Privacy Policy

At Relax by Espeki we take our customers’ privacy seriously. This Privacy Policy explains in summary how your personal data is collected, used and protected when you browse our products, place an order or contact us through www.espeki.com.tr (the “Site”). For a fuller legal assessment please review the KVKK Privacy Notice.

1. What Information Do We Collect?

• What we receive directly from you: name, surname, e-mail, telephone, delivery and billing address, order details, contact messages (e-mail, contact form, WhatsApp Business).

• Collected automatically: IP address, browser and device details, pages visited, cookie data.

• Payment details: processed by the payment institution’s infrastructure (PayTR); we do not store your full card number.

2. How Do We Use Your Information?

• Receiving, preparing and dispatching orders

• Completing invoicing and payment transactions

• Handling customer service and contact requests

• Developing the Site, ensuring its security and detecting faults

• Fulfilling legal obligations (tax, e-invoicing, ETBİS, consumer law)

• With your explicit consent; marketing communication, personalised recommendations and advertising measurement

The data we collect is limited to what the processing purpose requires, in line with the data minimisation principle in KVKK art. 4. To keep your data accurate and up to date you may request correction from your account settings or via merhaba@espeki.com.tr.

3. Who Do We Share Your Data With?

Data is shared within the contractual relationship we have with our service providers, with KVKK roles determined as follows:

• PayTR: Independent Data Controller (payment institution licensed by the BRSA; card data on PCI-DSS compliant infrastructure)

• Geliver.io and the courier companies (Yurtiçi, Aras, Sürat, Hepsijet): Data Processor (within our contractual relationship, for delivery purposes only)

• Financial adviser and legal adviser: Independent Data Controller (within their own professional obligations)

• Competent public institutions and organisations, as Recipient, upon lawful request

• With your explicit consent; analytics and advertising providers (Google, Meta) and WhatsApp Business for customer communication: transfer abroad under Standard Contractual Clauses within the framework of technical and administrative measures

We do not sell your data to third parties for commercial purposes.

4. Data Security

The Site is served with SSL/TLS encryption. The technical and administrative measures required under KVKK art. 12 are applied, and the written documentation process is being completed:

• Update management: server, plugin and application updates are applied regularly

• Backup and recovery: daily backups are taken and retained for 7 days; the restore procedure is tested

• Access control and revocation: all system access of an authorised user is revoked within 24 hours of the end of their duty or contract, and passwords are renewed

• Event log scope: login attempts, administrator actions, payment/order write calls and cookie preference changes are recorded

• Payment security: PCI-DSS compliant PayTR infrastructure

Even so, no data transmitted over the internet can be guaranteed 100% secure; you are also responsible for keeping your account password confidential.

5. Notification in the Event of a Data Breach

In the event of a possible personal data breach, notification is made to the Personal Data Protection Authority within 72 hours at the latest of our becoming aware of the breach, and the affected data subjects are informed by appropriate means.

6. Retention Period

Your personal data is retained for as long as the processing purpose requires and thereafter until the statutory retention periods (Turkish Commercial Code art. 82, Tax Procedure Law art. 253, Turkish Code of Obligations art. 146 and similar) have expired. Detailed periods and their bases are set out in article 7 of the KVKK Privacy Notice.

7. Children’s Privacy and Consent of the Legal Representative

The Site is not designed for use by users under the age of 18. Pursuant to article 11 et seq. of the Turkish Civil Code, capacity to enter into a contract begins as a rule on reaching the age of 18. Orders or account transactions on behalf of persons under 18 may only be carried out by a parent or legal representative.

If it emerges during use that a data subject is under 18, the relevant order is cancelled, the account is closed and the personal data collected is deleted without delay, subject to statutory retention obligations. If you believe your child’s data is being processed, you can reach us at merhaba@espeki.com.tr.

8. Third-Party Links

The Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites; we recommend that you review their privacy policies.

9. Profiling and Automated Decisions

If you give explicit consent, profiling (advertising personalisation and analytics) is carried out within a scope limited to cookie and behavioural data. No decision producing an adverse effect on you (price differentiation, account restriction and the like) is taken through automated processing. You may withdraw your consent in this scope: for marketing communication from the My Communication Preferences page, for cookie preferences through the “Cookie Settings” link in the Site footer, and for other matters through the application channel merhaba@espeki.com.tr.

10. Your Rights and Complaints

You may exercise your rights under KVKK art. 11 by the methods set out in articles 11 and 12 of the KVKK Privacy Notice. We recommend writing “KVKK Application” in the subject line of your application. If your application is refused or the response is inadequate, your right to complain to the Personal Data Protection Authority (kvkk.gov.tr) is reserved.

11. Contact

Data Controller: ESRA PERUZE KIZILTUĞ TİNER, ESPEKİ

Address: Yakacık Yeni Mah. Samandıra Cad. No:49/A Kartal / İstanbul, Türkiye

E-mail: merhaba@espeki.com.tr

Telephone: +90 540 010 24 34

12. Changes to This Policy

The Privacy Policy is updated as necessary. Significant changes are announced through the Site. Effective date: 01.05.2026. The version history can be followed in the Version History table at the end of this document.