KVKK information notice

For what purpose your personal data is processed, to whom it is transferred, how long it is kept, and your rights in this regard.

Effective dateSep 22, 2026

Data controller

Your personal data is processed by the data controller whose details are given below.

Legal name: BEHERLABS ENDÜSTRİYEL KİMYASALLAR
Address: İkitelli OSB, İPKAS Plastikçiler Sanayi Sitesi No:4 B Blok, 34490 Başakşehir/İstanbul, Türkiye
Email: info@beherlabs.com
Phone: +90 501 145 65 54
Website: beherlabs.com

This text is the information notice prepared pursuant to Article 10 of the Kişisel Verilerin Korunması Kanunu No. 6698 (the Turkish Personal Data Protection Law, KVKK). It explains which of your data is processed when you shop on the site, open an account or contact us; why it is processed; and what you can do in this regard.

Which of your data we process

The data processed depends on what you do on the site. Much less data is processed about a visitor who only browses than about a customer who places an order.

Identity and contact: name and surname, email address, phone number. You can also place an order as a guest, without opening an account; in that case no account record is created, but an order record is.
Address: delivery and billing addresses.
End-user declaration: if your order contains a controlled chemical (e.g. acetone, methyl ethyl ketone), the intended use you enter at the payment step and the signed declaration you upload. Information you write by hand on the document (e.g. your Turkish identity number) stays only in the document itself; it is not entered into a separate field on the site.
Corporate buyer details: company name, tax identification number and tax office. Processed only when you open a corporate account or request a corporate invoice.
Order and payment records: order contents, amounts, payment result, invoice records. Your card details never reach us — the payment page belongs to the payment institution. We store only the card programme (e.g. Paraf) and the last four digits of the card, for display purposes.
Account security records: an irreversible hash of your password, session information, sign-in attempts. If you signed in with Google, the account information that Google passes to us.
Site usage: which pages were viewed, searches made on the site. Our own measurement does not use cookies and keeps the record as a hash that cannot be linked back to you; optional measurement cookies run only if you give your consent.
Correspondence: messages you send through the contact form and your conversations with the site assistant.

For which purposes we process your data

To create and prepare your order, hand it over to the carrier and deliver it.
To issue invoices and collect payment; to handle return and withdrawal requests.
To manage your account and to enable you to sign in and view your orders.
To respond to your questions and requests.
To keep the site secure: preventing abuse, applying rate limits, keeping a trail of administrative actions.
To fulfil obligations arising from commercial and tax legislation.
To obtain, review and retain the end-user declaration in sales of controlled chemicals.
If you give your consent, to measure usage in order to improve the site.

Legal bases

The processing described above is based on the following grounds in Article 5 of the Law:

Establishment and performance of the contract: processing relating to the receipt, preparation, delivery and return of the order.
Legal obligation: retention of invoices, commercial books and tax records; obtaining the end-user declaration and retaining it for five years, as required by Article 7 of the Kontrole Tabi Kimyasal Maddeler Hakkında Yönetmelik (Regulation on Controlled Chemical Substances). The declaration is forwarded to the Sağlık Bakanlığı (Ministry of Health) and the Türkiye İlaç ve Tıbbi Cihaz Kurumu (Turkish Medicines and Medical Devices Agency) only upon request.
Legitimate interest: account and site security, prevention of abuse, keeping error logs.
Explicit consent: only for optional cookies. You can withdraw your consent at any time through the cookie preferences link; withdrawing it does not affect your order or your account.

Security of data

Passwords are not stored as plain text; they are kept as an irreversible hash.
The card number is not stored in full anywhere.
Fields such as passwords, card numbers and identity numbers are masked before they are written to system logs, error reports and transaction logs.
Site traffic is carried over an encrypted connection.

Who your data is transferred to

Your data is transferred only to the extent the service requires: to the providers whose services we use for collecting payment, issuing the invoice, handing the order over to the carrier, sending emails, hosting the site and — if you give your consent — measuring usage. Some of these providers are established outside Türkiye. Beyond this, your data is not shared with any third party and is not sold.

If you use the site assistant, what you write to the assistant and the assistant’s replies are processed through OpenRouter and openai, established outside Türkiye. The request is sent stating that use of the conversation for model training is not permitted.

How long your data is kept

Each type of data is kept only for as long as the purpose for which it is held continues. When the period expires, the record is deleted or anonymised by a clean-up job that runs daily.

Order, invoice and payment records
Period
10 years
When the period expires
Not deleted
The Türk Ticaret Kanunu (Turkish Commercial Code) and the Vergi Usul Kanunu (Tax Procedure Law) require these records to be kept for ten years. These records remain even if you delete your account.
Anonymised form of the account record
Period
Indefinite
When the period expires
Not deleted
When you request deletion, your name, address and contact details are cleared; what remains is an emptied record, so that the invoice can stay linked to it.
Carts that did not turn into an order
Period
90 days
When the period expires
Deleted
The purpose of keeping the cart is to let you continue shopping; after ninety days that purpose comes to an end.
Site usage measurements
Period
12 months
When the period expires
Deleted
The measurement record is kept as an irreversible hash and cannot be linked to a person; after a one-year comparison window it serves no purpose.
Searches made on the site
Period
24 months
When the period expires
Deleted
Kept in order to see which products could not be found in the catalogue; after two years it no longer has any comparative value.
Cookie consent records
Period
12 months
When the period expires
Deleted
The proof of consent lives as long as the consent itself — the same period as the cookie’s lifetime.
Contact form messages
Period
24 months
When the period expires
Deleted
Kept so that the correspondence can be found later.
Stock notification requests — after the notification has been sent
Period
12 months
When the period expires
Deleted
Once the notification has been sent, the purpose of the record is fulfilled.
Guest order tracking links
Period
60 days
When the period expires
Deleted
Once the link’s access period expires, there is no longer any reason to keep the record.
Rate limit counters
Period
24 hours
When the period expires
Deleted
A counter is meaningful only during the window in which it prevents abuse.
Assistant conversations
Period
90 days
When the period expires
Anonymised
The text of the conversation and who it belongs to are deleted; what remains are figures that cannot be linked to a person, such as how many times the assistant answered and how many times it declined to answer.
Audit log of administrative actions
Period
5 years
When the period expires
Deleted
It must be possible to ask later who carried out an action concerning your account; deleting early removes the answer to that question.
End-user declarations
Period
5 years
When the period expires
Deleted
Regulations require the declaration collected when a controlled chemical is sold to be kept for five years; it is passed to the Sağlık Bakanlığı (Ministry of Health) and the Türkiye İlaç ve Tıbbi Cihaz Kurumu (Turkish Medicines and Medical Devices Agency) only on request.
Server and error logs
Period
30–90 days
When the period expires
Deleted by the provider
The hosting and error-monitoring providers delete these logs automatically when their own periods expire.
Safety data sheets
Period
As long as the product is listed + 10 years
When the period expires
Not deleted
Chemicals legislation requires these documents to be kept. The documents do not contain personal data.

How long your data is kept
Data	Period	When the period expires	Reason
Order, invoice and payment records	10 years	Not deleted	The Türk Ticaret Kanunu (Turkish Commercial Code) and the Vergi Usul Kanunu (Tax Procedure Law) require these records to be kept for ten years. These records remain even if you delete your account.
Anonymised form of the account record	Indefinite	Not deleted	When you request deletion, your name, address and contact details are cleared; what remains is an emptied record, so that the invoice can stay linked to it.
Carts that did not turn into an order	90 days	Deleted	The purpose of keeping the cart is to let you continue shopping; after ninety days that purpose comes to an end.
Site usage measurements	12 months	Deleted	The measurement record is kept as an irreversible hash and cannot be linked to a person; after a one-year comparison window it serves no purpose.
Searches made on the site	24 months	Deleted	Kept in order to see which products could not be found in the catalogue; after two years it no longer has any comparative value.
Cookie consent records	12 months	Deleted	The proof of consent lives as long as the consent itself — the same period as the cookie’s lifetime.
Contact form messages	24 months	Deleted	Kept so that the correspondence can be found later.
Stock notification requests — after the notification has been sent	12 months	Deleted	Once the notification has been sent, the purpose of the record is fulfilled.
Guest order tracking links	60 days	Deleted	Once the link’s access period expires, there is no longer any reason to keep the record.
Rate limit counters	24 hours	Deleted	A counter is meaningful only during the window in which it prevents abuse.
Assistant conversations	90 days	Anonymised	The text of the conversation and who it belongs to are deleted; what remains are figures that cannot be linked to a person, such as how many times the assistant answered and how many times it declined to answer.
Audit log of administrative actions	5 years	Deleted	It must be possible to ask later who carried out an action concerning your account; deleting early removes the answer to that question.
End-user declarations	5 years	Deleted	Regulations require the declaration collected when a controlled chemical is sold to be kept for five years; it is passed to the Sağlık Bakanlığı (Ministry of Health) and the Türkiye İlaç ve Tıbbi Cihaz Kurumu (Turkish Medicines and Medical Devices Agency) only on request.
Server and error logs	30–90 days	Deleted by the provider	The hosting and error-monitoring providers delete these logs automatically when their own periods expire.
Safety data sheets	As long as the product is listed + 10 years	Not deleted	Chemicals legislation requires these documents to be kept. The documents do not contain personal data.

Your rights

Under Article 11 of the Law, you may apply to the data controller and request the following:

To learn whether your personal data is processed.
If it has been processed, to request information about it.
To learn the purpose of the processing and whether the data is used in accordance with that purpose.
To know the third parties to whom it has been transferred, within or outside Türkiye.
If it has been processed incompletely or inaccurately, to request its correction.
To request its deletion or destruction.
To request that the correction and deletion operations be notified to the third parties to whom it has been transferred.
To object to a result to your detriment arising from its analysis solely by automated systems.
If you suffer damage because of unlawful processing, to claim compensation for the damage.

How to apply

If you have an account, you can submit your deletion request from your account settings. For your other requests, you can use the contact channels below.

A deletion request anonymises your personal data; order and invoice records remain for the statutory retention period. For details, see the retention periods section.

Email: info@beherlabs.com
Phone: +90 501 145 65 54
Address: İkitelli OSB, İPKAS Plastikçiler Sanayi Sitesi No:4 B Blok, 34490 Başakşehir/İstanbul, Türkiye