Information Text Regarding the Processing of Personal Data

Last updated: July 13, 2026

1. Data Controller

In accordance with the Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by the company below as the data controller:

KRGL Tekstil Sanayi ve Ticaret Limited Şirketi ("HOX’S" or "Company")
Address: Esenyalı Mahallesi, Yanyol Caddesi, Varyap Plaza, No:61/40, 34903 Pendik/İstanbul
MERSİS No: 0589087153300001
Tax Office / Tax ID No: Tuzla / 5890871533
Company Phone: +90 (216) 606 49 00
Customer Service: +90 (850) 308 0 803
E-mail: merhaba@hoxs.com
KVKK Application E-mail: kvkk@hoxs.com
KEP: krgl.tekstil@hs01.kep.tr

2. Scope

This Disclosure Text covers the personal data processed about visitors to the hoxs.com website and mobile web pages, those who create customer accounts, place orders, make return or exchange requests, contact customer service via email, phone, contact form, or WhatsApp, register for product stock notifications or newsletters, and those who give separate consent for campaign communications. HOX’S does not have a mobile application.

Detailed information about cookies and similar technologies can be found in the Cookie Policy. Non-essential analytical and advertising cookies are used within the framework of preference or consent mechanisms in accordance with applicable legislation.

3. Categories of Processed Personal Data

• Identity information: Name, surname, and other identity information required for invoicing or by law, if necessary.
• Contact information: Delivery and billing address, email address, phone number, and communication preferences.
• Customer transaction information: Order number, purchased product, size, color, quantity, price, campaign, delivery, return, exchange, withdrawal, invoice, and customer account information.
• Financial and payment information: Payment method, payment status, installment and transaction reference, and refund information. Full card information is not received or stored by HOX’S; payment transactions are carried out in the secure systems of authorized payment and financial institutions.
• Request, complaint, and communication information: Content of email, contact form, WhatsApp, and customer service correspondence; submitted documents, photos, and product review information.
• Transaction security and technical information: IP address, session, device, browser, traffic, and security records; cookie preferences, and fraud and misuse prevention records.
• Legal transaction and compliance information: Records related to disputes, warnings, applications, official correspondence, and obligations arising from legislation.
• Marketing information: Newsletter, campaign, product interest, communication preferences, and marketing interaction information, if explicit preference or consent is given.

HOX’S does not routinely request special categories of personal data. We kindly ask you not to send health, biometric, or similar special categories of information that are not necessary for your requests and complaints.

4. Purposes and Legal Bases for Processing Personal Data

Your personal data is processed for the following purposes, based on the processing conditions specified in Articles 5 and, to the extent applicable, 6 of the KVKK:

• Establishment and fulfillment of the order; execution of payment, invoicing, shipping, delivery, return, exchange, and withdrawal processes.
• Creation of a customer account, display of order history, and provision of requested services.
• Management of customer service, product inquiries, stock notifications, requests, complaints, and disputes.
• Ensuring transaction and site security; prevention of fraud, misuse, unauthorized transactions, and cyber risks.
• Fulfillment of obligations arising from accounting, tax, e-commerce, consumer law, and other legislation; providing information to authorized institutions.
• Establishment, exercise, or protection of a right; storage of evidence and transaction records.
• Measurement and improvement of company activities, service quality, and customer experience; protection of legitimate interests, provided that the fundamental rights and freedoms of the data subject are not harmed.
• Execution of campaign, newsletter, product recommendation, advertising, and commercial electronic communication activities, if a separate preference or consent has been given.

The necessary processes for receiving and fulfilling an order are based on the establishment or performance of a contract; invoice and legal records are based on legal obligation; processes aimed at security and protection of rights are based on legitimate interest or the establishment, exercise, or protection of a right; and non-essential marketing and advertising activities are based on explicit consent or the consent condition within the scope of relevant commercial communication legislation, to the extent applicable.

5. Methods of Personal Data Collection

Your personal data may be collected completely or partially by automated means or by non-automated means as part of a data recording system, through membership, order, payment redirection, communication, return, stock notification, and e-newsletter forms on hoxs.com; cookies and similar technologies; email, phone, and WhatsApp communication; payment institutions, banks, shipping companies, and authorized institutions.

6. Transfer of Personal Data

Your personal data may be transferred only to the following recipient groups, limited to the purpose of transfer and to the extent necessary:

• To e-commerce, hosting, technical infrastructure, and customer account service providers such as Shopify,
• To iyzico, banks, and other authorized payment/financial institutions,
• To DHL eCommerce, HepsiJet, PTT Kargo, Yurtiçi Kargo, and other logistics/delivery service providers used,
• To email, communication, cloud, and business continuity service providers such as Google Workspace,
• To WhatsApp/Meta infrastructure for the purpose of enabling communication, if the data subject communicates via WhatsApp,
• To accounting, e-invoice/e-archive, information technology, cybersecurity, audit, legal, and consultancy service providers,
• To analytical, advertising, social media, and commercial communication service providers within the scope of explicit preference or consent,
• To legally authorized public institutions, judicial authorities, and other parties required by legal obligations.

Transfers are carried out in accordance with the conditions in Article 8 of the KVKK and, when international transfer is involved, Article 9. In the event of using technology providers located abroad or providing services from systems abroad, the transfer is carried out based on an adequacy decision, appropriate safeguard, standard contract, or another valid transfer condition stipulated in the legislation. Preferences regarding non-essential cookies and advertising technologies are managed separately through the Cookie Policy and cookie management tool.

7. Commercial Electronic Communication and Marketing

Reading or accepting this Disclosure Text alone does not constitute marketing consent or explicit consent. Commercial electronic communications regarding campaigns, advertisements, and product recommendations are sent if a separate consent or another condition stipulated in the legislation exists. The data subject can stop marketing communications by using the refusal/unsubscribe method provided to them. Service messages regarding orders, delivery, security, returns, and customer services are separate from marketing communications.

8. Retention and Destruction

Personal data is retained considering the necessary period for processing, the retention periods stipulated in relevant legislation, and the statute of limitations during which a potential legal claim can be made. Order, contract, invoice, payment, delivery, return, and legal records are retained for the periods specified in relevant consumer, tax, commercial, and e-commerce legislation; marketing data is retained until consent is revoked, the right to refuse is exercised, or the processing purpose ends; and request and complaint records are retained for the necessary period to finalize the request and protect legal rights.

When the processing conditions and retention necessity cease to exist, personal data is deleted, destroyed, or anonymized using appropriate technical and administrative methods.

9. Rights of the Data Subject

Within the scope of Article 11 of the KVKK, you have the right to;

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether it is used appropriately for its purpose,
• Know the third parties to whom it has been transferred domestically or abroad,
• Request correction of incomplete or incorrectly processed data,
• Request deletion or destruction of data within the framework of the conditions in the law,
• Request notification of corrections, deletions, or destructions to third parties to whom the data has been transferred,
• Object to a result against you arising from analysis exclusively by automated systems,
• Request compensation for damages if you suffer damage due to unlawful processing.

rights.

10. Application to the Data Controller

You can submit your requests within the scope of the KVKK by one of the following methods:

• Written application: Esenyalı Mahallesi, Yanyol Caddesi, Varyap Plaza, No:61/40, 34903 Pendik/İstanbul
• KEP: krgl.tekstil@hs01.kep.tr
• Using secure electronic or mobile signature: kvkk@hoxs.com
• Via your email address previously notified to our company and registered in our system: kvkk@hoxs.com

The application should include your name-surname, signature if the application is written, T.C. identity number for citizens of the Republic of Turkey, nationality and passport or identity number if any for foreigners, address for notification, email/phone information for notification if any, and the subject of the request. Additional information may be requested for identity verification, depending on the nature of the request; unnecessary personal data is not requested.

Applications are concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. If the process requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board may be applied.

11. Updates

This Disclosure Text may be updated according to changes in personal data processing activities or legislation. The current text is published at hoxs.com/pages/kvkk. When a new processing activity requiring separate fulfillment of the disclosure obligation arises, the data subjects are informed by appropriate methods.