Personal Data Policy

General Information on the Personal Data Protection Law:

The Personal Data Protection Law No. 6698 (hereinafter referred to as “KVKK”) was adopted on March 24, 2016, and published in the Official Gazette No. 29677 on April 7, 2016. Some provisions of the KVKK came into effect on the date of publication, while the remainder became effective on October 7, 2016.

Information as Data Controller

As the Data Controller under Law No. 6698 KVKK, your personal data will be processed as described on this page; it may be recorded, stored, updated, classified, disclosed or transferred to third parties where permitted by law, and handled in the manner specified by the KVKK.

How Your Personal Data May Be Processed

Under Law No. 6698 KVKK, any personal data you share with our company may be processed by us—fully or partially—either automatically or manually as part of any data recording system. This includes collecting, recording, storing, modifying, reorganizing, or otherwise performing any operation on the data. Under the KVKK, any such operation carried out on personal data is considered “processing of personal data.”

Purposes and Legal Grounds for Processing Your Personal Data:

The personal data you share,

To fulfill the requirements of the services we provide to our customers in accordance with contractual and technological obligations, and to improve the products and services we offer;
To record identity, address, and other necessary information in order to verify the identity of the data subject, in accordance with Law No. 6563 on the Regulation of Electronic Commerce, Law No. 6502 on the Protection of Consumers, the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette No. 29457 on August 26, 2015, the Distance Contracts Regulation published in the Official Gazette No. 29188 on November 27, 2014, and other relevant legislation;
To organize all records and documents that will serve as a basis for transactions, whether in payment systems, electronic contracts, or on paper, as required in the banking and electronic payment fields; and to comply with information retention, reporting, and notification obligations mandated by legislation and other authorities;
To provide information to prosecutors, courts, and relevant public officials, upon request and as required by law, in matters related to public security and legal disputes;

Your personal data will be processed in accordance with Law No. 6698 KVKK and related secondary regulations.

Information About Third Parties or Organizations to Which Your Personal Data May Be Transferred

For the purposes stated above, the individuals or organizations to which your personal data shared with our company may be transferred include, but are not limited to: IdeaSoft Yazılım San. ve Tic. A.Ş., which provides our e-commerce infrastructure, suppliers, cargo companies, and other service providers related to the services offered; program partner organizations we cooperate with and/or service providers acting as Data Processors; domestic and international organizations; and other third parties.

How your personal data is collected:

Your personal data,

Through the forms on our website and mobile applications, our company collects information such as your name, surname, Turkish ID number, address, phone number, business or personal email address; as well as data from pages accessed using a username and password, including preferences, IP records of transactions, cookie data collected by the browser, browsing duration and details, and location data;

Through our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call center channels, we may collect data verbally, in writing, or electronically;

Personal data obtained from individuals who share their information—via business cards, resumes (CVs), proposals, or other means—for purposes such as establishing a commercial relationship with our company, applying for a job, or submitting a proposal; collected in physical or digital form, either face-to-face or remotely, verbally, in writing, or electronically;

In addition, data obtained indirectly from various channels—such as websites, blogs, contests, surveys, games, campaigns, and similar (micro) websites, as well as social media; e-newsletter reading or click activity; publicly available databases; and publicly shared profiles and data on social media platforms—may be collected and processed.

Your Personal Data Obtained Before the Entry into Force of the KVKK:

Personal data lawfully obtained before April 7, 2016—the effective date of the KVKK—through membership, consent for electronic communication, product/service purchases, or other means is also processed and stored in accordance with the terms and conditions outlined in this document.

Transfer of Your Personal Data Abroad:

Your personal data, collected by any of the methods mentioned above, may be processed in Turkey or transferred abroad for storage, provided that it remains within the scope of the KVKK and is used in accordance with the purposes of the contract. Such data may also be transferred to service providers located abroad (to countries accredited by the Personal Data Protection Board and where adequate protection for personal data is ensured).

Storage and Protection of Personal Data:

Your personal data will be stored confidentially in our company’s databases and systems in accordance with Article 12 of the KVKK and will not be shared with any third parties except as required by law or as specified in this document. Our company is responsible for ensuring that the systems and databases containing your personal data prevent unlawful processing, block unauthorized access, and implement software measures such as access management, as well as physical security measures, in accordance with Article 12 of the KVKK. If it is discovered that personal data has been obtained unlawfully by others, the situation will be immediately reported in writing to the Personal Data Protection Board in compliance with the legal regulations.

Keeping Personal Data Current and Accurate:

In accordance with Article 4 of the KVKK, our company is obliged to keep your personal data accurate and up to date. To fulfill its obligations under the applicable legislation, our company requires that customers provide accurate and current information or update their data through the website or mobile application.

Rights of the Personal Data Owner Under Law No. 6698 KVKK:

Article 11 of Law No. 6698 KVKK came into effect on October 7, 2016. In accordance with this article, the rights of the Personal Data Owner after this date are as follows: The Personal Data Owner may apply to our company (as the data controller) regarding their personal data;

To find out whether personal data has been processed,
To request information if personal data has been processed,
To learn the purpose of processing personal data and whether it is being used in accordance with that purpose,
To know the third parties to whom personal data has been transferred, either domestically or abroad,
To request the correction of personal data if it is incomplete or inaccurate,
To request the deletion or destruction of personal data in accordance with the conditions set out in Article 7 of the KVKK,
To request that any correction, deletion, or destruction of personal data be communicated to third parties to whom the data has been transferred,
To object to outcomes that may arise against oneself through the exclusive analysis of processed data by automated systems,
To request compensation for damages in case of loss or harm resulting from the unlawful processing of personal data,

are entitled to these rights. …KOZMETİK, registered with the Istanbul Chamber of Commerce under [..........................] registration number and holding MERSİS number ………………., located at ……………………, is the Data Controller under the KVKK. Once legally established, the Data Controller Representative appointed by our company will be announced in the Data Controllers Registry and on the website where this document is published.

Personal Data Owners may direct their questions, opinions, or requests through any of the following contact channels:

Email: info@pyxcosmetics.com

Telephone: [.........................]

Fax: [.............................]