Personal Data Protection, Privacy and Information Security Policy

Last updated: 12 October 2026

This is an English translation provided for convenience. In case of any discrepancy, the Turkish version prevails.

1. Scope and data controller

This policy explains how personal data is processed through the Hemgaard website, online store, communication channels and the home check-up service.

Hemgaard is a brand of Gözüm Yapı İnşaat Sanayi ve Ticaret A.Ş. Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), the data controller is Gözüm Yapı İnşaat Sanayi ve Ticaret A.Ş.

Address: Taya Hatun Mah. Çakmakçılar Yokuşu Sok. No: 30/409, 34120 Fatih, Istanbul, Türkiye
Phone: +90 535 875 11 70
Email: info@hemgaard.com

2. Data we process and why

Depending on your relationship with us, we may process your name, age, contact and address details; appointment and interview notes; the physical features of the home, household information and daily-living preferences; photos, video or audio recordings taken as part of the service; assessment reports; and order, payment and invoice details.

This information is collected through the website, the store, phone, email, WhatsApp, interviews and home visits. We use it to answer requests, arrange appointments, prepare the service and reports, fulfil orders, handle payments and accounting, and meet our legal obligations.

Depending on the activity, data is processed on the legal grounds of concluding or performing a contract, a legal obligation, establishing or protecting rights, our legitimate interest provided it does not harm your fundamental rights and freedoms, or, where required, your explicit consent.

3. Confidentiality of service information

We do not ask for medical documents, diagnoses or treatment information as part of the home check-up. Please do not send health documents through our communication channels. However, to assess how well the home suits daily life, some information about mobility, hearing and daily routines may qualify as health data. We process this information as special-category personal data, only with your explicit consent and only to the extent the service requires.

The resident is informed about how their personal data is processed. Before any photo, video or audio recording, we explain its purpose and, where needed, ask for separate permission.

Client files are accessible only to Hemgaard staff authorised for their role. The report is shared with the person who requested the service and with family members or carers the resident approves.

Photos and reports are not used for advertising or marketing. Anonymised examples that cannot identify you may be used only for our team’s internal training and to improve report quality.

4. Service providers and data sharing

We use the following service providers to run our services:

  • Amazon Web Services (AWS): data storage, application infrastructure and email delivery
  • Google: business email (Google Workspace) and, if you consent, website usage statistics (Google Analytics)
  • Meta (WhatsApp): messaging
  • Cloudflare: infrastructure for our WhatsApp assistant
  • Anthropic: the assistant that replies to messages received via WhatsApp
  • Shopify: online store
  • PayTR: payments
  • DİA: accounting
  • one.com: domain name and website infrastructure

Data may be shared, to the extent necessary, with these service providers, delivery companies and legally authorised authorities. Your contact details are passed to our renovation and installation partners only with your approval.

Some of the providers above are based abroad or process data on infrastructure outside Türkiye. These transfers are made under Article 9 of the KVKK, on the basis of standard contracts that have been signed and notified to the Personal Data Protection Authority.

5. Cookies

Our website uses Google Analytics cookies to understand how the site is used. These cookies run only if you choose “Accept” in the cookie banner on our site; they are not needed to use the site. Using the site does not, on its own, mean you consent.

Your choice is kept for 12 months. You can change it or withdraw your consent at any time via the “Cookie preferences” link at the bottom of every page. Cookies in our store are managed through the separate cookie settings offered on the store pages.

6. Retention and information security

Service files are kept only as long as needed for their purpose, and for no more than five years. Records for which the law sets a different period, and our legal obligations, are not affected. Data that no longer needs to be kept is deleted, destroyed or anonymised.

To protect data, we use multi-factor authentication, access restrictions and backups.

7. Your rights and how to apply

Under Article 11 of the KVKK, you can find out whether your data is processed; request information if it is; and learn the purpose of processing, whether it is used for that purpose, and to whom it is transferred in Türkiye or abroad.

You can ask for incomplete or inaccurate data to be corrected; for data to be deleted or destroyed under the conditions set by law; and for these actions to be notified to third parties to whom the data was transferred. You can object to an outcome against you that results solely from automated analysis, and claim compensation for damage caused by unlawful processing.

You can send your request to info@hemgaard.com from the email address registered with us. Requests are answered as soon as possible and within thirty days at the latest. If your request is rejected, you find the answer insufficient, or you receive no answer in time, you may file a complaint with the Personal Data Protection Board.

The current version of this policy is published on our website.