Privacy Policy

TicariHub (ticarihub.com) is operated by the business below. It is the data controller for the personal data described in this policy under the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

Loading company details…

This policy covers the TicariHub website and the TicariHub panel. It is the English version of our privacy practices; the same processing is described in Turkish in our Gizlilik Politikası and our KVKK Aydınlatma Metni. Section 7 explains in detail how we handle data that we receive from Amazon.

• Account information: name, e-mail address, phone number and company details (trade name, tax or Turkish ID number, tax office) of the people who use TicariHub.
• Business data: orders, invoices, products, stock and customer records that users enter or that are imported from the sales channels and services they connect. Orders can contain the personal data of the seller’s own customers (name, contact details and addresses), which is needed to ship the order and to issue the invoice.
• Technical data: IP address, browser and device information, session records, login history (with approximate location) and security logs.
• Online identifiers on our public pages: a randomly generated visitor number and browser storage records; Google Ads cookie identifiers and the ad click identifier only if you choose “Accept” in the cookie banner.

We use personal data to:

• set up, provide and maintain the service and the user’s account;
• run the marketplace, e-invoice, carrier and other integrations that the user connects, and process orders and invoices;
• keep the service secure and prevent unauthorised access;
• answer requests and provide support;
• only with your consent (“Accept” in the cookie banner): measure whether our advertising works (Google Ads) and analyse clicks and anonymous screen movements on our public pages;
• meet our legal obligations.

Under KVKK Article 5, we rely on the performance of a contract, compliance with a legal obligation, our legitimate interests (without harming your fundamental rights), and, where required, your explicit consent. We do not sell or rent personal data.

We use essential cookies and browser storage to keep you signed in, keep the service secure and remember your choices. Only if you choose “Accept” in the cookie banner, on our public pages we also record clicks and an anonymous recording of screen movements (text typed into forms is masked), and we load the Google Ads tag to measure our advertising. The tag tells Google that an account was created or a “Call me back” request was left, and on every page where it loads it sends Google a technical measurement signal (page address and title, the referring site’s domain only, your consent status and Google’s ad cookie identifier). Your name, e-mail address and phone number are never sent to Google. Google may process this data on servers outside Türkiye.

If you choose “Only Essential”, none of this runs. Nothing is recorded and no advertising tag runs inside the panel after you sign in. The full list of cookies and storage records is in our Turkish Çerez Politikası (Cookie Policy).

We share personal data only as far as each purpose requires, with:

• the services that the user connects to TicariHub (marketplaces, e-invoice providers, carriers and accounting software);
• the suppliers that run our infrastructure (server hosting and e-mail delivery);
• Google LLC, only if you gave consent in the cookie banner, to measure our advertising;
• public authorities and courts, where the law requires it.

Invoices are issued through the user’s own e-invoice provider account, so invoice data is also processed by the provider the user chose.

The personal data of Amazon buyers is shared only as described in section 7.3.

This section applies when a seller connects their own Amazon seller account to TicariHub through the Amazon Selling Partner API. “Amazon data” means any information we receive from Amazon for that seller, including the personal data of Amazon customers.

7.1 What Amazon data we access

• Order data: Amazon order ID, order status, purchase date, order total and currency, fulfilment channel, and the order items (product title, SKU, ASIN, quantity, item and shipping prices, discounts and taxes).
• Buyer data: buyer name, the buyer e-mail address supplied by Amazon, and the shipping address with phone number; if the buyer gave them, the billing name, tax or Turkish ID number and tax office. This is restricted data: we request it with a Restricted Data Token limited to buyer information and shipping address, and only once Amazon has approved our restricted role. Until then the buyer name stays masked.
• Listing data: the seller’s own listings (SKU, title, price, quantity, ASIN) and the fulfilment channel of a listing.
• Seller account data: the seller’s selling partner ID and the authorization token that Amazon issues to TicariHub.

We do not receive buyers’ payment details. We do not request Amazon data that our features do not need.

7.2 Why we use it

We use Amazon data only to:

• fulfil the seller’s own orders: show the orders in the seller’s panel, create the seller’s shipment with their carrier, confirm the shipment on Amazon and keep the seller’s Amazon stock accurate;
• issue the Turkish tax invoice: Turkish tax law requires an e-invoice (e-Arşiv or e-Fatura) with the buyer’s name and address for each sale. We prepare it for the seller and, where Amazon supports it, upload it to the Amazon order.

We never use Amazon data for marketing or advertising, and we never sell it. In TicariHub, Amazon data is shown in the seller’s signed-in panel, where no analytics, session recording or advertising tags run.

7.3 Who we share it with

Amazon buyer personal data is shared with these parties, each only for the purpose described:

1. The seller’s own e-invoice provider (for example Kolaybi or Uyumsoft), to issue the legally required invoice for the order. We send the buyer’s name and invoice address, the tax or ID number and tax office if the buyer gave them, the buyer’s e-mail address and phone number if available, and the order lines and amounts. The provider transmits the invoice to the Turkish Revenue Administration (GİB), as the law requires.
2. The seller’s own carrier (for example Aras, Yurtiçi or MNG), when the seller creates a shipment. We send the recipient name, shipping address and phone number if available.
3. Amazon. The PDF of the issued invoice is uploaded to the Amazon order, in the Amazon stores that support invoice upload.
4. Our hosting provider. The application and database run on a dedicated virtual server in Türkiye that we administer. The hosting company provides the machine and has no application-level access.

Apart from these parties, Amazon buyer personal data is disclosed only to public authorities and courts where Turkish law requires it, and in one case that the seller chooses: if the seller e-mails an Amazon invoice to another address themselves (for example to their accountant), the e-mail, with the invoice PDF attached, is delivered through our e-mail delivery provider (Resend).

Transfers to the parties in items 1 to 3 are made over encrypted connections (HTTPS/TLS) to their official APIs, using the seller’s own credentials or the authorization the seller granted. We do not share Amazon data with advertisers, analytics or marketing services.

What we do not do with Amazon buyer data:

• TicariHub does not send e-mails, SMS or WhatsApp messages to Amazon buyers. The invoice reaches the buyer through Amazon.
• We do not open a separate customer record for each Amazon buyer. Amazon sales are recorded under one shared customer record (“Amazon Müşterileri”, Amazon Customers) that holds no personal data.
• The optional transfer to the seller’s own accounting software and the accounting and Excel exports show this shared record as the buyer of Amazon invoices. They carry no Amazon buyer data: the buyer’s name, tax or ID number, address, e-mail address and phone number are not transferred.
• The panel does not offer a bulk export of Amazon buyer data.

7.4 How we protect it

• Encryption at rest: Amazon buyer personal data (name, e-mail address, phone number, shipping and billing addresses, billing name, tax or Turkish ID number and tax office) is encrypted field by field with AES-256-GCM before it is written to our database. The recipient details and the shipping label on shipment records are encrypted in the same way. The invoice PDF of an Amazon order is not stored in TicariHub; it is fetched from the seller’s e-invoice provider each time it is opened. The authorization tokens Amazon issues, and all other integration credentials, are encrypted in the same way.
• Keys: encryption keys are kept outside the database and outside the source code repository, in the server’s protected configuration.
• Backups: database backups are encrypted with AES-256 before they are stored.
• In transit: all connections use TLS 1.2 or 1.3; plain HTTP is redirected to HTTPS, and HSTS is enabled.
• Access: each seller sees only their own company’s data. Every request is checked on the server against the user’s company membership, and requests without a valid company are refused. The database and internal services cannot be reached from the internet; only TicariHub’s administrator can access the production servers, using SSH keys.
• What we log: panel login attempts (successful and failed, with IP address and device information, and with approximate location for successful logins), an administrator switching into a seller’s account, each opening of an order’s details (Amazon orders included), and these invoice actions: invoice cancellations that the e-invoice provider refused or that were confirmed as done outside TicariHub, and marking an order as “invoiced elsewhere”. These records include the user who acted and the time.

7.5 How long we keep it

Amazon buyer personal data — name, e-mail address, phone number, shipping and billing addresses, billing name, tax or Turkish ID number and tax office, and the recipient details and shipping label on shipment records — is deleted automatically at most 30 days after the order ships, whatever the invoice status of the order. Cancelled and returned Amazon orders follow the same 30-day clock.

The issued tax invoice must contain the buyer’s name and address, and Turkish tax and commercial law require invoices and the related accounting records to be kept for the legal retention periods. The invoice is kept by the seller’s e-invoice provider. Return documents that are legal records (for example an expense voucher, “gider pusulası”) keep the other party’s details, which stay stored encrypted.

7.6 Security incidents

If we detect a security incident that involves Amazon data, we notify Amazon at security@amazon.com within 24 hours of detecting it. If personal data is affected, we also notify the Turkish Personal Data Protection Authority (KVKK) within 72 hours, as the law requires. Our written incident response plan covers containment, investigation, credential rotation and recovery from encrypted backups.

7.7 Requests from Amazon customers

If you bought from a seller who uses TicariHub, you can ask us whether we process your personal data, ask for a copy, and ask us to correct it, delete it or stop processing it. Write to the contact details on our English overview page, if possible with your Amazon order number. You can also contact the seller you bought from. We reply within 30 days. We cannot delete data that the law requires us to keep, such as issued tax invoices; if that applies, we tell you.

All traffic is encrypted with TLS. Passwords are stored only as bcrypt hashes. Users can turn on two-step verification (authenticator app or e-mail code). Repeated failed logins lock the account temporarily, and logins, registrations and token refreshes are rate limited per IP address. A new device or a new country at login triggers an e-mail alert to the account owner. Each company’s data is isolated from other companies. Customer contact details on orders and all integration credentials are encrypted at rest with AES-256-GCM, and backups are encrypted. More details are on our Turkish Güvenlik (Security) page.

We keep personal data for as long as the service is provided and for the retention periods required by law, in particular Turkish tax and commercial law. When these periods end, the data is deleted, destroyed or anonymised. When a user closes their account, data that we are not legally required to keep is deleted or anonymised within a reasonable time.

For orders from sales channels other than Amazon, a daily job deletes the buyer’s personal data from the order record (name, e-mail address, phone number, shipping and billing addresses) once the order has been invoiced, cancelled or returned and at least 30 days have passed since the order date. Amazon orders follow the stricter rule in section 7.5.

Under KVKK Article 11 you have the right to:

• learn whether your personal data is processed, and request information about it;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom the data is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for the data to be deleted or destroyed under the conditions of KVKK Article 7;
• ask for corrections and deletions to be notified to the third parties the data was transferred to;
• object to a result against you that comes only from automated analysis;
• claim compensation for damage caused by unlawful processing.

Send your request by e-mail to the contact details on our English overview page, or in writing to the address in section 1, with information that identifies you. We answer within 30 days (KVKK Article 13). If your request is rejected, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

We may update this policy from time to time and announce important changes in the platform. The date at the top of this page shows when it was last updated.

For questions about this policy or about Amazon data, write to the contact details on our English overview page. Our postal address is in section 1. See also our Terms of Service and the English overview of TicariHub.