KVKK ~

 

HARMONI COSMETICS INDUSTRY AND TRADE INC.

CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA

This Clarification Text has been prepared by HARMONI COSMETICS INDUSTRY AND TRADE INC. (“Company”) to inform the Company’s customers regarding the processing of their personal data by the Company within the scope of the Personal Data Protection Law No. 6698 (“Law”).

a) Methods of Obtaining Personal Data and Legal Grounds

Your personal data is collected in electronic or physical environments. The personal data collected for the legal reasons specified in this Clarification Text can be processed and shared within the scope of the personal data processing conditions set forth in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data

Your personal data is processed within the scope of the personal data processing conditions set forth in Articles 5 and 6 of the Law, for the purposes of planning and executing the activities necessary for customizing and promoting the products and services offered by the Company according to the tastes, usage habits, and needs of the relevant persons; ensuring that the relevant persons benefit from the products and services offered by the Company by carrying out the necessary work by business units and executing the relevant business processes; conducting the commercial activities carried out by the Company by performing the necessary work by the business units and executing the related business processes; planning and executing the Company’s commercial and/or business strategies; and ensuring the legal, technical, and commercial-business security of the Company and the relevant persons with whom the Company has a business relationship.

c) Parties to Which Personal Data Can Be Transferred and Purposes of Transfer

Your personal data may be shared within the scope of the personal data processing conditions and purposes set forth in Articles 8 and 9 of the Law with the Company’s business partners and suppliers, legally authorized institutions and organizations, and legally authorized private law legal entities for the purposes of planning and executing the activities necessary for customizing and promoting the products and services offered by the Company according to the tastes, usage habits, and needs of the relevant persons; ensuring that the relevant persons benefit from the products and services offered by the Company; conducting the commercial activities carried out by the Company and executing the related business processes; planning and executing the Company’s commercial and/or business strategies; and ensuring the legal, technical, and commercial-business security of the Company and the relevant persons with whom the Company has a business relationship.

d) Rights of Data Subjects and Exercise of These Rights

In case you submit your requests regarding your rights listed below to the Company by the methods specified under the heading “Exercise of Rights by Data Subjects,” your requests will be evaluated and concluded by our Company as soon as possible and in any case within 30 (thirty) days.

According to Article 11 of the Law, as a personal data subject, you have the following rights:

  • To learn whether your personal data is processed,
  • To request information if your personal data has been processed,
  • To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
  • To know the third parties to whom your personal data is transferred, domestically or abroad,
  • To request the correction of your personal data if it is incomplete or incorrectly processed and to request that the correction be notified to third parties to whom personal data has been transferred,
  • To request the deletion or destruction of your personal data in the event that the reasons requiring its processing cease to exist, although it has been processed in accordance with the Law and other relevant laws, and to request that the action taken be notified to third parties to whom personal data has been transferred,
  • To object to a result against yourself that arises from the analysis of the processed data exclusively through automated systems,
  • To request compensation for damages in case you suffer damage due to unlawful processing of your personal data.

According to paragraph 2 of Article 28 of the Law, data subjects do not have the right to request in the following cases:

  • When personal data processing is necessary to prevent crime or for criminal investigation,
  • When personal data is processed by the relevant person themselves, having been made public,
  • When personal data processing is necessary for the performance of supervision or regulatory duties and disciplinary investigation or prosecution by public institutions and organizations and professional organizations in the nature of public institutions, based on the authority granted by the law,
  • When personal data processing is necessary to protect the economic and financial interests of the State in relation to budget, tax, and financial matters,

In such cases, the above-mentioned rights cannot be exercised with respect to the data.

According to paragraph 1 of Article 28 of the Law, since the following data will be outside the scope of the Law, requests of data subjects regarding such data will not be processed:

  • Processing of personal data by real persons within the scope of activities related to themselves or their family members living in the same residence, provided that it is not given to third parties and obligations regarding data security are complied with,
  • Processing of personal data for purposes such as research, planning, and statistics by anonymizing them with official statistics,
  • Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy of private life, or personal rights, and does not constitute a crime,
  • Processing of personal data by public institutions and organizations authorized by law to carry out preventive, protective, and intelligence activities for the purpose of ensuring national defense, national security, public security, public order, or economic security,
  • Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial, or execution proceedings.

Exercise of Rights by Data Subjects

Regarding the exercise of your rights listed above, you may submit your request in Turkish and in writing, or by using a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the electronic mail address previously notified to the Company and registered in our system, pursuant to Article 13(1) of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller dated 10.03.2018 and numbered 30356. In applications, only information about the applicant person will be given, and it will not be possible to obtain information about other family members or third parties. The Company may request information from the relevant person in order to determine whether the applicant is the personal data owner, and may ask questions to clarify the issues raised in the application.

In your application, the following must be included:

a) Your name, surname, and signature if the application is in writing,

b) For Turkish citizens, your T.R. ID number; for foreigners, your nationality, passport number or, if available, identity number,

c) Your residence or workplace address for notification,

d) If available, your electronic mail address, telephone and fax number for notification,

e) Your request,

must be included, and if any, information and documents related to the subject must be attached to the application.