Privacy Policy

Privacy Policy

Last updated: 06.07.2026

At Harmony Deo, we take the protection of your personal data very seriously. This Privacy Policy explains how your personal data is collected, processed, stored and protected under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Data Controller

The data controller responsible for processing your personal data is:

• Company Name: Harmony Deo
• Address: Yakupulu Mah. Fuar Cad. Göçmen Sok. No:1/55 Sinpaş İş Modern, Ambarlı/Beylikdüzü/İstanbul
• Email: [email protected]
• Phone: +90 543 526 94 70
• Website: https://harmonydeo.com

2. Personal Data We Collect

To provide our services, we collect the following categories of personal data:

2.1. Identity Data

• First and last name
• National ID / tax number (for invoicing where required)
• Date of birth (where age verification is required)

2.2. Contact Data

• Email address
• Phone number
• Delivery and billing address

2.3. Account and Transaction Data

• Username and password (stored encrypted)
• Order history and shopping preferences
• Payment details (full card data is not stored by us; it is processed through our payment service providers)
• Return and exchange requests

2.4. Technical Data

• IP address
• Browser type and version
• Operating system
• Cookie data (see our Cookie Policy for details)
• Device information
• Page view and click data

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Processing your orders and managing shipping and delivery
• Creating and managing your membership account
• Carrying out payment transactions
• Responding to customer service and support requests
• Fulfilling legal obligations (tax, accounting, consumer rights)
• Improving our products and services
• Marketing communications (subject to your explicit consent)
• Fraud and abuse prevention
• Ensuring the security of our website

4. Legal Basis for Processing

Under the GDPR (Article 6)

• Performance of a contract (Art. 6(1)(b)): Order processing, delivery and returns
• Legal obligation (Art. 6(1)(c)): Tax and commercial law
• Legitimate interests (Art. 6(1)(f)): Fraud prevention, service improvement, security
• Consent (Art. 6(1)(a)): Newsletters, personalised advertising, profiling

Under the KVKK (Article 5)

• Performance of a contract: Order, delivery and return transactions
• Legal obligation: Tax legislation, consumer rights, e-commerce regulations
• Legitimate interest: Service improvement and security
• Explicit consent: Marketing communications and profiling

5. Transfer of Personal Data

Your personal data may be shared with third parties in the following cases:

• Shipping and logistics companies: To deliver your orders
• Payment service providers: For secure payment processing
• Accounting and financial advisors: For legal accounting obligations
• Public authorities: Where legally required
• Analytics service providers: For website performance analysis (using anonymised data)

International transfers: Some of our service providers (e.g. cloud storage, analytics tools) may be located outside the EU/EEA. In such cases, adequate safeguards (such as Standard Contractual Clauses) are applied in accordance with GDPR Article 46 and KVKK Article 9.

6. Data Retention

Your personal data is retained for as long as necessary for the purposes for which it is processed and in accordance with statutory retention obligations:

• Account data: While your account is active and for 30 days after an account deletion request
• Order and invoice data: 10 years (as required by tax law)
• Communication records: 3 years
• Cookie data: Up to 13 months (see the Cookie Policy)
• Marketing consents: Until consent is withdrawn

7. Your Rights

Under the GDPR (Articles 15–22) and the KVKK (Article 11) you have the following rights:

• Right to be informed: To learn whether your data is being processed
• Right of access: To request access to your processed data
• Right to rectification: To have incomplete or inaccurate data corrected
• Right to erasure ("right to be forgotten"): To request deletion of your data under certain conditions
• Right to restriction of processing: To limit processing in certain situations
• Right to data portability: To receive your data in a structured, commonly used, machine-readable format
• Right to object: To object to processing based on legitimate interests
• Rights related to automated decision-making: Not to be subject to decisions based solely on automated processing
• Right to withdraw consent: To withdraw consent at any time for consent-based processing

Exercising Your Rights

To exercise the rights above, you can contact us via:

• Email: [email protected]
• Post: Yakupulu Mah. Fuar Cad. Göçmen Sok. No:1/55 Sinpaş İş Modern, Ambarlı/Beylikdüzü/İstanbul

Your request will be answered free of charge within 30 days at the latest.

Right to Lodge a Complaint

• EU: You may lodge a complaint with your local supervisory authority.
• Turkey: Personal Data Protection Authority (KVKK) - www.kvkk.gov.tr

8. Data Security

We apply the following technical and organisational measures to protect your personal data:

• Data transmission with SSL/TLS encryption
• Firewalls and intrusion detection systems
• Access controls and authorisation
• Regular security audits
• Staff training and confidentiality agreements
• Data backup and disaster recovery plans

9. Cookies

Our website uses cookies. For detailed information about the types, purposes and management of cookies, please visit our Cookie Policy.

10. Policy Updates

This Privacy Policy may be updated from time to time. You will be informed via our website of any significant changes. You can always find the most current version on this page.

11. Contact

For any questions about our privacy policy or the processing of your personal data:

• Email: [email protected]
• Address: Yakupulu Mah. Fuar Cad. Göçmen Sok. No:1/55 Sinpaş İş Modern, Ambarlı/Beylikdüzü/İstanbul
• Phone: +90 543 526 94 70
• Web: https://harmonydeo.com