Privacy Policy

The data controller is [COMPANY LEGAL NAME], [COMPANY REGISTERED ADDRESS], tax number [COMPANY TAX NUMBER]. You can reach us about anything in this policy at care@victorianbeautyline.com.

• Account details — your name, email address and, if you give it, your phone number. We need these to create your account and to contact you about orders.
• Order details — what you bought, what you paid, and the delivery address. We need these to fulfil the contract and we are legally required to keep the invoice records.
• Payment metadata — the card brand and last four digits only, so your receipt is readable. We never receive, store or log the full card number, expiry date or security code: those go directly from your browser or our server to the payment provider.
• Technical data — IP address and browser user agent, kept against your login sessions. We use these to detect suspicious sign-ins and to rate-limit abuse.
• Marketing preferences — only if you opt in. You can withdraw consent at any time in Account → Notifications.

• Performance of a contract — processing your order, delivering it, and handling returns.
• Legal obligation — retaining invoices and tax records for the statutory period.
• Legitimate interests — securing accounts, preventing fraud, and improving the store. We balance these against your rights and keep the data minimal.
• Consent — marketing email, and any non-essential cookies. Consent can be withdrawn without affecting anything we did before you withdrew it.

We do not sell your personal data, ever. We share the minimum necessary with the service providers that make the shop work: our payment provider, our delivery carriers, our email provider, and our hosting provider. Each acts on our instructions under a data processing agreement.

• Order and invoice records — for the statutory retention period under Turkish tax law (currently 10 years).
• Account data — until you ask us to delete the account, minus anything we must retain for the records above.
• Login sessions — 30 days, then automatically purged.
• Password reset tokens — one hour, and they are single use.
• Marketing subscriptions — until you unsubscribe.

Under KVKK Article 11 — and, where it applies to you, the GDPR — you can ask us what data we hold about you, have it corrected, have it deleted, restrict or object to processing, and receive a copy in a portable format. Write to care@victorianbeautyline.com and we will respond within 30 days. If you are not satisfied, you may complain to the Turkish Personal Data Protection Authority (KVKK) or to your local supervisory authority.

Passwords are stored only as bcrypt hashes and are never recoverable, by us or anyone else. Session tokens are stored as SHA-256 hashes, so a database leak cannot be replayed as a login. The site is served over HTTPS in production, and administrative functions require an administrator role.