Privacy Policy

This Privacy Policy sets out how we collect, use, share, and protect the personal data of individuals and legal entities ("Users") who use our Shipping Integration Services through our platform ("Platform"), available at www.orbiscommerce.com ("Site"). This policy is an integral part of the Service Agreement between the User and the Platform. The Turkish version of this policy prevails in case of any discrepancy.

Data we collect and why

We may collect the following personal data during registration, integration, support requests, shipment tracking, payment, and invoicing:

• Identity and contact details: full name, e-mail, phone number, address, Turkish national ID number (for individual senders)
• Business data: company name, tax ID number, billing details
• Transaction data: order details, tracking numbers, payment and invoice data
• Technical data: IP address, device information, browser data

We use this data to provide the platform services, deliver support, handle invoicing, meet our legal obligations, improve our systems, and carry out analysis and marketing activities.

Retention and security

We keep your personal data for as long as the purposes of processing require and within the periods set by KVKK (Turkish Personal Data Protection Law No. 6698). When these periods end, or at your request, your data is securely destroyed or anonymized. We protect your data with technical measures (encryption, access control) and administrative measures (authorization, training).

Data sharing

Unless stated otherwise, we do not transfer your data to third parties without your explicit consent. Data may, however, be shared in the following cases:

• With public authorities, where required by law
• With service partners such as carriers, payment providers, and ERP/accounting systems
• With business partners providing marketing or analytics services (with your explicit consent)

These transfers are carried out under Article 8 of KVKK.

International data transfers

With your explicit consent, IP, payment, shipment tracking, technical usage data, and call center/recording data may be shared, in accordance with Article 9 of KVKK, with service providers that operate cloud infrastructure abroad. These providers follow international security standards, and the data is used only for the stated purposes.

Intermediaries and integration providers

OrbisCommerce transfers data to the e-commerce, shipping, and ERP systems it integrates with only when the User has authorized the integration. Data is shared only to provide the integration and only for use by the systems concerned.

Analytics, marketing, and statistics

Usage patterns and system performance may be analyzed in anonymized form to improve the Platform, develop new features, and market campaigns. Users who opt in may also receive information by e-mail or SMS.

Your rights and how to apply

Under Article 11 of KVKK, Users have the right to learn whether their personal data is processed; to request information about the purpose of processing and whether the data is used accordingly; to know about transfers within Türkiye or abroad; to have incomplete or inaccurate data corrected, erased, and such actions notified to recipients; to object to automated analysis; and to claim compensation for damages.

You can submit your request through the "Data Subject Application Form" on the Site. Requests are resolved within 30 days at the latest. If the process involves a cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, or the response is late or insufficient, you may file a complaint with the Board within 30 days of learning of the response, and in any case within 60 days of your application date.

Acceptable use and prohibited activities

Users of the Service may not, and may not allow any third party to:

• Create, solicit, incentivize, trade, or manipulate customer reviews, ratings, or feedback on any marketplace; send unrequested or undeclared products to customers to generate reviews ("brushing"); or offer payment or benefits in exchange for reviews.
• List, sell, distribute, or ship counterfeit, pirated, or infringing products; or use any trademark, copyrighted work, patent, or other intellectual property without the rights holder's authorization.
• Use the Service to circumvent, breach, or facilitate a breach of any agreement between a Selling Partner or Vendor and a marketplace operator, including the Amazon Services Business Solutions Agreement and Amazon program policies.
• Use data obtained through the Service for any purpose other than providing order fulfillment and logistics services to the account holder the data belongs to.
• Share account credentials, resell API access, or provide Service functionality to parties who have not accepted these Terms.

Protection of intellectual property

Users represent and warrant that they hold all necessary rights to every product listing, image, brand name, or content they submit to the Service.

We operate a notice-and-takedown procedure. Rights holders can send infringement notices to e-mail address. Reported content is reviewed within 3 business days and, if the claim is verified, removed or disabled.

Accounts that are the subject of repeated or verified infringement notices are suspended or terminated.

User or marketplace content is not modified, republished, or licensed beyond what is necessary to provide the Service.

Amazon data received through the Selling Partner API

This section applies when you connect your Amazon seller account to our Service through the Amazon Selling Partner API (SP-API).

1. What we receive. When you authorize our application, we receive the following data from Amazon on your behalf: order information (order number, order date, items, quantities, order status), shipment information needed to deliver the order (recipient name, delivery address, and phone number where provided by Amazon), and operational data such as tracking references. We do not receive buyers' payment card information.
2. Why we process it. This data is processed only to provide the shipping and logistics services you request: synchronizing your orders, creating shipping labels, arranging carrier pickup and transport, preparing customs declarations for cross-border shipments, and sending tracking information back to Amazon. We do not use this data for any purpose not disclosed to you in these terms and this notice.
3. What we never do. Amazon data is never sold, rented, or shared with third parties for their own purposes, and is never used for advertising, marketing, market research, credit scoring, or profiling buyers. We never contact buyers in any way.
4. Who can access it. Access is limited to our staff and sub-processors who need it to provide the service (for example, the carrier transporting your shipment receives only the delivery details needed for that shipment). All staff with access are bound by written confidentiality obligations, and all access to buyers' personal data is logged.
5. How long we keep it. Buyer personal data received through SP-API is kept for no more than 30 days after the shipment is delivered and is then securely deleted. Where a legal requirement (for example, customs or tax law) requires longer retention, the data is archived in encrypted form and accessed only when that legal obligation requires it.
6. How we protect it. Amazon data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Access is controlled on a least-privilege basis with individual accounts and multi-factor authentication, and monitored through audit logs and automated anomaly detection.
7. Your obligations and rights. You remain the data controller for the data of your registered sellers and buyers. You can revoke our application's authorization at any time in Seller Central; on revocation, we stop processing and delete the related Amazon data in line with item 5. For any questions or requests about this section, contact e-mail address.

Compliance with Amazon Selling Partner and Vendor agreements

Users must at all times comply with the Amazon Services Business Solutions Agreement, the Amazon Acceptable Use Policy, the Data Protection Policy, and all applicable Amazon program policies.

We do not encourage or assist Users in breaching these agreements, and we offer no functionality intended for that purpose.

Amazon Information is processed only for order fulfillment and shipping, kept only as long as necessary, and never sold, shared, or used for advertising, market research, or resale.

Where we reasonably believe a breach has occurred, we reserve the right to suspend or terminate any account without notice and, where necessary, to report the breach to Amazon.

Changes to this policy

OrbisCommerce may update this Privacy Policy from time to time. Changes take effect on the date they are published on the Site. Users can always access the current version of the policy on the Site.