Privacy Policy

This Privacy Policy explains in general terms how your personal data are collected, used, shared and protected when you use the website https://www.herbaltox.com and related services (the "Site") operated by Herbaltox Gıda Limited Şirketi ("we"). Our duty to inform under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is fulfilled separately by the Personal Data Processing Notice; this policy complements that notice and does not replace it. Details on cookies are in the Cookie Policy. 1. Data Controller and Business Details Trade name: Herbaltox Gıda Limited Şirketi Address: Atatürk Mahallesi İrfan Sokak No:10/A, 34764 Ümraniye, İstanbul, TR Tax office / Tax No: Ümraniye / 4611180643 MERSIS No: 0461118064300001 Trade Registry No: 1072642 Email: info@herbaltox.com Phone: +90 216 606 18 79 Registered electronic mail (KEP): herbaltoxgida@hs01.kep.tr Questions about personal data can be sent to info@herbaltox.com; they are handled by the person we have made responsible for personal data. 2. Personal Data We Process Depending on how you use the Site, we may process the categories of data below. We aim to process only data that are relevant, limited and proportionate to the purpose. 2.1 Account and Membership Data When you register or sign in: first and last name, email address, phone number, an irreversible hash of your password (the password itself is not stored), account preferences and session information. If you sign in with a third-party account (for example Sign in with Google), we receive only the basic profile information you allow for that sign-in (name, email address, profile identifier); we use it only to create your account and recognise you, and we do not sell it or share it for advertising. 2.2 Order and Transaction Data When you place an order: delivery and billing address, order contents, amounts, order number and date, for business purchases the tax number, tax office and company name, return and exchange requests, shipping and delivery information. The rights and obligations of the sale itself are set out in the Distance Sales Contract and the Pre-Contractual Information Form. 2.3 Payment Data Your card details are processed on the secure page of the payment institution or bank; we do not store your full card number or security code. We may receive transaction information such as the payment result, transaction number, instalment details and the masked part of the card. For cash on delivery and bank transfer, a payment record is kept. The payment institutions we work with are named on the payment page. 2.4 Communication Data When you contact us by email, phone, contact form or support channels: the content of the correspondence, your contact details and the outcome of your request. If you agreed to receive commercial electronic messages (campaigns and newsletters), that consent and its record. 2.5 Technical Data and Logs When you visit the Site: IP address, browser and device information, pages visited, request times, error logs and security logs. Access records that must be kept under Turkish Law No. 5651 and related legislation fall into this category. 2.6 Cookies Strictly necessary cookies (basket, session, language and market preference) are used for the Site to work, and analytics or marketing cookies only if you consent. Details and how to manage your preferences are in the Cookie Policy, which also lists the analytics and marketing tools in use. 3. Purposes of Processing We process your personal data to: - create, manage and secure your account; - take your orders, collect payment, deliver and invoice; - handle return, exchange, withdrawal and customer service requests; - send you information about your orders and account; - send campaigns and newsletters if you consent; - keep the Site secure and prevent abuse and fraud; - meet our legal obligations and answer requests from authorities; - improve the Site and measure service quality. 4. Legal Grounds We process your data on the legal grounds listed in KVKK Art. 5 and Art. 6, mainly: concluding or performing a contract (order, membership); complying with our legal obligations (tax, e-invoicing, consumer law, access records); establishing, exercising or protecting a right; our legitimate interest provided it does not harm your fundamental rights and freedoms (security, service improvement); and, where required, your explicit consent (for example commercial electronic messages, non-essential cookies). The legal ground of each purpose is shown in the Personal Data Processing Notice. 5. Service Providers and Transfers We may share your data, only as far as the purposes above require, with these groups of recipients: payment institutions and banks, carriers and logistics companies, e-invoice / e-archive integrators, email and SMS service providers, the Message Management System (İYS), hosting, infrastructure and software providers, legal and accounting advisers, and competent public authorities. We do not sell your data. The names of the service providers we work with are available on request from info@herbaltox.com. 6. Transfers Abroad Some of our service providers may have servers outside Türkiye. Personal data are transferred abroad only under the conditions of KVKK Art. 9 (an adequacy decision, appropriate safeguards such as standard contractual clauses, or the exceptional cases provided for by law). You can ask info@herbaltox.com which providers and countries are involved and on what basis. 7. Retention Periods We keep your data for as long as the purpose of processing requires and for the periods required by law; for example invoices and accounting records for the periods set by tax law, orders and consumer transaction records for the periods set by consumer law, and access records for the periods set by the related legislation. When the period ends, the data are deleted, destroyed or anonymised. The retention period applied to each category of data is available on request from info@herbaltox.com. 8. Security We take reasonable technical and organisational measures to protect your data against unauthorised access, loss and misuse: encrypted connections (HTTPS), irreversible storage of passwords, role-based access, two-step verification for administrator accounts, activity logs and regular backups. No system is entirely free of risk; if a data breach is detected, the notifications required by law are made. 9. Your Rights Under KVKK Art. 11 you have the right to learn whether your personal data are processed and, if so, to request information; to learn the purpose of processing and whether data are used accordingly; to know the third parties to whom data are transferred; to request correction of incomplete or inaccurate data and, where the conditions are met, deletion or destruction; to request that these actions be notified to the third parties to whom data were transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing. You can send requests by email to info@herbaltox.com, to the KEP address herbaltoxgida@hs01.kep.tr or in writing to Atatürk Mahallesi İrfan Sokak No:10/A, 34764 Ümraniye, İstanbul, TR. Requests are concluded free of charge within thirty days at the latest; if the action involves an additional cost, the statutory tariff may apply. You can unsubscribe from marketing messages at any time using the link in the message or by writing to us. 10. Children The Site is not directed at children and we do not knowingly collect personal data from anyone under 18. If you are under 18, please use the Site under the supervision of a parent and do not send us personal data. If we become aware that a child's data have been sent to us, we delete them. 11. Changes to This Policy We may update this policy to reflect changes in the law or in our services. The current version is always published on this page; its version number and date appear below. We announce important changes on the Site or by email to your registered address. 12. Contact Us For any question about this policy or your personal data: Herbaltox Gıda Limited Şirketi Atatürk Mahallesi İrfan Sokak No:10/A, 34764 Ümraniye, İstanbul, TR Email: info@herbaltox.com — Phone: +90 216 606 18 79 Web: https://www.herbaltox.com Document version: 1 — Date: 2026-10-23