Privacy Policy

Last updated: 20 August 2026 · Effective date: 20 August 2026

MYRA SUPPLIER LTD ("we", "us", "our") operates the website heliosync.app (the "Site"). We are committed to protecting your privacy and handling your personal data lawfully, fairly and transparently. This Privacy Policy explains what data we collect, why we collect it, how long we keep it, who we share it with and what rights you have. It applies to visitors of the Site; the Heliosync platform itself (dash.heliosync.app) is available to authorized users only and is governed by separate agreements.

1. Who is responsible for your data

The data controller for personal data collected through the Site is:

MYRA SUPPLIER LTD
Email: [email protected]

2. Data we collect

a) Data you give us directly. When you use the contact form we collect your full name, email address, phone number, company name (optional) and the content of your message. Providing this data is voluntary; without it we simply cannot respond to your inquiry.

b) Data collected automatically. When you visit the Site, our infrastructure automatically processes limited technical data: IP address, approximate country derived from the IP address, browser type and operating system, requested pages, timestamps, referring URL, and basic usage events (pages viewed, clicks on site elements, session duration) collected through our own first-party measurement. This data is processed for security, abuse prevention, service reliability and understanding how the Site is used.

c) Data stored in your browser. Your language preference (TR/EN) is stored locally in your browser (localStorage) and is never transmitted to our servers. See our Cookie Policy for details.

d) Data we do NOT collect. We do not collect payment information, government identifiers, or special categories of personal data through this Site, and we do not use advertising or cross-site tracking technologies.

3. Purposes and legal bases
  • Responding to your inquiry — name, contact details and message content; legal basis: our legitimate interest in responding to messages you send us, and steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b) and (f)).
  • Security and abuse prevention — IP address, technical metadata, rate limiting and bot detection; legal basis: our legitimate interest in keeping the Site secure (GDPR Art. 6(1)(f)).
  • Compliance with legal obligations — where retention or disclosure is required by applicable law (GDPR Art. 6(1)(c)).

We do not use your personal data for automated decision-making or profiling, and we do not send marketing communications.

4. Who we share data with

We do not sell, rent or trade your personal data. We share data only with service providers that help us operate the Site, strictly for the purposes described above:

  • Cloudflare, Inc. — content delivery network, DDoS protection, DNS and email routing. Cloudflare processes visitor traffic (including IP addresses) as a processor to deliver and secure the Site.
  • Hosting providers — our servers are hosted in professional data centers within Europe.
  • Internal communication tools — contact form submissions are relayed to our operations team over secure internal channels.

We may also disclose personal data where required by law, court order or competent authority, or to establish, exercise or defend legal claims.

5. International transfers

Some of our service providers may process data outside your country of residence. Where personal data is transferred outside the EEA or the UK, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

6. How long we keep your data
  • Contact form messages: kept for as long as needed to handle your inquiry and any follow-up, and no longer than 24 months after the last interaction.
  • Security and access logs: kept for up to 12 months, then deleted or anonymized.
  • Language preference: stored only in your own browser until you clear it.
7. How we protect your data

We apply technical and organizational measures appropriate to the risk, including:

  • Encryption: all traffic is encrypted in transit (TLS); customer delivery data processed by the Heliosync platform is protected with encryption at rest; backups are encrypted before leaving our infrastructure.
  • Access control: least-privilege, role-based access — staff can access only the data required for their task (for example, warehouse staff see only shipments assigned to them), enforced per user and per store.
  • Account security: strong password requirements, brute-force protection and rate limiting on staff accounts, and prompt removal of access when staff leave.
  • Auditability: access to protected customer data is logged (who accessed which record, when and from where) and administrative actions are fully recorded.
  • Environment separation: production data is kept strictly separate from test and development environments; test environments use fictitious data only.
  • Data loss prevention: databases are not publicly reachable, credentials follow least privilege and are rotated, secrets are stored outside source code, and exports are restricted and monitored.
  • Incident response: we maintain a documented security incident response policy (detection, containment, investigation, remediation, notification and post-incident review). Affected merchants are notified of personal data breaches without undue delay.

No method of transmission or storage is 100% secure, but we continuously review and improve our safeguards.

8. Your rights

Depending on your jurisdiction (including the GDPR, UK GDPR and the Turkish Personal Data Protection Law No. 6698 "KVKK"), you have the right to:

  • request access to the personal data we hold about you;
  • request correction of inaccurate or incomplete data;
  • request deletion of your data ("right to be forgotten");
  • request restriction of processing or object to processing based on legitimate interests;
  • receive your data in a portable format;
  • lodge a complaint with your local supervisory authority.

To exercise any of these rights, email us at [email protected]. We respond to verified requests within 30 days.

9. Children's privacy

The Site is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it promptly.

10. Third-party links

The Site may contain links to external websites we do not operate. We are not responsible for the privacy practices of those sites and encourage you to review their policies.

11. Changes to this policy

We may update this Privacy Policy from time to time. The current version, with its effective date, is always published on this page. Material changes will be highlighted on the Site.

12. Marketplace, merchant and customer order data (Heliosync platform)

Beyond this website, the Heliosync platform provides order management and fulfillment (3PL) services to merchants selling on e-commerce platforms and marketplaces such as Shopify, Amazon, WooCommerce, BigCommerce, Etsy and eBay. When a merchant connects a store or installs a Heliosync application, we process the following data on the merchant's behalf, strictly to provide the fulfillment services they request:

  • Store data: store identifier/domain, connection status and configuration.
  • Order data: order ID and number, order date, product titles, variants, SKUs, quantities, fulfillment and shipping status, tracking numbers and carriers.
  • Customer delivery data: recipient name, shipping address (street, city, state/province, postal code, country), phone number and email address (only where required for shipping label generation or carrier delivery notifications).

Why each field is needed:

  • Name — identifying the shipment recipient and generating accurate shipping labels.
  • Shipping address — delivering the order to the destination selected by the customer.
  • Phone number — carrier delivery coordination and last-mile delivery where required.
  • Order lines / SKU / quantity — warehouse picking, packing and order preparation.
  • Tracking information — shipment monitoring and reporting fulfillment status back to the merchant's store.

We request and process the minimum data necessary for fulfillment; the customer's email address is processed solely where shipping label generation or carrier delivery notifications require it, and is used for nothing else. Heliosync processes this data solely to provide order management, warehousing, picking, packing, shipping, delivery coordination, tracking and fulfillment services requested by the merchant. Customer data obtained through connected platforms is never sold, rented, used for advertising, behavioral profiling or unrelated marketing.

Retention: customer delivery data is retained while the related shipment is active and is deleted or anonymized no later than 90 days after fulfillment is completed, unless a longer period is required by law. Disconnection: when a merchant uninstalls a Heliosync application or disconnects a store, access to new data ends immediately and stored merchant and customer data is deleted or anonymized according to this schedule. We honor platform privacy requests (such as data access and erasure requests relayed by Shopify) within 30 days.

13. Contact

For any privacy-related question or request:
MYRA SUPPLIER LTD — [email protected]