Privacy Policy
This English version is provided for convenience. In case of any discrepancy, the Turkish version prevails.
1. Who we are
This policy explains how the Hamurlabs group handles personal data on hamurlabs.com and in the HaROS platform. Version 1.0, effective 15.10.2026.
The group consists of two companies. Each acts for the relationships it holds:
| Company | Details | Acts for |
|---|---|---|
| Hamurlabs BV | Kapeldreef 60, 3001 Leuven, Belgium · Enterprise no. 1008.980.934 | Customers, contacts and visitors in the EU/EEA, the UK and other countries outside Türkiye; applicable law: GDPR and UK GDPR |
| Hamurlabs Elektronik Hizmetler Yazılım ve Ticaret A.Ş. | Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. B2 Blok No: 151/1C İç Kapı No: 111 Esenler / İstanbul, Türkiye · Mersis 0456-0607-9150-0001 · KEP [email protected] | Customers, contacts and visitors in Türkiye; applicable law: KVKK (Law No. 6698) |
In this policy, "Hamurlabs", "we" and "us" mean the company responsible in the situation concerned.
Contact for all privacy matters: [email protected]. Requests for Hamurlabs A.Ş. can also be sent by KEP or by post to the Istanbul address above.
2. Scope and our roles
We process personal data in two different roles, and this policy covers both.
- As controller, we decide why and how data is processed. This covers our website, demo requests, business contacts, customer account administration and job applications (section 3).
- As processor, we process data on behalf of our customers, the merchants who use HaROS (OMS, WMS, PIM and fulfilment). This covers order, customer and shipping data that merchants bring into HaROS, including data received from the marketplaces and sales channels they connect (section 4). In this role the merchant is the controller and we act only on its instructions.
If you bought from a merchant that uses HaROS, that merchant's privacy policy governs your data. We support the merchant in handling your requests.
3. Data we process as controller
We collect only what each purpose needs. We do not sell personal data and do not use it for automated decisions with legal effect.
| Who | Data | Purpose | Legal basis (GDPR / KVKK) |
|---|---|---|---|
| Website visitors | IP address, browser and device data, pages visited, security logs | Running and securing the website, preventing abuse | Legitimate interest — Art. 6(1)(f) / m.5/2-f |
| Demo and contact requests | Name, business email, phone (optional), company, role (optional), modules of interest, order volumes, message; demo account username and access logs if a demo account is created | Answering the request, preparing and giving the demo, pre-contract communication | Steps before a contract — Art. 6(1)(b) / m.5/2-c; legitimate interest — Art. 6(1)(f) / m.5/2-f |
| Customer and supplier contacts | Name, business contact details, role, communications, contract and invoice records | Managing the contract, support, billing, legal and tax obligations | Contract — Art. 6(1)(b) / m.5/2-c; legal obligation — Art. 6(1)(c) / m.5/2-ç |
| HaROS user accounts | Name, business email, username, role, login and activity logs | Providing access, security, support | Contract — Art. 6(1)(b) / m.5/2-c; legitimate interest — Art. 6(1)(f) / m.5/2-f |
| Job applicants | CV data, contact details, interview notes | Recruitment | Steps before a contract — Art. 6(1)(b) / m.5/2-c; consent for keeping your CV for future roles — Art. 6(1)(a) / m.5/1 |
| Newsletter and marketing | Name, email, preferences | Sending commercial electronic messages | Consent — Art. 6(1)(a) / m.5/1; you can withdraw at any time |
Please do not send us special categories of data (for example health data) or personal data of other people in free-text fields.
4. Data we process for our customers (HaROS and integrations)
When a merchant connects a marketplace, web shop or sales channel to HaROS, we receive the data needed to fulfil its orders. We process it only to provide the service the merchant has instructed.
Data concerned: buyer name, delivery and billing address, phone number and email (where the channel provides them), order details, product and inventory data, shipment and return records.
Purposes: order synchronisation, inventory and catalogue updates, warehouse picking and packing, shipping label creation, returns, invoicing and the related support.
Our commitments:
- We use this data only on the merchant's instructions and in line with the data processing agreement and the terms of the connected channel. We never use it for our own marketing, profiling or sale.
- Data is stored in cloud infrastructure in the EU (Belgium), encrypted in transit (TLS 1.2+) and at rest (AES-256). Each merchant's data is logically separated.
- Access is limited to named personnel who need it, with multi-factor authentication, and is logged and reviewed.
- Requests to access, correct, delete or restrict data are actioned without undue delay when received from the merchant or the channel.
- After a merchant's contract ends, its data is deleted within 60 days, unless the law requires longer retention of specific records. Backup copies are overwritten in the normal backup cycle. We provide written confirmation of deletion on request.
- We notify the merchant, and the channel where its terms require it, of a personal data breach without undue delay.
If you are a buyer and want to exercise your rights, please contact the merchant first. If you contact us, we will forward your request to the merchant and help them answer it.
5. Who receives data and international transfers
We share personal data only with the service providers below, within the Hamurlabs group, and with public authorities where the law requires it.
| Recipient | Role | Location |
|---|---|---|
| Cloud hosting provider | Hosting of HaROS and the website, backups | EU (Belgium) |
| Corporate email and document provider | Corporate email and documents | Provider's data centres, including outside the EU |
| Content delivery and security provider | Content delivery and website security | Global network |
| Hamurlabs BV / Hamurlabs A.Ş. | Development, support and operations within the group | Belgium / Türkiye |
| Merchant-selected carriers and channels | Delivery and order updates, only on the merchant's instructions | As chosen by the merchant |
Transfers outside the EU/EEA: where data reaches a country without an EU adequacy decision, including access by group staff in Türkiye, we use the European Commission's Standard Contractual Clauses and additional safeguards.
Transfers outside Türkiye (KVKK): data of Hamurlabs A.Ş. is transferred abroad, including to the EU hosting region, under KVKK Art. 9 safeguards: standard contracts with the providers concerned, notified to the Personal Data Protection Authority.
6. Retention, security and cookies
We keep data only as long as the purpose or the law requires, then delete, destroy or anonymise it.
| Data | Retention |
|---|---|
| Demo and contact requests that do not lead to a contract | 12 months from the request |
| Customer data in HaROS (processor role) | While the contract is active, then deleted within 60 days |
| Contracts and customer/supplier correspondence | 10 years after the contract ends |
| Invoices and accounting records | 10 years (Turkish and Belgian law) |
| Security, access and system logs | 2 years, longer only if needed as evidence for an incident |
| Job applications not leading to hiring | 1 year after the decision |
| Marketing data | Until you withdraw consent; reviewed yearly |
Security: we apply encryption in transit and at rest, least-privilege access with multi-factor authentication, centrally managed and encrypted company laptops, logging and monitoring, and a documented incident response process. Our information security management system is aligned with ISO/IEC 27001.
Cookies: our website uses cookies that are strictly necessary for its operation and security. If we use analytics or marketing cookies, we ask for your consent first, and you can change your choice at any time.
7. Your rights
You can ask us to:
- confirm whether we process your data and give you a copy;
- correct inaccurate or incomplete data;
- delete your data, or restrict its processing;
- give you the data you provided in a portable format;
- stop processing based on our legitimate interest;
- stop sending marketing messages, and withdraw any consent you gave;
- tell third parties who received your data about a correction or deletion (KVKK);
- compensate damage caused by unlawful processing (KVKK).
Send requests to [email protected]. Requests for Hamurlabs A.Ş. can also be sent by KEP or in writing to the Istanbul address. We answer within one month (GDPR) or 30 days (KVKK). We may ask you to confirm your identity.
Complaints: you can complain to the Belgian Data Protection Authority ([email protected]), the supervisory authority in your EU country, the UK Information Commissioner's Office, or, for Hamurlabs A.Ş., the Turkish Personal Data Protection Board (KVK Kurulu). We would welcome the chance to resolve your concern first.
Children: our services are for businesses and are not directed at children. We do not knowingly collect children's data.
Changes: when we update this policy, we publish the new version on this page with a new version number and date.