you sign in with Google; analytics with Google Analytics 4, only if you consent; and the mailbox hosted by Google (Gmail) that receives the forwarded e-mails.
Our servers are located in Germany, so data is transferred outside Turkey; Cloudflare’s and Google’s servers may also be located in other countries, including the United States. Under the KVKK these transfers follow the conditions and procedure of Art. 9; under the GDPR, transfers outside the EU rely on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses. Transfers for analytics only take place if you consent.
Retention
- Server logs: kept only as long as needed for security and troubleshooting, then deleted.
- Cloudflare logs: according to Cloudflare’s retention policies.
- Google Analytics 4: event data is kept for at most 14 months; the _ga and _ga_<container-id> cookies stay in your browser for at most 2 years.
- E-mail correspondence: after your request is resolved, for as long as needed in case of disputes.
- Compare list and cookie choice: stay in your browser until you delete them.
- Account, collection and votes: until you delete your account.
- Session records: expire 30 days after last use; expired records are deleted.
- Like / Not for me marks and the saved scent finder result: until you delete your account or remove them. Without an account: only in your browser until you delete them.
- Riddle results: until you delete your account. When you play without signing in: in your browser only, until you clear it.
- A deleted account can remain in database backups until they rotate out (at most 28 days); backups are only used to restore after a failure.
Your rights
Under the GDPR (Art. 15-21) you have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. You can withdraw consent at any time without affecting the lawfulness of processing before the withdrawal.
Under KVKK Art. 11 you may also ask whether your data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties it is transferred to in Turkey or abroad, request correction, erasure or destruction and notification of these to third parties, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.
If you have an account, you can download all your data (JSON) from your profile page and delete your account with one click and a confirmation. Deletion removes your account, sessions, collection and votes immediately and for good.
How to exercise your rights
Send your request by e-mail to [email protected]. We may ask for additional information to verify your identity. We respond free of charge within 30 days at the latest (GDPR Art. 12; KVKK Art. 13). You have the right to lodge a complaint with a data protection supervisory authority in the EU/EEA, and, under the KVKK, with the Turkish Personal Data Protection Board (KVKK Art. 14).
Changes
We may update this notice when needed. The current version is always on this page; the date of the last update is shown at the top.