Orven Trust
Privacy and Security
We treat privacy as part of the design: we collect only what is needed, state plainly what we do, and leave control with you. This page explains how we protect your data; the formal notice is in our KVKK Privacy Notice.
- Encrypted communication over HTTPS site-wide
- We do not store your payment card details
- Analytics cookies only with your permission
Foundation of Security
Security
- Limiting infrastructure and system access
- Role-based access rights and authentication
- Access logs kept and monitored
Privacy
- Only necessary data, processed for a stated purpose
- Clear statements of what is processed and why
- Rights under KVKK Art. 11 and a working request channel
control
- Manage your contact preferences and withdraw consent
- Access, correct and erase your data
- Complaint routes and how to petition the Board, stated clearly
Security Applications
Data minimization
Our forms ask only for the fields the task requires. When the purpose ends, data is erased, destroyed or anonymised.
Encryption and secure transmission
All traffic is carried over HTTPS. Session cookies are hardened with HttpOnly and SameSite policies.
Access authorizations
System access is restricted by role-based authorisation and reviewed periodically.
Recording (log) and monitoring
Access and transaction logs are kept, security events are monitored and acted on when needed.
Supplier security
Contractual and technical security requirements apply to service providers such as hosting, shipping and payment.
Backup and continuity
Data backup and business continuity procedures are defined and tested periodically.
Payment security
We do not store your card details. Payment transactions are handled through the infrastructure of a licensed payment institution.
No tracking without consent
Google Analytics and Microsoft Clarity load only if you allow them. If not, only cookies needed for the session and functionality are used.
Data Lifecycle
Data is managed at collection, use, storage and deletion stages. Details KVKK Information TextIt is located in.
- collection — Through order, service and contact forms
- Usage — In order, delivery, warranty and support processes
- storage — For the period required by law and by the business purpose
- Deletion / anonymization — On your request or when the period expires
Tips to protect your account
strong password
Use a strong, unique password and do not reuse one from other sites. We recommend a password manager.
Account and data control
You can update your account details and request deletion of your account and data at any time.
Session security
Log out when you finish on shared or public devices; do not leave your session open.
Email verification
Keep your account e-mail an address you can access and trust; order and service notifications go there.
Orven will never ask for your password or card details by e-mail or phone. If you receive such a request, do not reply and let us know.
Incident Management
Security incidents are handled through detection, containment, investigation, remediation and notification. Where a personal data breach is involved, the notifications required by law are made.
- detection
- limitation
- Review
- correction
- Information
If you notice a vulnerability or anything suspicious, write to us. Putting “Security” in the subject line gets your report to the right team quickly.
- Security notice: info@orvenenerji.com
- General contact: Contact
- Suggestion / Complaint: Suggestion & complaint
What We Do in the Event of a Data Breach
If personal data is unlawfully obtained, we make the notifications required by law. This is a legal obligation, not a statement of goodwill.
Notification to the Board
The Personal Data Protection Board is notified within 72 hours at the latest from the moment we become aware of the breach.
Notification to you
Once the individuals affected by the breach are identified, they are informed directly within the shortest reasonable time.
Content of the notification
When and how the breach occurred, the categories of data and number of people affected, and the measures taken are reported.
Afterwards
The root cause is addressed, the measures taken are recorded, and corrections are applied to prevent similar incidents.
Reporting a Security Vulnerability
If you find a security vulnerability, please report it to us. We assess reports made in good faith and will not take legal action against the person reporting.
- Send your report to info@orvenenerji.com with “Security” in the subject line.
- Briefly describe the steps needed to reproduce the issue and its impact.
- Give us reasonable time to fix it before sharing it with third parties.
- Do not access or download real user data, and do not run tests that would disrupt the service.
Frequently Asked Questions
- What data do you collect?
- Identity, contact, order and service data, plus the technical records needed for transaction security. The full list of categories is in the KVKK Information Textin.
- Where is my data stored?
- Data is held on secure infrastructure for the periods required by law and by the business purpose. For services whose servers are abroad, the transfer conditions in KVKK Art. 9 apply; details are in the KVKK notice.
- Will my data be shared with third parties?
- Only with the providers needed to deliver the service (shipping, payment, hosting) and where the law requires it. Your data is never sold or rented to third parties for marketing.
- What information is required when I open a claim?
- Depending on the request: identity, contact details and the content of the request. Forms ask only for the necessary fields; for KVKK requests we must be able to verify your identity.
- Can I have my data deleted?
- Yes. You may request erasure or destruction under KVKK Art. 11; your request is concluded within 30 days at the latest. The request channel is on the KVKK located on the page.
- Do you use cookies?
- We always use the cookies needed for functions such as the session, security and the basket. If you allow it, we measure how you use the site with Google Analytics and Microsoft Clarity, keep your Orva conversations for up to 90 days and load Google Maps. We do not use cookies for advertising or profiling. Microsoft, however, may use Clarity data for its own purposes, including advertising.
