Privacy Policy

HEKTOR'S NUTRITION (Giyimkent 10. Sokak, Giyimkent B105 Blok No:23 A, 34235 Esenler / Istanbul, Türkiye) is the data controller under this policy.

At checkout: your name, delivery/billing address, phone number and email.

When you create an account: your email and password (passwords are stored using irreversible encryption).

In your order history: products purchased, order amount and status.

Technically: an anonymous session identifier assigned to your browser to keep your cart/session working, and your theme/language preference (see Cookie Policy).

Your payment details never reach us — they're processed directly by iyzico's secure infrastructure; we never store card numbers, expiry dates or CVV codes.

Personal data is collected electronically through the forms and interfaces on our site. It is processed under KVKK Art. 5 on the basis of contract formation and performance (order processing), our legal obligations (invoicing, consumer arbitration procedures, etc.), and, where applicable, your explicit consent (e.g. newsletter sign-up).

To process and deliver your orders.

To respond to support requests and return/exchange applications.

To meet legal invoicing and accounting obligations.

Where you've opted in, to send newsletter emails about new products and campaigns.

For security checks aimed at preventing fraud and misuse.

Personal data is shared with the couriers we use to deliver your order (Sürat Kargo, HepsiJET) — limited to the name, address and phone number needed for delivery,

with iyzico, our payment provider, to collect payment,

and with competent public authorities where required by law (court order, official request, etc.). Beyond this, personal data is not shared with or sold to third parties.

Personal data is retained for the periods required by applicable law (e.g. 5 years for invoice/accounting records under the Tax Procedure Law) and for as long as needed for the purpose it was collected for, after which it is deleted, destroyed or anonymised.

We take reasonable technical and administrative measures to protect personal data against unauthorised access, loss or misuse (encrypted transmission via HTTPS, access restrictions, irreversible password hashing, and similar controls).

For the full list of rights under Article 11 of the KVKK, see our Personal Data Protection Notice page. You can send requests to hektor@hektors.com.tr.

This policy may be updated to reflect changes in law or in our data processing activities. The current version is always published on this page.