Data Protection Notice (KVKK)

We process only the data you give us through this website.

Order form (cart page):

• Identity: first name, last name
• Contact: email, phone
• Delivery: address, city, district, postal code
• Invoice: invoice type (individual / corporate); for corporate invoices, company name, tax number, tax office
• Optional: club / organization name, order note
• Transaction: order number, selected product and quantity, date, language, consent records

Contact form:

• Name, email, subject, message
• Optional: club / organization name, phone

Technical logs: The infrastructure hosting the site (Cloudflare) keeps short-term server logs such as IP address, browser type and request time for security and debugging. We do not use these logs to identify you.

Your cart is kept only in your browser's local storage; it is not sent to us until you submit an order.

If you reach us via WhatsApp or phone, the information you share on that channel is processed for the same purposes; WhatsApp's own privacy terms also apply.

We process your personal data for the following purposes:

• Receiving your order, sending bank details (IBAN) and matching the payment to the order
• Issuing invoices and meeting record-keeping obligations under tax and commercial law
• Shipping the device and tracking delivery
• Handling warranty, return and withdrawal requests
• Replying to contact-form messages; answering demo, pricing and support requests
• Keeping the site secure and blocking bot and spam submissions
• Responding to lawful requests from competent authorities

We do not use your data to send marketing emails, build profiles or sell it to third parties. If you want news from Hexa, we will ask you separately and explicitly.

Each group of data is processed on one of the following grounds in Article 5 of the KVKK:

• Order and delivery data: Art. 5/2-c — processing directly related to the formation or performance of a contract
• Invoice and financial records: Art. 5/2-ç — compliance with a legal obligation of the data controller (Tax Procedure Law, Turkish Commercial Code, Consumer Protection Law No. 6502)
• Warranty, withdrawal and dispute records: Art. 5/2-e — necessary for establishing, exercising or protecting a right
• Security and server logs: Art. 5/2-f — our legitimate interest, provided it does not harm your fundamental rights and freedoms
• Contact form: Art. 5/1 — explicit consent (the checkbox on the form)

You may withdraw the explicit consent given for the contact form at any time by writing to [EMAIL]; withdrawal does not affect processing carried out before it and takes effect going forward.

Your data is collected through the forms on the website, email, WhatsApp and phone, partly by automated means. Forms are sent only over an encrypted connection (HTTPS) and in the request body; no personal data is written into the address bar (URL).

We transfer your data only to the following recipients, limited to the stated purpose:

• Courier company ([COURIER COMPANY]): name, phone, delivery address — for delivery
• Email infrastructure (Resend, Inc., USA): form content and your email address — for sending notification and confirmation emails
• Hosting and security infrastructure (Cloudflare, Inc., USA): technical data passing through while serving the site
• Accountant / bookkeeping: invoice details — for legal obligations
• Competent public authorities: upon a lawful request

Transfers abroad: Resend and Cloudflare servers may be located outside Turkey. Under Article 9 of the KVKK, data may be transferred abroad to countries with an adequacy decision by the Personal Data Protection Board, where appropriate safeguards (standard contract etc.) are in place, or exceptionally with your explicit consent or to the extent necessary for the performance of a contract. Hexa will complete the [CROSS-BORDER TRANSFER SAFEGUARD: standard contract / Board notification] arrangement with these providers. Until then, by submitting the contact form you give explicit consent to your message being transferred abroad through these providers; order data is transferred to the extent necessary to perform the contract.

We keep your data only as long as needed for the purpose and for statutory retention periods:

• Order, invoice and payment records: 10 years from the invoice date (Turkish Commercial Code Art. 82; consistent with Tax Procedure Law Art. 253)
• Distance contract, pre-contractual information and withdrawal records: 3 years (Distance Contracts Regulation Art. 20)
• Warranty and service records: for the warranty period and 2 years after it ends
• Contact form messages: 2 years; then deleted
• Server logs: the infrastructure provider's short-term log retention; Hexa keeps no separate copy

When the period ends, data is deleted, destroyed or anonymized in line with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.

Match videos you record with the Hexa camera stay on the device and on your own devices; they are not sent to us through the website and are outside the scope of this notice. For player footage in the videos, the data controller is the club or person making the recording; informing people on the pitch is the recorder's responsibility.

When the mobile app becomes available, a separate data protection notice and terms of use will be published for that service and presented for your approval inside the app.

By applying to the data controller you may:

• Learn whether your personal data is processed
• Request information if it has been processed
• Learn the purpose of processing and whether it is used in line with that purpose
• Know the third parties to whom it is transferred, in Turkey or abroad
• Request correction if it is incomplete or inaccurate
• Request deletion or destruction under the conditions in Article 7 of the KVKK
• Request that correction, deletion and destruction be notified to third parties the data was transferred to
• Object to a result against you produced exclusively by automated analysis
• Claim compensation for damage caused by unlawful processing

To exercise your rights, send your request to [EMAIL] with "KVKK request" in the subject line. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, the request must include your name, surname, Turkish ID number (nationality and passport number for foreigners), a postal or email address for notification, the subject of the request and, for written applications, your signature. You may also apply in writing to [ADDRESS].

Your request is concluded free of charge within 30 days at the latest; if the process requires additional cost, the fee set by the Board may apply.

If your request is rejected, the reply is found insufficient or no reply is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning the reply and in any case within 60 days of the application date (kvkk.gov.tr).

We update this notice as legislation or our processing changes. The current version is always published on this page; the date at the top shows the last change.