Privacy Policy

This policy explains how NESCO uses personal data when you visit our international store at nesco.com.tr/en, open an account, place an order or contact us. NESCO is based in Türkiye, so Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK) applies to everything we do with your data. Section 11 gives additional information for US residents.

At a glance

• We use your data to run your account, make and deliver your order, invoice it, answer your questions and keep our website secure.
• Our English store uses no analytics, advertising or tracking tools. We do not show you targeted ads based on your visit, and we do not sell or share your personal data for advertising.
• Card payments are handled by iyzico on its own secure payment page. NESCO never sees or stores your card details.
• Our customer and order database is on our server in Türkiye.
• Some of our service providers are outside Türkiye (section 7).
• You can ask for a copy of your data, or ask us to correct or delete it (section 9).

1. Who we are and how to contact us

The data controller (the party responsible for your personal data) is:

2. The personal data we collect

Data you give us

• Account: your name, e-mail address and password. We never store your password itself, only a one-way code (hash) made from it, so no one at NESCO can see it.
• Orders: delivery and billing address, phone number, the items and options you choose, prices, shipping cost, order number and order notes.
• Messages: what you write to us by e-mail, WhatsApp or Instagram, what you tell us by phone or in our shop, and any photos or files you choose to send.
• Records of what you accepted: which version of our sales documents you accepted at checkout, and when.

Data we collect automatically

• Security and technical data: IP address, time of access, browser and device type, sign-in times, failed sign-in attempts, and the result of our bot check (Cloudflare Turnstile).
• Error reports: if a page fails in your browser, we record the error text, the page address and the browser type and main version. This record contains no IP address and no identity.

Data we receive from others

• iyzico: the result of your payment and a payment reference.
• Our shipping partner and carriers: tracking events and delivery problems.
• Instagram and WhatsApp (Meta): your profile name, username or phone number when you message us there.

We do not ask for sensitive data (for example about your health, religion or ethnic origin). Please do not send it to us.

3. Do you have to give us your data?

You can browse our store without an account and without giving us personal data. To buy, you need an account and must give the details marked as required at checkout. Without them we cannot make, invoice and deliver your order.

4. How we use your data and our legal bases

For each purpose we give the legal basis under KVKK (Article 5).

4.1 Your account

We use your account details to open your account, check your e-mail address with a verification code, let you sign in with your e-mail address and password, reset your password with a code sent to your e-mail, show your orders, documents and saved addresses, and delete your account when you ask. After you sign in, you stay signed in for 7 days unless you sign out. After repeated failed sign-in attempts, sign-in is paused for a while to protect your account.

• Legal basis: performing our contract with you (Art. 5(2)(c)); for account security and preventing misuse, our legitimate interest (Art. 5(2)(f)).

4.2 Taking, making and delivering your order

We use your details to confirm your order, cut and sew it in our workshop, pack it, ship it and deal with delivery questions. Our shipping partner, the carrier and US Customs receive your name, delivery address, phone number and e-mail address, and the description and value of the parcel.

• Legal basis: performing our contract with you (Art. 5(2)(c)).

4.3 Payments and refunds

You pay by card through iyzico, our payment service provider. You enter your card details on iyzico's secure payment page, not on our website, and iyzico processes them under its own privacy notice. We receive the payment result and a payment reference, which we use to match the payment to your order, make refunds and handle payment disputes.

• Legal basis: performing our contract with you (Art. 5(2)(c)); for fraud prevention and disputes, establishing and protecting our rights and our legitimate interest (Art. 5(2)(e) and (f)).

4.4 Invoices, accounting, tax and customs

We issue a Turkish export invoice for your order through a licensed e-invoice provider, and invoice data is sent to the Turkish Revenue Administration as Turkish law requires. We keep accounting records and give export and customs information when required.

• Legal basis: expressly provided for by law and necessary for our legal obligations (Art. 5(2)(a) and (ç)).

4.5 Private order-tracking link

After you order, we give you a private link that is practically impossible to guess. It shows only the production stages of your order with their times, the names of the parts in your order and how many are ready. It never shows your name, phone number, address, the amount you paid or the names of our staff. Anyone who has the link can see these stages, so please share it only with people you trust.

• Legal basis: performing our contract with you (Art. 5(2)(c)).

4.6 Service messages

We send you the e-mails you need about your account and your orders: verification and password reset codes, order confirmation with your order documents, tracking information, invoices and answers to your questions. These are not marketing messages.

• Legal basis: performing our contract with you (Art. 5(2)(c)).

Marketing: the English store does not send marketing e-mails or messages. If we ever offer them, we will ask for your separate consent first and update this policy.

4.7 Customer service

You can reach us by e-mail, WhatsApp, Instagram direct message, phone or in our shop. We use your messages to answer you and to handle orders, cancellations, returns and complaints.

Instagram messages may first be answered by an AI-assisted reply assistant. To produce a reply, the text of your message and your username are sent to our AI service provider (Anthropic, USA). The assistant answers questions about products, prices and orders. It does not place, cancel or refund orders and makes no decision about you. If you write that you want to talk to a person, your conversation goes to one of our staff without delay.

WhatsApp and Instagram are services of Meta. When you use them, Meta also processes your messages under its own terms.

• Legal basis: performing our contract with you or taking steps you ask for before an order (Art. 5(2)(c)); our legal obligations on complaints (Art. 5(2)(ç)); our legitimate interest in answering people who contact us (Art. 5(2)(f)).

4.8 Internal order notifications

When an order is placed, our team receives a short notification through a cloud messaging app (Telegram) so that the workshop can start on time. It contains the order number, the products and production details and, only where needed, the buyer's name.

• Legal basis: performing our contract with you (Art. 5(2)(c)); our legitimate interest in processing orders on time (Art. 5(2)(f)).

4.9 Website security, error monitoring and backups

Our web pages are delivered through Cloudflare, which also runs our firewall and bot protection (including Cloudflare Turnstile at sign-up, sign-in and checkout). Our server keeps security logs. Server errors are reported to Sentry, an error-monitoring service; personal fields such as e-mail addresses, phone numbers and session details are masked before they are sent. We back up our database so that data is not lost.

• Legal basis: our legal obligation to keep data secure (Art. 5(2)(ç), with KVKK Art. 12); our legitimate interest in a secure and working website (Art. 5(2)(f)); protecting our rights (Art. 5(2)(e)).

4.10 Legal claims and official requests

If there is a complaint, a payment dispute (chargeback), a legal claim or a request from an authority, we use the relevant order, payment, delivery and message records.

• Legal basis: necessary for our legal obligations and to establish, exercise or protect a right (Art. 5(2)(ç) and (e)).

4.11 Automated decisions

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you. Cloudflare's bot protection is automatic; if you think it blocked you by mistake, contact us and a person will look at it.

5. Cookies

The English store uses only cookies and similar technologies that are strictly necessary: a session cookie that keeps you signed in, browser storage that remembers your cart (product codes and quantities only), and Cloudflare's bot protection. It uses no analytics or advertising cookies and shows no cookie banner. It uses no analytics or advertising cookies. See our Cookie Policy.

6. Where your data is stored

• Our customer and order database runs on our server hosted by DorukCloud in Türkiye. It is not transferred abroad as a whole.
• Our backups are kept in Türkiye.
• Our web pages and the connection to our server go through Cloudflare's global network.
• Some service providers process the data they need abroad (section 7).

7. Who receives your data

We share personal data only when it is needed for the purposes in section 4. We do not sell your personal data.

8. Transfers outside Türkiye

• We keep the heaviest data at home: our customer and order database stays in Türkiye, and each provider abroad receives only what its service needs.
• The Turkish Personal Data Protection Board has not issued an adequacy decision for any country. For the regular transfers to providers listed in section 7, we rely on the appropriate safeguards in KVKK Article 9, mainly the standard contracts published by the Board.
• To deliver your parcel to you in the United States, your delivery details must go to the carrier and to US Customs. This transfer is made for each order and is necessary to perform our contract with you (KVKK Article 9(6)(b)).
• We do not use your consent as the basis for these transfers.

You can ask which safeguard applies to a provider by writing to abidin@nesco.com.tr.

9. Your rights and how to use them

Under KVKK (Article 11) you have the right to:

• learn whether we process your personal data, and request information about it;
• learn the purpose of the processing and whether your data is used for that purpose;
• know the third parties in Türkiye or abroad who receive your data;
• ask for incomplete or incorrect data to be corrected;
• ask for your data to be deleted or destroyed under the conditions in KVKK Article 7;
• ask that corrections and deletions are passed on to those who received your data;
• object to a result against you that arises only from the automated analysis of your data;
• claim compensation if you suffer damage because your data was processed unlawfully.

How to make a request. E-mail abidin@nesco.com.tr from the e-mail address registered in your account, or send a signed letter to our address in section 1, or use registered electronic mail (KEP) to abidinmert.yagci@hs01.kep.tr. Tell us your name, your address or e-mail address for our reply, your nationality and passport or ID number if you are not a Turkish citizen, and what you are asking for. We may ask you to confirm your identity, because giving your data to someone else would itself be a breach. We answer free of charge, as quickly as possible and within 30 days at the latest. If the request requires extra cost, Turkish law allows a fee set by the Board.

Deleting your account. You can delete your account from your account page; we send a confirmation code to your e-mail address first. If you have an order in progress, we delete the account after that order is completed. Records that we must keep by law (such as invoices and sales contract records) are kept for the legal period and then deleted, and are not used for anything else.

Complaints. Please contact us first. If we refuse your request, if you find our answer insufficient or if we do not answer in time, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) within 30 days after you learn of our answer, and in any case within 60 days after your request (KVKK Article 14).

10. How long we keep your data

When a period ends, we delete, destroy or anonymise the data.

11. Information for US residents

• We do not sell your personal data, and we do not share it for cross-context behavioural or targeted advertising. The English store runs no advertising pixels, analytics tags or third-party tracking.
• Categories and recipients: the categories of personal data we collect are in section 2, and the categories of third parties who receive it are in section 7.
• Do Not Track and Global Privacy Control: we do not track you across websites, so there is nothing for these browser signals to switch off. We do not allow other companies to collect personal data about your online activities over time and across websites through our store.
• Your requests: you can ask us to access, correct or delete your personal data, wherever you live in the United States (section 9). We do not treat you differently for making a request.
• Sensitive data: we do not collect sensitive personal information.
• Children: our store is for adults. You must be at least 18 to open an account or buy. We do not knowingly collect data from children under 13; if you believe a child has given us data, contact us and we will delete it.
• How you will know about changes: the date at the top of this page shows when this policy was last updated (its effective date). If we make an important change, we tell account holders by e-mail before it takes effect.

12. Visitors from other countries

We currently sell and deliver only to the United States. If you contact us from another country, this policy and KVKK still apply to the data you give us.

13. Security

We use technical and organisational measures appropriate to the risk, such as encrypted connections, hashed passwords, access controls, bot protection, limits on sign-in attempts and backups. No system is completely secure. If a personal data breach affects you, we inform you and the authorities as the law requires.

14. Changes to this policy

We update this policy when the law or what we do with your data changes. The current version is always on this page, and the date at the top shows the last change.