Privacy and Security Policy

This translation is provided for information only; the Turkish text is legally binding. Turkish text

In short: The information you provide on shevec.com for orders, membership, contact, the newsletter and product reviews, and the data collected through cookies, are processed for the purposes described in this policy. Your card details are not visible to us. Your data is not sold; it is shared only to the extent necessary with parties from whom we receive services, such as delivery, payment, infrastructure and product reviews. You can exercise your rights via destek@shevec.com.

As SHE VEC Sağlık ve Kozmetik Ürünleri Sanayi ve Ticaret A.Ş. (“s'hevec”, the “Company” or “we”), we attach importance to the privacy and security of your personal data in the services we provide through the website www.shevec.com (the “Site”). This Privacy and Security Policy explains what information we collect when you visit the Site or shop on it, for what purposes we use that information and how we protect it.

For detailed information on the processing of your personal data under Law No. 6698 on the Protection of Personal Data (“KVKK”), please see our Privacy Notice; for information on our use of cookies, please see our Cookie Policy.

1. Information We Collect

1.1. Information you provide directly

• Membership and account information: first name, surname, email address, telephone number. You sign in to your account not with a password but with a one-time verification code sent to your email address.
• Order and delivery information: delivery and billing address, recipient name, telephone number; where a corporate invoice is requested, tax office and tax identification number.
• Communication and request information: messages you send to customer service, return and exchange requests, complaint records.
• Marketing preferences: your permissions for the email newsletter and other commercial electronic messages, and information on the form through which you registered. The answers you give in the Routine Builder (skin type, care priorities) are processed in your browser to generate the recommendation; they are added to the page address so that you can reopen the result, and are not written to your customer or newsletter record.
• Product reviews: the rating, review text and any photo or video you share through the link sent to you by email after your order. Reviews are displayed on the Site with your first name and the initial of your surname (for example “Ayşe K.”) and a verified buyer badge. We ask that you do not share information about your health in reviews.

1.2. Information collected automatically

• IP address, browser and device information, operating system, language preference.
• Navigation on the Site, products viewed, add-to-cart and purchasing behaviour.
• Data obtained through cookies and similar technologies.

1.3. Information we do not collect

Your credit card and debit card details are never seen, recorded or stored by us at any stage. Payments are carried out through the infrastructure of a licensed payment institution and banks; your card details are transmitted directly to the secure system of the institution concerned.

2. Purposes for Which We Use Information

• Creating, preparing, dispatching and delivering your order,
• Carrying out payment transactions and invoicing,
• Handling returns, exchanges, defective products and after-sales support,
• Responding to customer requests, questions and complaints,
• Collecting product reviews, verifying them against orders and publishing them on the Site; sending, after delivery, a review request email that contains no promotional or campaign content,
• Fulfilling our legal obligations (tax, commercial and consumer legislation),
• Ensuring the security of the Site, detecting errors and preventing fraud,
• Sending campaign, discount and new product announcements, where you have given your explicit consent,
• Analysis and reporting activities aimed at improving our services.

3. Parties with Whom Information Is Shared

We do not sell or rent your personal data or transfer it to third parties for marketing purposes. Your data is shared only in the following cases and only to the extent necessary:

• Courier and logistics companies: name, address and telephone number, for the delivery of your order.
• Payment institutions and banks: for carrying out payments and refunds.
• IT and infrastructure providers: e-commerce infrastructure, servers, email and SMS delivery services.
• Product review service provider (Judge.me): name, email address, order and product information, for sending review request emails and for collecting, verifying and displaying reviews on the Site.
• Accounting and legal advisers: for the fulfilment of legal obligations.
• Authorised public institutions and organisations: within the scope of requests for information and documents arising from legislation.
• Message Management System (İleti Yönetim Sistemi, İYS): for recording your consents to and refusals of commercial electronic messages as required by legislation.

The Site runs on the Shopify infrastructure (contracting party: Shopify International Limited, Ireland); order, membership, contact form, newsletter and cookie data are processed on Shopify's servers abroad. Product reviews, and the name, email address, order and product information required for review requests, are processed abroad on the servers of our review service provider Judge.me. These transfers are subject to Article 9 of the KVKK and to the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad; the Personal Data Protection Board has not yet issued an adequacy decision for any country. Transfers of a continuous nature are not based on explicit consent. Transfers to institutions in Türkiye from which we receive delivery and payment services are domestic transfers.

4. Data Security

We take technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of your personal data and unlawful access to your data. These measures include:

• Use of SSL/TLS encryption across the Site,
• Access control based on an authorisation matrix and user-based logging,
• Up-to-date security software, regular backup and update processes,
• Signing of confidentiality undertakings with employees and suppliers,
• Auditing the security level of suppliers acting as data processors.

We would remind you that, despite all the measures taken, the absolute security of data transmitted over the internet cannot be guaranteed. You are responsible for keeping confidential the email address linked to your account and the verification codes sent to you.

5. Retention Period

Your personal data is kept for as long as necessary for the purpose for which it is processed, taking into account the limitation periods and retention obligations laid down in the relevant legislation. At the end of that period, the data is erased, destroyed or anonymised. Records relating to commercial books and documents (under the Turkish Commercial Code and the Tax Procedure Law) and records relating to electronic commerce and records of consents to and refusals of commercial electronic messages (under Law No. 6563 on the Regulation of Electronic Commerce) are kept for ten years. Product reviews are kept for as long as they remain published on the Site; you may request their removal at any time at destek@shevec.com.

6. Your Rights

Under Article 11 of the KVKK, you have the right to request information about your personal data, to request its rectification or erasure, to object to its processing and to claim compensation for any damage you suffer. Detailed information on how you can exercise your rights is available on our Privacy Notice page.

7. Commercial Electronic Messages

Emails, SMS messages and similar commercial electronic messages with campaign and promotional content are sent only if you have given your consent and that consent has been registered in the Message Management System (İYS) in accordance with Law No. 6563 on the Regulation of Electronic Commerce; no commercial electronic messages are sent to recipients who do not have a consent registered in the İYS. Not giving consent does not prevent you from placing an order. You may withdraw your consent free of charge at any time by using the link in the messages, through the İYS or by notifying destek@shevec.com; your refusal is processed within 3 working days at the latest.

8. Information Concerning Children

Purchases made through the Site are intended for persons who have reached the age of 18. If we discover that data belonging to a person under the age of 18 has been collected without our knowledge, that data is erased without delay.

9. Changes to the Policy

This Policy may be amended in line with changes in legislation and updates to our services. The current text is published on the Site with its effective date indicated.

10. Contact

SHE VEC Sağlık ve Kozmetik Ürünleri Sanayi ve Ticaret A.Ş.
Address: Alaaddinbey Mah. 615. Sk. Ünlü Plaza 2 No: 2B, İç Kapı No: 1, Nilüfer / Bursa, Türkiye
Email: destek@shevec.com
Telephone: +90 850 304 08 32
KEP (registered electronic mail): shevecsaglik@hs01.kep.tr
MERSİS No. (Central Registry Number): 0769189526800001
Trade Registry No.: 111842 (Bursa)
Professional chamber: Bursa Chamber of Commerce and Industry (BTSO)
Tax office / Tax number: Çekirge V.D. / 7691895268

Last updated: 06.10.2026