Privacy Policy

JTR — Jewellery Technology Research (“JTR”, “we”, “us”, “our”) designs and builds diamond-detection instruments, operates accredited gemology laboratories, runs the JTR Academy, and sells and supports these products and services through this website and store (together, the “Services”). This Privacy Policy explains what personal data we collect, why we process it, whom we share it with, how long we keep it, and the rights you have over it — including data you share with us through messaging channels such as WhatsApp, Facebook Messenger and Instagram.

We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where it applies to you, the EU General Data Protection Regulation (2016/679) and the UK GDPR (together, “GDPR”). Where this Privacy Policy and our Terms & Conditions conflict on the handling of personal data, this Privacy Policy controls.

Please read this Privacy Policy carefully. By using the Services or communicating with us, you acknowledge that you have read and understood it.

1. Who Is Responsible for Your Data (Data Controller)

The data controller (veri sorumlusu under the KVKK; “controller” under the GDPR) that determines the purposes and means of processing your personal data is:

You can contact us about any data-protection matter, or to exercise your rights, using the details above or in Section 15. If you require our registered establishment, VERBİS registration or KEP (registered electronic mail) address for a formal KVKK application, or the details of our representative in the European Union or United Kingdom, we will provide them on request.

2. Personal Data We Collect or Process

Depending on how you interact with us, we may collect or process the following categories of personal data, together with any inferences drawn from it:

• Identity and contact details — name, company/organisation, billing and shipping address, country, phone number and email address.
• Account information — the credentials and profile you hold in the myJTR identity system, your preferences and settings. Authentication is provided by the myJTR identity system; one login works across the store, the myReveal app and the my.jtr portal.
• Order and transaction information — the products, equipment, course seats or services you view, add to your cart, purchase, pre-order, return, exchange or cancel, and your transaction history.
• Payment information — payment-card and financial-account details, transaction and confirmation details. Card data is collected and processed directly by our payment providers (see Section 8); we do not store full card numbers on our own systems.
• Communications and messaging data — the content of your enquiries, support requests, course and distributor leads, reviews, and the messages you exchange with us over email and over messaging platforms (WhatsApp, Facebook Messenger, Instagram) — see Section 6.
• Grading and verification data — report numbers you look up to verify a JTR report, and related enquiry details.
• Device and usage information — device, browser and network details, IP address and other identifiers, and information about how you interact with and navigate the Services.
• Marketing data — your consents, preferences and history of engagement with our communications.

We do not seek to collect special categories of personal data (such as health, biometric or religious data). Please do not send us such data through any channel unless we specifically request it and set out a lawful basis for doing so.

3. Where We Obtain Your Data

• Directly from you — when you create an account, place an order, reserve a course seat, submit a lead or review, verify a report, or contact us by any channel.
• Automatically — from your device and through cookies and similar technologies when you use the Services.
• From our service providers and platforms — including payment providers, hosting and IT providers, and the messaging platforms through which you contact us (see Sections 6 and 8).
• From our partners — such as authorised distributors, where you engage with JTR through them.

4. Why We Process Your Data (Purposes)

• Providing the Services. Creating and managing your account, processing payments, fulfilling and shipping orders, managing pre-orders, returns and refunds, registering devices in your my.jtr portal, managing course reservations and bookings, and verifying JTR reports.
• Customer support and communication. Responding to your enquiries and support requests across all channels, including WhatsApp, Messenger and Instagram, and maintaining our business relationship with you.
• Marketing and advertising. Sending you commercial communications and showing you relevant advertising, only where you have consented or where permitted by law, and always with a means to opt out.
• Security and fraud prevention. Authenticating access, securing payments and the Services, and detecting, investigating and preventing fraudulent, unsafe, unlawful or malicious activity.
• Improving the Services. Understanding how the Services are used, and developing and improving our products, laboratories and education programs.
• Legal and regulatory compliance. Meeting our accounting, tax, consumer-protection and other legal obligations, and responding to lawful requests and legal claims.

5. Legal Bases for Processing

We only process personal data where we have a lawful basis to do so. Under the KVKK (Articles 5 and 6) and the GDPR (Article 6), we rely on the following bases, depending on the purpose:

• Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) — to provide the Services, fulfil your orders and bookings, and support you as a customer.
• Compliance with a legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(a) and (ç)) — for accounting, tax, invoicing and other statutory duties.
• Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) — to secure the Services, prevent fraud, respond to enquiries you initiate, keep records, and improve our products — balanced against your rights and freedoms.
• Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) — for marketing communications, non-essential cookies, and any processing that is not covered by another basis. Where we rely on consent, you may withdraw it at any time without affecting processing carried out beforehand.

6. Messaging Platforms — WhatsApp, Messenger and Instagram

You can reach JTR through third-party messaging services operated by Meta Platforms — WhatsApp (including the WhatsApp Business Platform), Facebook Messenger and Instagram Direct. If you contact us on these channels, we process the following as part of that conversation:

• Your profile identifiers on the platform — such as your display name, WhatsApp phone number, or Facebook/Instagram handle and profile picture, as made available to us by the platform.
• The content of your messages — the text, images, documents, voice notes and other media you send, our replies, and message metadata such as timestamps and delivery/read status.
• The context of your enquiry — for example the product, order, report number or course your message relates to, so that our support team can help you.

Why. We use messaging data to respond to your enquiries, provide order and product support, arrange bookings and appointments, and — only where you have opted in — send you permitted business or promotional messages. Our legal bases are performance of a contract and our legitimate interest in responding to conversations you start; for marketing messages we rely on your consent.

Meta’s role. The messaging platforms are provided by Meta, which transmits and processes your messages as the platform operator under its own terms and privacy policy. WhatsApp messages are protected by end-to-end encryption in transit. When you message us, Meta processes that interaction in accordance with its own WhatsApp and Meta privacy policies, over which we have no control. We receive and store a copy of the conversation in our own customer-support systems to serve you and keep a record of our correspondence.

What we do not do. We do not sell your messaging data, and we do not share the contents of your messages with third parties for their own marketing. We use messaging data only for the purposes described here and share it only with the processors that operate our support systems (Section 8).

Retention. We keep messaging records for as long as needed to resolve your enquiry and to keep a reasonable record of our dealings with you, and then delete or anonymise them in line with Section 12. You can ask us to delete your conversation with us at any time (Section 10), and you can manage or delete messages on your own device through the platform.

7. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Services, remember your preferences and locale, keep your cart, secure sign-in, and — with your consent — to measure usage and support marketing. Strictly necessary cookies are used on the basis of our legitimate interest in providing a working, secure website; all other categories are used only with your consent, which you can manage or withdraw at any time. You can also control cookies through your browser settings, though disabling some may affect how the Services work.

8. How We Disclose Personal Data

We share personal data only where necessary and under appropriate safeguards, including with:

• Payment providers — Stripe (international) and iyzico (Türkiye) process card payments and, where applicable, instalments (taksit) and local tax; card data is handled directly by them.
• Hosting, IT and cloud providers — including Microsoft Azure, which hosts the Services and stores our data.
• Messaging and communication providers — Meta Platforms (WhatsApp, Messenger, Instagram) and our email and support-system providers, as described in Section 6.
• Logistics and fulfilment partners — couriers (e.g. DHL, FedEx, UPS) to ship and track your orders.
• Analytics and marketing providers — where you have consented, to help us understand usage and reach relevant audiences.
• Professional advisers and authorities — accountants, auditors and legal advisers, and public authorities where we are legally required to disclose data.
• Corporate transactions — a buyer or successor in the event of a merger, acquisition, reorganisation or similar event, subject to this Privacy Policy.

Our providers act as our processors (veri işleyen) and are bound by contracts requiring them to protect your data and use it only on our instructions, except where they act as independent controllers under their own policies (such as Meta and our payment providers).

9. International Transfers

JTR operates across Türkiye, the European Union and the United States, and some of our providers are located abroad. This means your personal data may be transferred to, stored in, or accessed from countries other than the one you live in. Where we transfer personal data internationally, we rely on a lawful transfer mechanism:

• Under the KVKK, transfers abroad are made on the bases permitted by Article 9 — including your explicit consent where required, an adequacy decision, or appropriate safeguards such as a written undertaking approved by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or binding corporate rules.
• Under the GDPR, transfers outside the EEA or the UK are made under an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum / IDTA), together with any additional measures required.

10. Your Rights

Subject to the conditions and exceptions in applicable law, you have the following rights over your personal data.

Under the KVKK (Article 11), you may: learn whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; learn the third parties to whom it is transferred at home or abroad; request correction of incomplete or inaccurate data; request its erasure or destruction; request that these actions be notified to third parties to whom the data was transferred; object to a result arising solely from automated analysis of your data; and claim compensation for damage arising from unlawful processing.

Under the GDPR (Articles 15–22), you may: access your data; have it rectified; have it erased; restrict or object to its processing; receive it in a portable format; withdraw consent; and not be subject to solely automated decisions with legal or similarly significant effects.

How to exercise your rights. Contact us using the details in Section 15. KVKK applications may be made in writing or through the methods set out in the Communiqué on Application Procedures, including via your registered electronic mail (KEP) address; we respond within the statutory period (at most 30 days). We may need to verify your identity before acting on a request, and you may appoint an authorised agent. We will not treat you unfairly for exercising your rights.

11. Automated Decision-Making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Some fraud-prevention and security checks are automated, but they do not by themselves determine outcomes without human involvement where required by law.

12. Security and Retention

We take appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, disclosure or alteration, including access controls, encryption in transit, and secure hosting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; please avoid sending sensitive information over unsecured channels.

We keep personal data only for as long as necessary for the purposes set out in this Privacy Policy — typically for the duration of your relationship with us and thereafter for the periods required to meet legal, accounting, tax and dispute-resolution obligations. When data is no longer needed, we delete or anonymise it, and we destroy it in line with our KVKK retention-and-destruction policy (saklama ve imha politikası).

13. Children’s Data

The Services are intended for businesses and adults and are not directed at children. We do not knowingly collect personal data from children under the age of majority in your jurisdiction. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Complaints

If you have concerns about how we handle your personal data, please contact us first using the details below so we can address them. You also have the right to lodge a complaint with a supervisory authority — in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu); in the EEA, your local data protection authority; and in the UK, the Information Commissioner’s Office (ICO).

15. Contact

For any question about this Privacy Policy, our data practices, or to exercise your rights, please contact us:

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal or regulatory reasons. We will post the revised version here, update the “Last updated” date above, and provide any further notice required by applicable law.