Privacy notice

Who is responsible

BrandsShipped is operated by Kodex Bilgi Teknolojileri A.Ş. (the data controller), Altınşehir Mah. 228. Sok. No:44, 16230 Nilüfer / Bursa, Türkiye; MERSİS 0574094840500001. For privacy questions or requests, email hello@brandsshipped.com or use our registered KEP address kodexbilgi@hs01.kep.tr.

What we collect and how

• Project and contact details: the route you choose, your name, email, optional phone or WhatsApp number, country, business name if provided, product category and description, starting material or approved physical sample status, estimated quantity, and any message, timing, technical details, notes or other information you choose to give us. We collect these directly through the project or short contact form and subsequent correspondence.
• Optional files: images, videos and a PDF you select as project references, including file names and technical details. Selected files start uploading to private storage before you press “Send my project.” No project lead is created until you send the form. Unsubmitted temporary uploads are scheduled for deletion after seven days. Please avoid sensitive personal information and obtain permission before including other people in photographs or video.
• Site and security data: server request information, browser and device information, and a salted one-way fingerprint derived from the request IP address and user agent to prevent repeated submissions. We do not use that fingerprint as a public visitor profile.
• Optional analytics: only after you allow Analytics, our first-party analytics and Google Analytics loaded through Google Tag Manager collect a pseudonymous browser ID, page and interaction events, language, landing page, referring site and campaign parameters. Google Analytics may set _ga and related cookies. We may associate our first-party attribution identifier with the project you submit while Analytics permission is active. We do not send your name, email address, free-text project description or uploaded files to Google Analytics.
• Optional marketing measurement: only after you allow Marketing, we load the Meta Pixel for page-view and successful lead measurement. When you allow both Marketing and Analytics, Google advertising conversion measurement is also permitted through GA4, and Yandex Metrica measures page views and verified successful enquiries using pseudonymous visitor identifiers and campaign parameters; personalised Google advertising stays disabled. Marketing alone does not load Google Tag Manager. Meta may set _fbp and, following a Meta advertising click, _fbc. Our browser Pixel implementation does not use Automatic Advanced Matching and does not send your name, email address, free-text project description or uploaded files to Meta. Yandex Metrica receives no contact details, free-text form content or uploaded files. Session Replay, click maps and form analysis are disabled, and the counter does not save full IP addresses. The project form works if you reject Marketing.
• Project correspondence: our replies, proposal and approval communications, and operational decisions if discussions continue. For the detailed project form, we record that you acknowledged this notice and, when supplying files, confirmed your right to share them. The short contact form displays this notice beside the Send button.

Purposes and legal grounds

For requests from Türkiye, our grounds under Law No. 6698 (KVKK) are set out below. Where the EU/EEA GDPR applies to a particular interaction, the corresponding GDPR grounds are also shown. These are separate from the optional cookie choices.

• Receive and evaluate a project, communicate with you and prepare a proposal: steps requested before a contract or performance of a contract (KVKK Article 5(2)(c); GDPR Article 6(1)(b), where the individual is the contracting party). For a company representative, our legitimate interest in handling a genuine business enquiry applies (KVKK Article 5(2)(f); GDPR Article 6(1)(f)).
• Operate and protect the site, control spam and keep necessary submission and service records: our legitimate interest in a secure, reliable service (KVKK Article 5(2)(f); GDPR Article 6(1)(f)). Where a record is needed to establish, exercise or defend a right, KVKK Article 5(2)(e) and GDPR Article 6(1)(f) also apply.
• Meet applicable accounting, regulatory and other legal duties if a project proceeds: compliance with a legal obligation (KVKK Article 5(2)(ç); GDPR Article 6(1)(c), where applicable).
• Optional website analytics and attribution: your separate, affirmative Analytics choice (KVKK Article 5(1); GDPR Article 6(1)(a), where applicable).
• Optional advertising measurement: your separate, affirmative Marketing choice (KVKK Article 5(1); GDPR Article 6(1)(a), where applicable). Google conversion measurement and Yandex Metrica also require Analytics permission. You can withdraw either optional choice at any time through Cookie settings without affecting the lawfulness of earlier processing.

We use an automated priority score to help order human review of detailed project enquiries. Short contact messages are marked for manual review. A person decides whether a project is suitable and what to propose; the score does not itself accept or reject a project or create a binding decision.

Who can receive it

Authorised BrandsShipped project reviewers access enquiries through a restricted administration area. We use Supabase for database and private file storage, VPS hosting to run the website, Hostinger SMTP for short contact messages and internal alerts, Resend for receipt confirmations and some notifications, Google Analytics and Google Tag Manager only after Analytics permission, Meta Pixel only after Marketing permission, and Yandex Metrica only after both Analytics and Marketing permission. An internal notification can include contact and project details; project receipt confirmations go to the email you supply. If we discuss a specific project with production, quality or logistics partners, we share only the materials needed to assess or perform that work under the agreed project scope. We may disclose information when legally required. Uploaded project files are not public downloads, advertising assets or client case studies by default.

International processing

Our business is based in Türkiye and may receive projects from other countries. Hosting, storage, email, analytics, advertising measurement and project partners may process or access information outside your country. We assess any applicable cross-border transfer requirements under KVKK Article 9 and, where relevant, GDPR Chapter V before relying on a transfer mechanism. The applicable countries, recipients and safeguards depend on the services and project involved; ask us at the address above for the current details relevant to your information. This notice does not itself constitute consent to an international transfer.

How long we keep information

The consent preference cookie lasts 180 days. Attribution stored in your browser expires for use after 90 days, although its local record may remain until a later visit, withdrawal or browser clearing; the optional browser ID remains until withdrawal or clearing. Meta browser identifiers may persist for their applicable cookie lifetime unless you withdraw Marketing permission or clear browser storage. Unsubmitted temporary media is scheduled for removal after seven days. We retain submitted enquiries, their files and communications while assessing the request and following up, and review them when that purpose ends. If a project proceeds, the agreed project record is kept while the work is active and for any applicable accounting, legal-claims or other mandatory period afterward. Security logs and event records are kept only as needed for security, troubleshooting and accountability. The exact period for a record depends on its status, last meaningful contact, legal duties and possible claims; we delete or anonymise it when those reasons end. Contact us if you want the retention decision for a particular record.

Your choices and rights

You can use Cookie settings to allow, reject or withdraw optional Analytics and Marketing independently. Withdrawal stops future optional requests for that category and removes known related browser storage where technically possible; it does not automatically erase data already received. Under KVKK Article 11 you may ask whether and why we process your data, who receives it, request correction or deletion where the legal conditions apply, and exercise the other statutory rights. Where GDPR applies, additional rights may include access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Email hello@brandsshipped.com or use our KEP address. We may need to verify your identity before disclosing or deleting a record. You can also complain to the Turkish Personal Data Protection Authority or, where applicable, the relevant EU/EEA supervisory authority.

Security and changes

We restrict administrative access and keep project files in private storage. No internet service can promise absolute security. We update this notice when our practices materially change and show the revision date here. See the cookie and storage policy for browser item names and durations.