Privacy Policy

Note: The German version of this privacy policy is the legally binding version. This English translation is provided for convenience and information purposes only. As of: November 2026

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws and other data protection provisions is: Company: DVA Verlag UG (haftungsbeschränkt) Managing director: İlker Kuscu Address: Schwachhauser Heerstr. 179, 28211 Bremen, Germany Email: info@istanbulbooks.com Websites: istanbulbooks.com | dva-yd.com Our company has no statutory obligation to appoint a company data protection officer under Art. 37 GDPR or § 38 BDSG.

2. Provision of the website and hosting (server log files)

When you visit our website, the internet browser on your device automatically sends information to our hosting provider's web server. This data is stored temporarily in so-called server log files: • IP address of the requesting computer • Date and time of the server request • Name and URL of the file or subpage retrieved • Website from which the access is made (referrer URL) • Browser used, with version, and the operating system of your device • Name of your internet access provider Purposes and legal basis: The IP address and the connection data listed above are processed to ensure a smooth connection, to safeguard system stability and security, and for administrative purposes. The legal basis is Art. 6(1)(f) GDPR (legitimate interest of the operator). Hosting infrastructure: The web server is provided through RNG Technology and operated in a data centre of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). A data processing agreement (AVV) under Art. 28 GDPR has been concluded with the provider. Local hosting of fonts and media files: All fonts and audio elements are loaded exclusively from our own servers. No data is exchanged with external third-party servers (such as Google Fonts or external content delivery networks).

3. Use of cookies

Our website uses only technically necessary cookies. These are small text files stored on your device to make the basic functions of the online shop technically possible (e.g. keeping the contents of the shopping cart, managing the session, processing the secure checkout and preventing fraud during payment processing). We expressly do not use tracking, analytics or marketing cookies. The legal basis for storing and reading technically required information on your device is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

4. Customer account and order processing

a) Customer account Customers may optionally create a password-protected user account on our platform. We collect the mandatory details requested in the registration form (including name, address and email address). Order histories, invoice retrievals and wish lists are also kept in the customer account. The legal basis is Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures). The user can delete the customer account at any time unless statutory retention periods prevent this. b) Guest order Orders can alternatively be placed without creating a permanent customer account. In this case we process your order data solely for the purpose of handling the order in question. c) Transfer to vicarious agents (printing and logistics) For on-demand printing, order picking and the postal shipment of the books ordered, we transfer the necessary delivery and order data (first and last name, delivery address, items ordered) to our distribution partner: Books on Demand GmbH (BoD) / Libri GmbH In de Tarpen 42, 22848 Norderstedt, Germany The data is transferred strictly for this purpose on the basis of Art. 6(1)(b) GDPR in order to perform the purchase contract.

5. Payment service provider: Stripe

To process electronic payments securely, we use the services of the licensed payment service provider Stripe: Stripe Payments Europe, Ltd. 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland During the payment process, your payment and transaction data (e.g. card details, IBAN/bank details, invoice amount, IP address) are transmitted directly to Stripe over an encrypted SSL/TLS connection and processed there. Stripe uses its own technically required cookies to ensure transaction security and detect fraud. The legal basis for this processing is Art. 6(1)(b) GDPR (payment processing) and Art. 6(1)(f) GDPR (fraud prevention and payment security). Any transfer to the parent company Stripe Inc. in the USA takes place on the basis of the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.

6. Email communication and system messages

If you contact us by email or receive system messages in connection with a book order (e.g. order or shipping confirmations), these are processed through our business email infrastructure at Microsoft 365 (provided via GoDaddy): Microsoft Ireland Operations Limited One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland The legal basis is Art. 6(1)(b) GDPR (initiation/performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in smooth and secure business communication).

7. Storage period

We generally process and store personal data only for as long as is necessary to achieve the purpose of the processing. Once the purpose has been fulfilled the data is deleted, unless statutory retention obligations prevent this. In particular, accounting records and invoice data relevant to tax and commercial law are subject to a statutory retention period of up to 10 years under § 257 HGB and § 147 AO.

8. Rights of data subjects

As a data subject you have extensive rights under the GDPR: • Access (Art. 15 GDPR): the right to information about the personal data processed. • Rectification (Art. 16 GDPR): the right to have inaccurate or incomplete data corrected without delay. • Erasure (Art. 17 GDPR): the right to erasure (“right to be forgotten”) unless retention obligations prevent this. • Restriction (Art. 18 GDPR): the right to restrict processing under certain conditions. • Data portability (Art. 20 GDPR): the right to receive the data in a common, machine-readable format. • Objection (Art. 21 GDPR): the right to object to processing based on legitimate interests (Art. 6(1)(f) GDPR). Right to lodge a complaint with the supervisory authority (Art. 77 GDPR): You have the right to complain to a data protection supervisory authority about the processing of your personal data. The state supervisory authority responsible for our company is: Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen Arndtstraße 1, 27570 Bremerhaven, Germany Phone: +49 421 3612010 Email: buero@datenschutz.bremen.de Website: datenschutz.bremen.de