Privacy Policy
Privacy Policy
This policy explains Byhendi’s data practices. Effective: Effective on publication; this version was prepared on 10 November 2026.; updated: 10.11.2026. Turkish is the reference text for Türkiye; mandatory rights are preserved.
1. Controller and contact
Seller: MERT ARAZ; address: Mimar Sinan Mahallesi, Selmani Pak Caddesi, No: 48, İç Kapı No: 111, Üsküdar / İstanbul, Türkiye; email: info@byhendi.com; telephone: +905323417907; tax/registration: Vergi Dairesi: Üsküdar; VKN: 0730701617. Brand: Byhendi. Confirmation of controller capacity and relationship to the store: MERT ARAZ is the owner and data controller of the Byhendi store..
2. Information collected
Information includes account name/email, verification records, addresses, orders, delivery/billing details and support messages. Amounts, references and transaction status relate to orders. Actual payment data flow: This version has no live payment-provider integration, card-number/CVV fields or iyzico API call. A test receipt is not a payment.. Do not include unnecessary card details in support messages.
3. Purposes and legal grounds
Account, order and delivery services are assessed under making/performing a contract; invoicing and lawful authority requests under legal obligations. Specific grounds and balancing for security, abuse prevention and disputes: Contract formation/performance for accounts and requested services, legal obligation for legally required records, and balanced legitimate interests for proportionate security records are the proposed legal grounds, subject to qualified review before publication. Marketing consent is not presumed.. Where needed, marketing permission is separate, withdrawable and not a service condition.
4. Recipients and transfers
Necessary data may be shared within confirmed services with hosting, communication, carrier, payment and accounting recipients or legally authorised bodies. Actual recipients/purposes/countries: The application has PostgreSQL, Redis and SMTP configuration points; these do not identify provider legal entities or countries. The owner-confirmed carrier is DHL eCommerce. Hosting/SMTP/CDN provider identity and countries cannot be established from source code; the execution report records this limitation.. For international transfers, the KVKK mechanism is Source code cannot verify hosting or SMTP/CDN countries or an international-transfer mechanism. No claim of Türkiye-only processing or a particular safeguard is made; actual service agreements require legal review before publication.. No provider or country is assumed.
5. Retention and security
Periods depend on purpose, account status, legal retention and limitation/dispute needs. Category-specific periods/grounds: Accounts, addresses, checkout, orders, support and email event records are stored in PostgreSQL. Verification codes are valid for 10 minutes; expiry does not mean deletion. No automatic deletion schedule is implemented for those records; no invented retention period is stated.. Deletion/destruction/anonymisation process: Saved addresses can be deleted through the account. There is no general automatic account/record erasure or anonymisation flow. Access, correction and erasure requests can be sent through the official contact channel, subject to applicable legal retention duties.. Closing an account does not immediately erase every legal record. Actual technical/organisational safeguards: The source uses Django password hashing, CSRF protection, permission checks, email verification codes, rate limits, signed operation tokens and secure-cookie settings for HTTPS. Absolute security is not guaranteed.. Absolute security is not promised.
6. KVKK rights and requests
Rights include asking whether data are processed; information about processing, purposes, use and recipients; correction; qualifying deletion/destruction and recipient notification; objection to adverse automated analysis and compensation for unlawful processing. Request and identity verification procedure: MERT ARAZ; info@byhendi.com; +905323417907. Responses follow legal deadlines.
7. Cookies and updates
The cookie notice separately explains session/security and selected-language tools. Non-essential tracking does not start without the required legal basis. Privacy information, KVKK notice and optional marketing permission do not replace one another. Changes have versions/dates; new purposes receive any necessary separate information and permission.