KVKK Aydınlatma Metni

This text is a template; have it reviewed by your legal counsel before publishing.

As [ŞİRKET UNVANI] (the "Company"), we attach importance to protecting the personal data of persons who visit, register on and shop at our website at [SİTE ADRESİ] (the "Site"). This Information Notice has been prepared in our capacity as data controller pursuant to Article 10 of Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

1. Data Controller

Trade Name: [COMPANY TRADE NAME]
MERSIS No: [MERSIS NO]
Address: [ADRES]
Telephone: [TELEFON]
E-mail: [E-MAIL]
Registered Electronic Mail (KEP) Address: [KEP ADDRESS]

2. Categories of Personal Data Processed

Data category	Sample data
Identity	First name, last name; Turkish ID number where required for invoicing; date of birth, if you share it
Contact	E-mail address, telephone number, delivery and billing address
Customer transaction	Order history, basket and favourites information, billing information, return and exchange requests, customer service correspondence, loyalty point transactions
Marketing	Commercial electronic message preferences, campaign participation information, shopping habits and interests
Transaction security	IP address, session and login records, encrypted password, device and browser information
Preference information	Skin Analysis test answers, skin type, skin needs and product preferences
User content	Product reviews, ratings and product questions

Preference information such as skin type (e.g. dry, oily, combination) and skin needs (e.g. hydration, mattifying, radiance) is not health data or special category personal data within the meaning of Article 6 of the Law; it is processed as your cosmetic preferences so that we can recommend suitable products to you. Sharing this information is entirely optional, and not sharing it does not prevent you from shopping. We kindly ask you not to share health information such as illnesses, treatments or medication use in the Skin Analysis test, reviews or correspondence.

Your card details, such as card number, expiry date and security code, are not collected or stored by the Company; this information is processed directly by the payment institution.

3. Purposes of Processing Personal Data

Creating the membership record and managing the account,
Receiving orders, collecting payments, delivering products and issuing invoices,
Handling withdrawal, return, exchange and defective goods requests,
Customer service and management of requests and complaints,
Running the loyalty program, calculating points and enabling their use,
Reviewing and publishing product reviews and questions,
Providing personalized product recommendations based on Skin Analysis test answers,
Sending commercial electronic messages about campaigns, discounts and new arrivals and conducting marketing analyses, subject to your consent,
Conducting information security processes and preventing fraud and misuse,
Fulfilment of obligations arising from legislation and responding to information requests from authorised institutions,
Establishing, exercising and protecting rights in legal disputes.

4. Collection Method and Legal Grounds

Your personal data is collected by automated or partially automated means through the membership, order, Skin Analysis test, review and contact forms on the Site, cookies and customer service channels (e-mail, telephone), and is processed on the basis of the following legal grounds set out in the second paragraph of Article 5 of the Law:

(c) Establishment or performance of a contract: Membership, order, payment, delivery, return and loyalty program processes, and the provision of the Skin Analysis recommendations you request,
(ç) Fulfilment of a legal obligation: Invoice and accounting records, obligations under consumer legislation and Law No. 5651, and providing information to authorised institutions,
(e) Establishment, exercise or protection of a right: Dispute, complaint and objection processes,
(f) Legitimate interest: Ensuring information security, preventing misuse and measuring service quality, provided that this does not harm your fundamental rights and freedoms,
Explicit consent: Analytics and marketing cookies and personalized marketing activities. For commercial electronic messages, your consent is additionally obtained pursuant to Law No. 6563.

You may withdraw your explicit consent and your consent to commercial electronic messages at any time; withdrawal does not affect the lawfulness of prior processing.

5. Transfer of Personal Data

Your personal data may be transferred to the following groups of recipients, limited to and proportionate with the purposes stated above:

Contracted cargo companies for the delivery of orders (name, surname, address, telephone),
To the payment institution and banks for collecting payments and processing refunds,
To hosting, cloud, e-mail and SMS delivery, e-invoice and other information technology service providers,
Business partners from whom accounting, legal and auditing services are obtained,
To authorised public institutions and organisations and judicial authorities, upon request and to the extent required by legislation.

Where our service providers' servers are located abroad, your personal data may be transferred abroad in accordance with the conditions set out in Article 9 of the Law (such as an adequacy decision, the provision of appropriate safeguards or, in exceptional cases, explicit consent).

6. Retention Periods

Membership information: for the duration of your membership and, after the membership ends, for the general statute of limitations period for possible disputes,
Order, invoice and accounting records: 10 years pursuant to the Turkish Commercial Code and the Tax Procedure Law,
Records relating to distance contracts: at least 3 years pursuant to the Regulation on Distance Contracts,
Traffic and transaction security records: for the period stipulated in Law No. 5651 and the relevant legislation (1-2 years),
Commercial electronic message consent records: 3 years from the expiry of the consent's validity,
Skin Analysis and preference information: for the duration of your membership or until you request its deletion.

Personal data whose retention period has expired is erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

7. Rights of the Data Subject

Pursuant to Article 11 of the Law, by applying to the data controller, you may:

To learn whether your personal data is being processed,
Request information if your personal data has been processed,
Learn the purpose of processing and whether the data is used in line with that purpose,
To know the third parties to whom your personal data is transferred domestically or abroad,
Request the rectification of such data if it has been processed incompletely or inaccurately,
Request erasure or destruction of the data within the framework of the conditions set out in Article 7 of the Law,
Request that third parties to whom personal data has been transferred be notified of correction, deletion or destruction,
Object to any outcome to your detriment arising from the analysis of the processed data exclusively through automated systems,
Request compensation for damages if you suffer damage due to unlawful processing

you have the right to do so.

8. Method of Application

You may submit your requests, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing with a wet signature to [ADDRESS], with a secure electronic signature or mobile signature to the registered electronic mail (KEP) address [KEP ADDRESS], or from the e-mail address registered on the Site to [E-MAIL]. Your application must include your first name, last name, Turkish ID number (for foreign nationals, nationality and passport or ID number), residential or business address for notification, e-mail address and telephone number for notification, if any, and the subject of your request.

Your application will be concluded free of charge as soon as possible depending on the nature of the request, and within 30 days at the latest. If the process requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board.