Legal information
Privacy Notice on the Protection of Personal Data
On this page
This translation is provided for information only; the Turkish text is legally binding. Turkish text
In short: As data controller, SHE VEC A.Ş. processes your personal data in the order, membership, contact, newsletter, product review and application processes for the purposes and on the legal grounds listed in this notice. Your data may be transferred to parties from whom we receive delivery, payment, infrastructure, review and consultancy services; because of the site infrastructure (Shopify) and the review service (Judge.me), it is also processed on servers abroad. For processing that requires explicit consent, your consent is obtained separately from this notice. You can exercise your rights through the channels set out in Section 9.
This Privacy Notice has been prepared by SHE VEC Sağlık ve Kozmetik Ürünleri Sanayi ve Ticaret A.Ş. in its capacity as data controller (veri sorumlusu), in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
1. Identity of the Data Controller
SHE VEC Sağlık ve Kozmetik Ürünleri Sanayi ve Ticaret A.Ş.
Address: Alaaddinbey Mah. 615. Sk. Ünlü Plaza 2 No: 2B, İç Kapı No: 1, Nilüfer / Bursa, Türkiye
MERSİS No. (Central Registry Number): 0769189526800001
Trade Registry No.: 111842 (Bursa)
Email: destek@shevec.com
Telephone: +90 850 304 08 32
KEP address (registered electronic mail): shevecsaglik@hs01.kep.tr
2. Categories of Personal Data Processed
| Data category | Examples of data |
|---|---|
| Identity | First name, surname; tax identification number for corporate invoices |
| Contact | Email address, telephone number, delivery and billing address |
| Customer transaction | Order and invoice information, order history, return and exchange records, request and complaint records |
| Finance | Payment amount, payment method, refund account details (card numbers are not processed by us) |
| Transaction security | IP address, cookie records, session and login information, log records |
| Marketing | Shopping habits, preference and behavioural data obtained through cookies, messaging permissions |
| Product review | Review rating and text, any photo or video you add, review date; the name displayed on the Site with your first name and the initial of your surname (for example “Ayşe K.”); the order and product information to which the review relates |
| Audio-visual records | Customer service call recordings (where calls are recorded) |
| Representatives of corporate customers, resellers and business partners | First name and surname, position/title, business telephone and email, application and request information; for sole proprietorships, also the tax identification number/Turkish identity number (T.C. kimlik numarası) |
Special categories of personal data are not requested by us; health data may be processed only in the notifications of undesirable effects described below, depending on the content of the notification. We ask that you do not share information about your health in product reviews. Under the Terms of Use, reviews that attribute a medical effect to a product are not published; if already published, they are taken down and the author is informed of the reasons.
Notifications of undesirable effects (cosmetovigilance): Notifications of undesirable effects relating to our products that you send to us may, by their nature, contain health data. Such data is processed solely for the purpose of assessing the notification and reporting serious undesirable effects to the Turkish Medicines and Medical Devices Agency (TİTCK) and to the manufacturer of the product under Article 26 of the Cosmetic Products Regulation, on the basis of the conditions listed in the third paragraph of Article 6 of the Law and with the adequate measures determined by the Personal Data Protection Board in place. Where none of these conditions applies, your explicit consent is requested separately.
3. Purposes of Processing Personal Data
- Carrying out the order process, preparing, shipping and delivering products,
- Concluding and performing the contract, carrying out payment and invoicing transactions,
- Managing returns, exchanges, the right of withdrawal and after-sales support processes,
- Responding to customer requests, questions and complaints, and carrying out communication activities,
- Creating and managing membership accounts,
- Establishing and conducting wholesale, corporate and reseller relationships, and assessing applications,
- Collecting reviews of purchased products, verifying them by matching them with orders and publishing them on the Site; sending, after delivery, a review request email that contains no promotional or campaign content,
- Fulfilling legal obligations (tax, commercial, consumer and electronic commerce legislation),
- Ensuring information security, preventing forgery and fraud, keeping log records,
- Exercising the right of defence in legal disputes and responding to requests from official authorities,
- Where you have given your explicit consent: sending commercial electronic messages, carrying out campaign and advertising activities, personalising the user experience and marketing analyses.
4. Legal Grounds for Processing Personal Data
Your personal data is processed on the basis of the following legal grounds set out in Article 5 of the Law:
- Processing is directly related to the conclusion or performance of a contract (Art. 5(2)(c)): order, payment, delivery and return processes.
- Processing is expressly provided for by law and is necessary for the data controller to fulfil its legal obligation (Art. 5(2)(a) and (ç)): issuing invoices, keeping commercial books, keeping logs under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications.
- Data processing is necessary for the establishment, exercise or protection of a right (Art. 5(2)(e)): dispute and claims processes.
- Legitimate interest (Art. 5(2)(f)): information security, fraud prevention, measuring service quality; sending a product review request email after delivery and verifying the review by matching it with the order.
- The data has been made public by the data subject (Art. 5(2)(d)): displaying on the Site, together with your abbreviated name, a review you have submitted for publication.
- Explicit consent (Art. 5(1)): sending commercial electronic messages, non-essential cookies and personalised marketing activities. Your explicit consent is obtained separately from this notice through the relevant tick box or the cookie preference panel; not giving consent does not prevent you from placing an order or using the Site, and you may withdraw your consent at any time.
5. Parties to Whom Personal Data Is Transferred and Purposes of Transfer
| Recipient group | Purpose of transfer |
|---|---|
| Courier and logistics companies | Delivery of orders and collection of return shipments |
| Banks and payment institutions | Carrying out payments, refunds and reconciliation |
| IT and infrastructure service providers | E-commerce infrastructure, servers and hosting, email and SMS delivery, analytics tools |
| Product review service provider (Judge.me) | Sending review request emails, collecting reviews, verifying them against orders and displaying them on the Site |
| Accounting, audit and legal advisers | Fulfilling legal obligations and conducting legal proceedings |
| Authorised public institutions and organisations | Responding to requests for information and documents arising from legislation |
| Manufacturer of the product | Forwarding notifications of serious undesirable effects under Article 26 of the Cosmetic Products Regulation |
| Message Management System (İYS) | Recording consents to and refusals of commercial electronic messages as required by legislation |
The Site runs on the Shopify infrastructure (contracting party: Shopify International Limited, Ireland); order, membership, contact form, newsletter and cookie data are processed on Shopify's servers abroad. Product reviews, and the name, email address, order and product information required for review requests, are processed abroad on the servers of our review service provider Judge.me. These transfers are subject to Article 9 of the Law and to the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad; the Personal Data Protection Board has not yet issued an adequacy decision for any country. Transfers of a continuous nature are not based on explicit consent; explicit consent is relied on only in the cases of incidental transfer provided for in Article 9 of the Law and on an exceptional basis. Transfers to institutions in Türkiye from which we receive delivery and payment services are domestic transfers.
6. Method of Collecting Personal Data
Your personal data is collected by wholly or partly automated means through membership and order forms, contact, return, newsletter and reseller application forms on the website www.shevec.com, the product review form sent by email after an order, email, telephone and social media channels, and cookies and similar technologies. Your answers in the Routine Builder are processed in your browser to generate the recommendation; they are added to the page address so that you can reopen the result, and are not written to your customer or newsletter record.
7. Retention Period
Your personal data is kept for as long as necessary for the purpose for which it is processed, taking into account the limitation periods laid down in the relevant legislation. Records relating to commercial books and documents, records relating to electronic commerce and records of consents to and refusals of commercial electronic messages are kept for 10 years, and traffic records under Law No. 5651 for the period laid down in the legislation. Data relating to reseller and corporate sales applications that do not result in a commercial relationship is kept for a maximum of 2 years. Product reviews are kept for as long as they remain published on the Site; you may request the removal of your review at any time at destek@shevec.com. When these periods expire, the data is erased, destroyed or anonymised.
8. Your Rights as a Data Subject
Under Article 11 of the Law, by applying to the data controller, you have the right to:
- learn whether your personal data is processed and, if it has been processed, request information about it,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your data is transferred,
- request rectification if the data has been processed incompletely or inaccurately,
- request erasure or destruction within the framework of the conditions set out in Article 7 of the Law,
- request that rectification, erasure and destruction operations be notified to the third parties to whom the data has been transferred,
- object to a result to your detriment arising from the analysis of the data exclusively through automated systems,
- claim compensation for the damage if you suffer damage as a result of the unlawful processing of the data
These rights are available to you as a data subject (ilgili kişi).
9. Application Method
You can submit requests concerning your rights through the following channels, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller:
- In person or through a notary, with a petition bearing a wet signature: Alaaddinbey Mah. 615. Sk. Ünlü Plaza 2 No: 2B, İç Kapı No: 1, Nilüfer / Bursa, Türkiye
- With a secure electronic signature or mobile signature: shevecsaglik@hs01.kep.tr
- From your email address registered in our system: destek@shevec.com
Your application must include your first name and surname, signature, Turkish identity number (for foreign nationals, nationality, passport number or identity number, if any), address for service, email and telephone details, if any, and the subject of the request. Your request is concluded free of charge as soon as possible according to its nature and within 30 days at the latest; the response is given in writing or electronically and, if the request is rejected, the reasons are clearly stated. If the process entails an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.
If your application is rejected, you find the response insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of the date on which you learn of the response and, in any event, within 60 days of the date of application.
Last updated: 06.10.2026