Privacy notice

This notice explains what personal data we process when you use homestylecy.com and order from us, why and on what legal basis, who receives it and how long we keep it. It also sets out your rights under the Personal Data Protection Law No. 89/2007 of Northern Cyprus.

Data controller ("controller" in the Law)

H.S Home Style, registration number 158871, owned by Hatice Sarıkaya. Address: Atatürk Caddesi, Yasemin Apartmanı, Dükkân 3, Gönyeli, Nicosia (Lefkoşa), TRNC. Phone and WhatsApp: 0539 112 17 87. Email: [email protected].

The website is built, hosted and run for H.S Home Style by Elevates Digital Services OÜ (Estonia, registry code 17455911). Elevates processes your data only on our instructions and only for the purposes in this notice.

Information the website's server does not keep

Your cookie choice is stored only in your own browser. Your basket and any discount code you enter are also kept in your browser; the products in your basket reach us only in the WhatsApp message you send.

What you type into the order form and the contact form (name, phone number, delivery address and delivery details, subject, message) is not sent to the website's server and is not stored there. When you press the button on the form, this information opens in WhatsApp as a message ready to send. You decide whether to send it.

Information that reaches us, why, and on what legal basis

Some of this information you give us yourself, by WhatsApp, phone or email. The rest is recorded automatically while you use the site: server records always, and Google Analytics data only if you agree.

Orders and questions by WhatsApp, phone or email

When you contact us by WhatsApp, phone or email, we receive: your name, phone number, your email address if you email us, delivery address and delivery details, the details you give for the invoice (company name and tax number, if any), payment details (payment method and amount; for a bank transfer, the sender's name and bank), the products you order and your message. We use them to confirm your order, take your payment, deliver and install the product, issue the invoice, resolve warranty, return and service requests, and answer your questions.

Legal basis: performing the sales contract you are a party to, and taking steps at your request before a contract is made (Law No. 89/2007, Article 6(2)). For invoices and accounting records, the legal basis is a legal obligation we are subject to (Article 6(1)).

You are under no legal obligation to give us information. Without your name, phone number and delivery address, however, we cannot confirm or deliver your order.

Every time you visit the site

Your browser automatically sends your IP address, browser details, the pages you open (including searches on the site) and the time to the server that hosts the site. We use these records to run the site, find errors and protect the site against attacks. Cloudflare also filters traffic to the site for the same purposes on our behalf, and sees your IP address while doing so.

Legal basis: our legitimate interest in providing the site securely (Article 6(5)). Server records are deleted after 14 days; they may remain for about two more weeks in the hosting company's server snapshots.

Only if you agree: Google Analytics

If you accept Statistics cookies in the cookie banner, Google Analytics 4 loads and automatically records: the pages and products you view, how far you scroll, searches you make on the site, clicks on external links, the site or campaign that brought you here, device type, browser, operating system, screen size, language and your approximate location (city and country) derived from your IP address. Your IP address reaches Google to determine your location, but Google Analytics does not store it. A random identifier, kept in a cookie for up to two years, is used to recognise returning browsers.

The purpose is to understand which products and pages interest people, so we can improve the shop. Google Signals and advertising features are switched off. Your name, phone number, email address and basket contents are not sent to Google Analytics. Detailed visit data is deleted automatically after 14 months; summary reports such as total visit counts remain.

Legal basis: your explicit consent (Article 6).

Only if you agree: the Google map

If you accept Maps cookies in the cookie banner, or press "Load the map" in the map area, the Google map showing where our shop is will load. Your browser then connects directly to Google's servers; Google receives your IP address, may set its own cookies and may read cookies it set earlier. If you do not agree, a static image appears where the map would be.

Legal basis: your explicit consent (Article 6).

Only if you agree: product videos

Some product pages have a YouTube video. If you accept Video cookies in the cookie banner, or press "Play the video" in the video area, the videos load. Your browser then connects to Google's (YouTube's) servers abroad, including in the United States; Google receives your IP address and may set cookies. If you do not agree, a notice and a "Play the video" button appear where the video would be.

Legal basis: your explicit consent (Article 6; for the transfer abroad, Article 11(2)(A)).

You do not have to agree. Even if you refuse, the basket, ordering and the rest of the site work; only the map is replaced by a static image, and each video by a notice. You can withdraw your consent at any time through "Cookie settings" at the bottom of every page; statistics data already sent stays in Google Analytics until its retention period ends.

Google reviews shown on the site

The site shows reviews that our customers have written publicly about our shop on Google, together with the first and last name the reviewer shows on Google; we do not show photos. This information is taken automatically from our shop's page on Google. The purpose is to show visitors what customers have written about our shop on Google.

Legal basis: our legitimate interest in presenting our shop (Article 6(5)). The reviewers have already published their reviews publicly on Google.

If you do not want your review or your name shown on our site, write to us and we will remove the review from our site. A review you delete or change on Google is also updated on our site within 30 days at the latest.

Who receives it, and why

• Elevates Digital Services OÜ (Estonia): builds, hosts and maintains the site for us, and runs the Google Analytics account on our behalf.
• Hostinger: the server holding the site and its database, in Düsseldorf, Germany. Hostinger's own full server snapshots are kept in Lithuania for about two weeks.
• Cloudflare, Inc. (USA): protects and speeds up the site, and sees your IP address while doing so. It also stores product images and encrypted backups; the backups are kept in European Union countries.
• Google, statistics, the map and video (Google Ireland Limited and Google LLC): receives your data only if you agree. This data is processed on servers abroad, including in the United States; the legal basis for this transfer is your explicit consent (Article 11(2)(A)).
• Google, email (Gmail): our shop's email address is on Gmail. If you email us, your message travels through Google's servers and is stored there. For correspondence about orders, this transfer is needed to carry out your order, or steps you ask us to take before an order (Article 11(2)(B)).
• WhatsApp (Meta): when you write to us on WhatsApp, your message travels over WhatsApp's infrastructure under WhatsApp's own terms. You start this transfer yourself; for orders, it is needed to carry out your order, or steps you ask us to take before an order (Article 11(2)(B)).
• Banks: when you pay by card or bank transfer, your payment is processed by your bank and ours. Your card details go to the bank through the card terminal, not to us.
• Delivery and service: for orders we send by courier, the courier company; for warranty or fault claims, the brand's authorised service centre. Each receives only the name, phone number, address and product details it needs for the delivery or the service.
• Public authorities: only where the law requires it, and only as much as it requires.

We do not sell or rent your information, and we do not use it for advertising. We do not send you promotional or advertising messages without your written consent.

How long we keep it

• Server records: 14 days. The hosting company's server snapshots: about two weeks.
• Detailed visit data in Google Analytics: 14 months.
• Order details, WhatsApp conversations and emails: until your order, delivery, warranty and return matters are completed. Invoices and accounting records: for the retention period the legislation requires.
• Google reviews shown on the site: as long as they stay published on Google and you have not asked us to remove them; a review deleted on Google comes off our site within 30 days at the latest.
• Your basket: in your own browser until you delete it. Your cookie choice: 6 months.
• The site's encrypted backups: data deleted from the site is also removed from the backups within 6 months at the latest.

How it is protected

The site works only over an encrypted connection (HTTPS). Only authorised users with their own account can enter the administration panel; the number of login attempts is limited, and the panel is also protected by Cloudflare's access control. Backups are encrypted before they leave the server.

Your rights

Under Law No. 89/2007 you can:

• find out whether personal data about you is processed, and ask what data is processed and where it came from, why it is processed, who has received it and which categories of data are involved (Article 14);
• ask for your data to be corrected, deleted or blocked from use, and ask for this to be notified to any third party that received it (Article 14);
• object at any time, on legitimate grounds relating to your particular situation, to the processing of your data (Article 15);
• withdraw any consent you gave, at any time. For cookies, use "Cookie settings" at the bottom of every page.

Send your request in writing to [email protected], to our WhatsApp line or to our shop address. We reply in writing within 30 days to requests for information, correction, deletion or blocking (Article 14), and within 15 working days to objections (Article 15).

If you get no reply within these periods, or find our reply unsatisfactory, you can apply to the Personal Data Protection Board of Northern Cyprus (Kişisel Verileri Koruma Kurulu). You can also take any complaint about how the Law is applied directly to the Board at any time (Article 34; kvkk.gov.ct.tr).

Cookies

Our Cookie policy lists one by one what the site stores on your device, why, and for how long.

Changes

If we change this notice, we publish the new text on this page with its update date. Before using your data for a new purpose, we inform you separately.