Privacy Policy

This privacy policy explains what personal data we process when you visit this website, place an order or contact us, why we do it, and what rights you have. We follow the EU General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law No. 6698 (KVKK), as applicable.

1. Who is responsible for your data

Data controller:

You can reach us at the contact details above for any privacy question or request.

2. What data we collect

• Order data: name, delivery address, email address, phone number, the products you order, order number and amounts, any note you add, and the time you accepted the pre-contract documents. To prevent misuse, we also store a shortened one-way hash (pseudonym) of your IP address with the order.
• Payment data: details of your bank transfer, such as the sender's name, the amount, the date and the payment reference. We never receive card data, because we don't accept card payments.
• Communication data: the content of messages you send us by email, phone or WhatsApp, and our replies.
• Technical data: IP address, browser type, pages visited and time of access, as recorded in server logs for security and troubleshooting.
• Link clicks: when you click a "Buy from ROOT" button, our server records the product, the time, the site language, the ROOT store you are sent to, the approximate country (from the location information supplied by our hosting provider), the referring website and a shortened one-way hash (pseudonym) of your IP address and browser identifier. We don't store your IP address in readable form, don't set a cookie for this and don't link the record to your name. We use it to send you to the right ROOT store and to see which pages are useful.
• Product reviews: if you submit a review through the form on this site, we process your name (shown publicly with the review), your rating and text, your email address (never published; used only if we need to contact you about the review) and a shortened one-way hash of your IP address to prevent spam. Reviews are published only after we have checked them.
• Analytics data: only if you consent (see section 5).

We receive this data directly from you (checkout form, messages, review form), automatically from your browser (server logs, click records and, only with your consent, Google Analytics), from our bank (details of your incoming transfer) and from ROOT (the ROOT order number and tracking details for your parcel). We don't buy data from third parties.

3. Why we use your data, and the legal basis

• To process and deliver your order, including placing it with ROOT and keeping you updated by email: performance of a contract (Art. 6(1)(b) GDPR; Art. 5(2)(c) KVKK).
• To keep records required by tax and commercial law: legal obligation (Art. 6(1)(c) GDPR; Art. 5(2)(ç) KVKK).
• To answer your questions: performance of a contract or steps before one, or our legitimate interest in replying to you (Art. 6(1)(b) and (f) GDPR; Art. 5(2)(c) and (f) KVKK).
• To keep the website secure and working, and to count link clicks: legitimate interest (Art. 6(1)(f) GDPR; Art. 5(2)(f) KVKK).
• To publish reviews you submit and prevent spam: your consent when you submit the review, and our legitimate interest in preventing misuse (Art. 6(1)(a) and (f) GDPR; Art. 5(1) and 5(2)(f) KVKK).
• Website analytics with Google Analytics 4: your consent (Art. 6(1)(a) GDPR; Art. 5(1) KVKK). You can withdraw consent at any time.

4. Who we share your data with

• ROOT (Root Wellness, LLC, USA): to fulfill your order, we place it on ROOT's store as the seller, on our own account, giving your name as the recipient, your delivery address and the contact details needed for delivery. ROOT and its carriers then process this data to ship your parcel.
• Our bank: to receive your payment and, if needed, to send a refund.
• Our hosting and email providers: they process data on our behalf to run the website and send order emails.
• Google (Google Analytics 4): only if you consent to analytics.
• Authorities: where we are legally required to.

We don't sell your data, don't send marketing emails and don't use your data for advertising, our own or third parties'.

5. Cookies and analytics

The shop only stores what it needs in your browser: your cart and your cookie choice (local storage). No language, login or advertising cookies are set for visitors. Google Analytics only runs after you click "Accept analytics" in our cookie banner; until then, it is not loaded. We don't use the Meta Pixel, Google Tag Manager or other marketing trackers. Details are in our cookie policy.

6. International transfers

ROOT is based in the United States, so your order data is transferred to the US when we place your order. This transfer is necessary to perform the contract you have asked us to fulfill (Art. 49(1)(b) GDPR; for KVKK, Art. 9 as applicable). Where Google Analytics is used with your consent, data may also be processed in the US by Google under its own safeguards.

7. How long we keep your data

• Order and payment records: as long as tax and commercial law require (typically up to 10 years, depending on the applicable law).
• Messages: as long as needed to handle your request, and then for up to 2 years unless they relate to an order.
• Reviews: as long as the review is published; if you ask us to remove it, we delete it together with your email address.
• Server logs and link-click records: for a limited period, normally no longer than 12 months.
• Analytics data: according to the retention setting in Google Analytics, no longer than 14 months.

8. Your rights

Under the GDPR, you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Under Article 11 of the KVKK, you can also ask whether your data is processed, request information about processing and transfers, and request correction, deletion or notification of third parties.

To exercise your rights, contact us using the details in section 1. We'll reply within one month (GDPR) or 30 days (KVKK). You also have the right to complain to a data protection authority, for example the authority in your EU country of residence, or the Turkish Personal Data Protection Authority (KVKK).

9. Security

The website uses an encrypted (HTTPS) connection. We keep access to order data limited to what's needed to handle your order.

10. Links to other websites and services

Our pages link to ROOT's store, and you can contact us via WhatsApp. When you follow such a link or use such a service, the provider's own privacy policy applies (for ROOT, see ROOT's privacy policy). We have no control over how those providers handle your data.

11. Children

This website is not directed at children, and you must be at least 18 years old to order. We don't knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

12. Changes

We may update this policy when our processes or the law change. The current version is always available on this page.

reCAPTCHA

We may use Google reCAPTCHA on our forms to prevent spam and abuse. reCAPTCHA may send information about your device and browsing behaviour (such as IP address, cookies and mouse or screen interactions) to Google for analysis; use of the service is subject to the Google Privacy Policy and Terms of Service.