Privacy and KVKK Policy

Last updated: 6 November 2026

This is an English translation provided for convenience. In case of any discrepancy, the Turkish version prevails.

In short

  • This policy is the single, shared text for Hemgaard’s website (hemgaard.com), online shop (shop.hemgaard.com), contact channels and home check-up service. The same rules apply whichever site you use.
  • We process your data to fulfil your order and service, meet our legal obligations and, if you agree, stay in touch with you. We do not sell your data.
  • Information about mobility, hearing and daily routines may count as health data. We process it only with explicit consent given through a separate checkbox. If you do not consent, we do not ask those questions.
  • The home check-up is not a medical assessment and does not replace the assessment of a health professional.
  • Non-essential cookies and marketing messages run only with your consent. You can withdraw consent at any time.
  • For questions and requests: info@hemgaard.com

1. Purpose, scope and data controller

This policy fulfils our duty to inform under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and explains our privacy practices. It covers how we collect, use, store, share and protect the personal data of visitors, members and customers who use Hemgaard’s website, online shop, contact channels (phone, email, WhatsApp) and home check-up service.

It is published with identical content at hemgaard.com/kvkk and on our shop’s Privacy policy page. If our Distance Sales Agreement or our Terms of Service differ from this policy on personal data, this policy prevails.

Your personal data is processed by Gözüm Yapı İnşaat Sanayi ve Ticaret A.Ş., which operates under the Hemgaard brand, as data controller.

Trade name: GÖZÜM YAPI İNŞAAT SANAYİ VE TİCARET A.Ş.
MERSIS no: 0411044943000011
Address: Taya Hatun Mah. Çakmakçılar Yokuşu Sok. Sabri-Safa Han No: 30/409, 34120 Fatih / Istanbul, Türkiye
Phone: +90 535 875 11 70
Email: info@hemgaard.com

2. Personal data we process

Depending on your relationship with us, we may process:

  • Identity and contact details: name, age, phone number, email address, delivery, billing and visit address; for corporate invoices, company name, tax office and tax number.
  • Customer transaction data: order, appointment, return, exchange and cancellation records; items added to the cart; invoice and delivery details.
  • Payment data: payment method, amount, approval and refund records. Your card number and security code are processed directly and in encrypted form by the payment provider; Hemgaard does not see or store them.
  • Home check-up service data: appointment and conversation notes; physical features of the home (such as room layout, lighting, floors, stairs and bathroom layout); household information and daily living preferences; photos, video or audio recorded as part of the service; assessment reports.
  • Account data: if you create a shop account, your user details, preferences and order history.
  • Communication records: requests, questions and complaints you send us by email, phone, WhatsApp or forms.
  • Technical data: IP address, device and browser details, date and time of visit, browsing data on the site.
  • Transaction security records: logs of sign-ins, orders and payments.
  • Preference and consent records: your explicit consent, cookie and marketing message permissions, and when they were given or withdrawn.
  • Marketing data: only if you consent, your interests and campaign interactions.

3. Health data and explicit consent

We do not ask for medical documents, diagnoses, medication or treatment information. Please do not share health documents through our contact channels.

What may count as health data? To assess how well a home suits daily life, we may ask some questions during the check-up call and home visit. For example: whether support is used when moving around the home, whether stairs or the bathroom are difficult to use, whether there has been a fall at home recently, whether it is hard to hear the doorbell or an alarm, and night-time routines. Such information may qualify as special category personal data (health data) under Article 6 of the KVKK.

How we obtain explicit consent

  • Whichever channel it reaches us through (website, shop, phone, WhatsApp or the home visit), we process this information only with your explicit consent and only to the extent the service requires.
  • Consent is collected on the booking form and on the form signed at the home visit, through a checkbox that is separate from other approvals and not pre-ticked. The consent text is limited to the questions actually asked at that stage.
  • If you do not consent, we do not ask these questions. The check-up is then based on the physical features of the home, and some recommendations may be more general.
  • You can withdraw consent at any time by writing to info@hemgaard.com. Withdrawal does not affect the lawfulness of processing before that date.
  • If the questions we ask change, we update the consent text accordingly.
  • Health data is never shared with third parties beyond the scope of your explicit consent.

Important: The home check-up and its report assess the safety and ease of use of the home. They have no medical diagnostic or treatment purpose and do not replace the assessment of a health professional.

We do not need special category data such as health, religion or ethnic origin for shop orders. Please do not include such information in order notes or messages. Any such information shared by mistake is deleted unless it is needed for your request.

4. Confidentiality of home check-up information

The resident is informed about the processing of their personal data. Before any photo, video or audio recording, we explain its purpose and, where needed, ask for separate permission.

Only Hemgaard staff authorised for their role can access client files. The report is shared with the person who requested the service and with family members or carers the resident approves.

Scores and recommendations in reports are prepared together with our team’s on-site observations and expert assessment. We may use software and AI-assisted tools to draft reports, but our team always reviews and finalises every report. No decision about you is made solely by automated systems.

Photos and reports are never used for advertising or marketing. Anonymised examples that cannot identify you may be used only for internal team training and to improve report quality.

5. Where we collect data from

Your personal data is obtained electronically or physically through our website and shop, order, appointment and account forms, email, phone, WhatsApp, conversations and home visits, and through our service providers:

  • Directly from you: when you place an order, book an appointment, create an account, in conversations and during the home visit.
  • Automatically: through cookies and similar technologies when you use our sites. Non-essential cookies are used only with your consent; see section 14.
  • From our service providers: such as the payment provider and courier, who carry out a transaction on your behalf.

6. Purposes and legal grounds

  • Taking your order, completing payment, delivering products, handling returns and exchanges, issuing invoices: formation and performance of a contract (KVKK Art. 5/2-c); legal obligation (Art. 5/2-ç).
  • Scheduling the home check-up, carrying out the visit, preparing and sharing the report: formation and performance of a contract (Art. 5/2-c); explicit consent for information that qualifies as health data (Art. 6).
  • Creating and managing your shop account; sending order, appointment and account notifications: formation and performance of a contract (Art. 5/2-c).
  • Answering your questions and requests, providing customer support: performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f).
  • Meeting obligations under distance selling, tax and commercial law; responding to requests from authorities: expressly provided for by law (Art. 5/2-a); legal obligation (Art. 5/2-ç).
  • Preventing fraud and unauthorised access, protecting our systems: our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f).
  • Managing your permissions and preferences, and proving when they were given or withdrawn: legal obligation (Art. 5/2-ç); establishing and protecting a right (Art. 5/2-e).
  • Establishing and defending our rights in a possible dispute: establishing, exercising or protecting a right (Art. 5/2-e).
  • Improving our sites and producing usage statistics: explicit consent for analytics cookies (Art. 5/1).
  • Sending campaigns, news and product suggestions; showing personalised ads: explicit consent (Art. 5/1) and commercial electronic message approval under Law No. 6563 (see section 7).

If a new processing activity requires explicit consent, we will ask for it before that activity starts.

7. Commercial electronic messages

Promotional emails, SMS or WhatsApp messages are sent only with your approval, as required by Law No. 6563 on the Regulation of Electronic Commerce. You give this approval through a checkbox that is separate from your order, account or booking confirmation and is not pre-ticked. Not giving it does not stop you from shopping or using our services.

You can stop these messages at any time: via the “unsubscribe” link in each message, by writing to info@hemgaard.com, or through the national Message Management System (İYS). Messages about your order, appointment or account are not commercial messages and are sent regardless of this approval.

8. Who we share data with

We share your personal data only as needed for the purposes above, with:

  • Infrastructure and service providers: cloud hosting and storage, e-commerce platform, payment providers, couriers, e-invoicing and accounting services, business email, messaging (WhatsApp), AI-assisted reply and drafting tools, domain services, analytics services. As data processors, these providers process your data only on our instructions and only as the service requires.
  • Advertising and marketing providers: only with your explicit consent and cookie consent.
  • Orders that include installation: the authorised specialist or partner who carries out the installation receives only your name, address and phone number, to fulfil the order.
  • Renovation and installation partners (after a check-up): referral to a partner after a home check-up happens only with your consent.
  • Report sharing: the person who requested the service and family members or carers the resident approves.
  • Authorised public bodies and courts: where required by law.
  • Legal and financial advisers: to protect our rights and meet legal obligations.

We do not sell or rent your data.

9. International transfers

Some of our service providers are based abroad or process data on servers outside Türkiye. Your data may therefore be transferred abroad so that we can fulfil your order and service. These transfers are made under Article 9 of the KVKK: standard contracts published by the Personal Data Protection Board have been signed with the relevant providers and notified to the Authority. Where this is not possible, the transfer relies on the exceptions listed in the Law. Transfers through analytics and marketing cookies happen only with your cookie consent.

Our e-commerce platform provider may also process your data as an independent data controller for certain features, such as fraud prevention. In that case the provider’s own privacy policy applies.

10. How long we keep data

We keep your data for as long as needed for its purpose and as required by law:

  • Order, contract and pre-contract information records: at least 3 years.
  • Invoice and accounting records: 10 years.
  • Home check-up service files (notes, photos, reports): up to 5 years.
  • Explicit consent records: 3 years from withdrawal of consent or the end of the related processing.
  • Commercial electronic message consent records: 3 years from withdrawal of consent.
  • Customer service correspondence: 3 years from closure of the request.
  • Shop account data: until you close your account.

When the period ends, your data is deleted, destroyed or anonymised.

11. Information security

Under Article 12 of the KVKK we take the technical and organisational measures needed to prevent unlawful processing of and access to your data and to keep it safe, including encrypted connections, multi-factor authentication, access restriction and backups. We limit access to people who need it for their work and expect the same care from our service providers. Please do not share your account password with anyone.

12. Children’s data

Our shop and services are not intended for people under 18, and we do not knowingly collect their data. If you believe a child in your care has sent us data, write to info@hemgaard.com and we will delete it.

13. Your rights and how to apply

Under Article 11 of the KVKK you can apply to us to:

  • find out whether your personal data is processed,
  • request information if it has been processed,
  • learn the purpose of processing and whether it is used accordingly,
  • know the third parties in Türkiye or abroad to whom it has been transferred,
  • request correction if it is incomplete or inaccurate,
  • request deletion or destruction under the conditions of Article 7 of the KVKK,
  • request that correction, deletion or destruction be notified to third parties who received the data,
  • object to an outcome against you that results solely from automated analysis,
  • claim compensation for damage caused by unlawful processing.

Send your request from the email address registered with us to info@hemgaard.com, or with a wet signature to our address in section 1. Requests are answered free of charge within 30 days at the latest. We ask only for the identity verification that is necessary and proportionate. If you need to send an identity document, please black out special category information such as blood type or religion. You may use the form at the end of this policy; it is not mandatory.

If your request is rejected, you find the answer insufficient or we do not answer in time, you have the right to complain to the Personal Data Protection Board.

14. Cookies

Essential, functional, analytics and marketing cookies may be used on our sites (hemgaard.com and shop.hemgaard.com). No cookies other than essential ones run without your consent; rejecting them does not stop you from shopping or using our services. Our Cookie Policy explains which cookies we use, why and for how long, and how to manage your preferences. You can change your choice at any time via the “Cookie preferences” link at the bottom of every page.

15. Third-party links

Our sites may contain links to other sites. We are not responsible for their content or data practices; please review their privacy policies when you visit them.

16. Changes

We may update this policy to reflect changes in law or in our practices. The current version is always published at hemgaard.com/kvkk and on our shop’s Privacy policy page, with its “Last updated” date. We will also notify you of significant changes by email.

17. Contact

For questions, requests or complaints about this policy or your personal data, write to info@hemgaard.com or call +90 535 875 11 70.

Annex: KVKK application form

  • Name and surname
  • Email or postal address for the reply
  • Phone
  • Your relationship with Hemgaard (shop customer / shop member / check-up client / visitor / other)
  • Subject of your application and your request
  • Related order or appointment number, or transaction details (if any)
  • Attachments (if any)
  • Date
  • Signature (for wet-signed applications)