Personal Data Protection Notice (KVKK)

HEKTOR'S NUTRITION acts as the "Data Controller" under the KVKK.

Address: Giyimkent 10. Sokak, Giyimkent B105 Blok No:23 A, 34235 Esenler / Istanbul, Türkiye

MERSİS No: [MERSIS NUMBER] · Tax Office / No: [TAX OFFICE AND TAX NUMBER] · Trade Registry No: [TRADE REGISTRY NUMBER]

Email: hektor@hektors.com.tr · Phone: +90 212 438 21 45

Identity data: first and last name.

Contact data: address, phone number, email.

Customer transaction data: order contents, order history, return/exchange requests.

Transaction security data: session identifier, IP address, hashed password.

Marketing data (only with explicit consent): newsletter subscription preference.

Note: card payment data is never processed or stored by the Data Controller — it is processed directly by our payment provider, iyzico.

Carrying out order and delivery processes,

Fulfilling contractual and legal obligations (invoicing, right-of-withdrawal/return processes, consumer-law compliance),

Managing customer relationships and responding to support requests,

Where explicit consent is given, sending commercial electronic messages about products and campaigns,

Carrying out information-security processes and managing legal disputes.

Personal data is collected electronically, by automated means, through the membership, order and contact forms on hektors.com.tr.

Legal bases: KVKK Art. 5/2-c (necessary for the establishment/performance of a contract — order processing), Art. 5/2-ç (necessary to fulfil the data controller's legal obligation — invoicing/accounting), Art. 5/2-e (necessary for the establishment, exercise or protection of a right — returns/dispute processes), and, where given, explicit consent under Art. 5/1 (newsletter emails).

Our partner couriers (Sürat Kargo, HepsiJET), limited to what's needed for delivery,

Our payment provider, iyzico, to collect payment,

Competent public authorities (courts, consumer arbitration committees, etc.) where legally required,

in accordance with the conditions of Articles 8 and 9 of the KVKK. Personal data is not shared with any other third party, domestically or abroad, beyond what's described here.

Personal data is retained for the periods required by applicable law (e.g. invoice records for 5 years under the Tax Procedure Law) and for as long as the processing purpose requires, after which it is deleted, destroyed or anonymised.

Under Article 11 of the KVKK, by applying to the Data Controller, you have the right to:

a) learn whether your personal data is processed, b) request information if it has been, c) learn the purpose of processing and whether it's used accordingly, ç) know the third parties to whom it is transferred domestically or abroad, d) request correction if processed incompletely or incorrectly, e) request its deletion or destruction within the conditions of KVKK Art. 7, f) request that corrections under (d) and (e) be notified to third parties the data was transferred to, g) object to a result that is to your detriment arising from analysis exclusively via automated systems, ğ) claim compensation for damages arising from unlawful processing.

To exercise the rights above, send a written request to hektor@hektors.com.tr (including via registered email/KEP) or apply in writing to Giyimkent 10. Sokak, Giyimkent B105 Blok No:23 A, 34235 Esenler / Istanbul, Türkiye. Under Article 13 of the KVKK, requests are concluded free of charge within 30 days at the latest; if the request requires additional cost, a fee per the tariff set by the Personal Data Protection Board may apply.

This notice may be revised to reflect changes in applicable law or in our data processing activities; the current version is always published on this page.