Personal Data Protection Notice (KVKK)

NOTICE ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

Personal Data Protection Notice under Türkiye’s KVKK

This notice is provided by Index Supplement, acting as a data controller, under Personal Data Protection Law No. 6698 (“KVKK”). It explains the processing of your personal data through www.indexsupplement.com (the “Website”) and related digital and online channels.

1. DATA CONTROLLER AND CONTACT DETAILS

Data controller: Shopify / Index Supplement

Business name: Index Supplement
Phone / WhatsApp: +90 505 265 65 87
Email: info@indexsupplement.com
Address: Burhaniye Mahallesi, Doğu Karadeniz Caddesi No: 7/1, İç Kapı No: 3, Üsküdar, Istanbul, Türkiye
Tax / VAT number: 6390621870

Website: www.indexsupplement.com

You may send requests concerning your personal data under Article 11 of the KVKK using the contact details above.

2. PERSONAL DATA WE PROCESS

When you use our services, we may process the following categories:

Identity information: First and last name, username, order number, and similar details.
Contact information: Email address, phone number, shipping and billing addresses, and country/city.
Customer transaction information: Order details, cart contents, return/exchange requests, support requests, and call center or WhatsApp correspondence.
Payment information: Payment amount, payment method, and installment details. Card information is stored by the payment provider; we do not retain full card numbers in our systems.
Transaction security information: IP address, device and session information, and logs.
Marketing data: Cookie records, campaign preferences, and, if you consent, records of consent to commercial electronic communications.

3. PURPOSES OF PROCESSING

Your personal data is processed under the conditions in Articles 5 and 6 of the KVKK for the following purposes:

Orders and contracts: Creating accounts and orders; delivering products; managing deliveries and returns; issuing invoices; and processing payments.
Customer relationships and support: Receiving and resolving requests and complaints; providing order updates; and offering support through WhatsApp, email, and similar channels.
Finance and accounting: Maintaining payment and collection records and meeting tax, accounting, and other legal obligations.
Logistics and shipping: Dispatching products from our U.S. warehouse to Türkiye and other countries and managing international shipping, customs, and local delivery.
Marketing and user experience: Analyzing Website use and improving the experience; and, with your permission, sharing campaigns, discounts, and product information.
Legal obligations and dispute resolution: Meeting statutory retention requirements, preserving evidence for potential disputes, and managing legal proceedings.

4. RECIPIENTS AND PURPOSES OF DATA TRANSFERS

In accordance with the KVKK and applicable law, personal data may be transferred to:

Domestic and international service providers: Website infrastructure and hosting providers; shipping and logistics companies; payment and virtual POS providers; and companies providing IT, software, call center, marketing, and analytics services.
Authorized public bodies: Courts, prosecutors, law enforcement, tax offices, and other authorized agencies requesting information under our legal obligations.

Because we use Shopify and similar infrastructure providers, some personal data may be transferred abroad. Transfers are made under Article 9 of the KVKK where you have given explicit consent or another legal basis specified by law applies.

5. COLLECTION METHODS AND LEGAL BASES

Personal data is collected by automated and partly automated means through account and order forms; information provided during payment; requests made through customer service, WhatsApp, email, and social media; cookies and similar technologies; and shipping, logistics, and payment provider systems.

Processing relies on the legal bases in Articles 5(2) and 6 of the KVKK, including necessity for entering into or performing a contract; compliance with the controller’s legal obligations; establishment, exercise, or protection of a right; the controller’s legitimate interests, provided your fundamental rights and freedoms are not harmed; and your explicit consent.

6. YOUR RIGHTS UNDER THE KVKK

Under Article 11 of the KVKK, you may apply to us as data controller to:

Learn whether your personal data is processed.
Request information about any processing.
Learn the purposes of processing and whether your data is used accordingly.
Learn which third parties receive your data in Türkiye or abroad.
Request correction of incomplete or inaccurate data.
Request erasure or destruction under the conditions set out in the KVKK.
Request notification of correction, erasure, or destruction to recipients of your data.
Object to an adverse result arising solely from automated analysis of your data.
Seek compensation for damage caused by unlawful processing.

7. HOW TO SUBMIT A REQUEST

You may submit a signed written request by mail, use your registered electronic mail (KEP) address, or use another method that establishes your identity. Send your request to the data controller, İndex Supplement Sağlık ve Sporcu Gıdaları Pazarlama Ticaret, through the following channels:

Address: Burhaniye Mahallesi, Doğu Karadeniz Caddesi No: 7/1, İç Kapı No: 3, Üsküdar, Istanbul, Türkiye
Email: info@indexsupplement.com

Depending on their nature, requests will be resolved as soon as possible and no later than 30 days. If processing requires an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.