CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA

ARTICLE 1 – DATA CONTROLLER

As BİLGE İLAÇ BİTKİSEL KOZ. SAN. VE TİC. A.Ş. (Akçaburgaz, 3034th Street No:23, 34522 Esenyurt/İstanbul), acting in the capacity of "Data Controller", we show the utmost sensitivity to the security of your personal data and to processing such data in accordance with the law. With this awareness, as a company, we attach great importance to the processing and protection of the personal data of our employees, customers who purchase our products, visitors, and other third parties whose data we process, in compliance with the Turkish Personal Data Protection Law No. 6698 ("KVK Law"). The protection of personal data is a constitutional right and is among the priorities of our Company. With the awareness of this responsibility, and acting as a "Data Controller" as defined under the KVK Law, we process your personal data in the manner explained below and within the limits prescribed by the relevant legislation.

ARTICLE 2 – PURPOSE OF DATA PROCESSING

Your personal data are processed for the purposes of:

  • Carrying out goods / services sales processes for our customers,
  • Conducting activities in compliance with legislation,
  • Informing customers about product-related activities for customer satisfaction, Evaluating requests, questions, and demands,

within the scope of carrying out all our activities, and in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698.

ARTICLE 3 – TRANSFER OF PERSONAL DATA

Your personal data may be stored on the infrastructures of overseas-based server and hosting service providers used within the scope of the information technology infrastructure employed by the data controller. In this context, your personal data are transferred abroad based on your explicit consent pursuant to Article 9 of Law No. 6698. The transfer abroad is limited only to the data categories required for the performance of the service, and the necessary technical and administrative security measures are taken during the transfer process.

Your collected personal data may be transferred, for the purposes explained in this Clarification Text and in compliance with the Law and relevant legislation, limited to the reasons requiring such transfer, to: public institutions and organizations, auditors, lawyers, banks and insurance companies from which our Company receives services, organized industrial zones, suppliers, domestic and foreign information technology service providers with whom we cooperate, group companies for the purpose of receiving support services, and shared databases used jointly with them.

ARTICLE 4 – METHOD AND LEGAL BASIS OF PROCESSING PERSONAL DATA

The majority of the personal data we process are obtained from the information you provide to us directly. The personal data processed include the contact/address information, identity information, product preference and interest information, and request and message contents of our visitors and customers.

We categorize such data as Identity Information, Contact Information, Experience, Customer Transaction, and Other Information. Although this may vary depending on the service provided or commercial activity, personal data belonging to the data subjects specified below may be processed by our Company in order to ensure the best provision of services. The aforementioned personal data may be processed, limited to the following purposes: provision of our products and services; continuation of production and commercial activities; execution of strategic planning activities; follow-up of requests and complaints; execution of legal affairs; supply chain management processes; ensuring the security of data controller operations; execution of finance and accounting activities; execution of information security processes; evaluation of suggestions for improving business processes; ensuring business continuity; execution of logistics activities; execution of service procurement processes; execution of after-sales support services; execution of sales processes; execution of production and operational processes; execution of customer relationship management processes; execution of customer satisfaction activities; organization and event management; execution of contract processes; providing information to authorized persons, institutions, and organizations; creation and monitoring of visitor records; execution of investment processes; ensuring physical premises security; fulfillment of requests from public institutions and organizations; execution of communication activities; reporting, analysis, internal control, audit, emergency management, and strategic planning activities; execution and auditing of business activities; execution of occupational health and safety activities; execution of storage and archiving activities; ensuring the security of movable property and resources; insurance claim processes; subcontractor personnel personnel processes; transportation, accommodation, and visa processes; association membership processes; facility personnel personnel file processes; consultancy service procurement processes; free zone authority personnel information sharing processes; and ensuring compliance with relevant legislation and procedures.

In accordance with the fundamental principles stipulated in the Law and based on the legal grounds set out in Article 5 of the Law—namely, being explicitly prescribed by law, fulfillment of the data controller's legal obligations, establishment or performance of a contract, and the legitimate interests of the data controller—personal data may be collected by automatic or non-automatic means through verbal or written information transmitted directly by you or via our website, email address, and applications and software used within the scope of Company activities.

ARTICLE 5 – PROTECTION OF PERSONAL DATA

In order to protect your personal data, we take necessary measures for physical data security and have established policies and procedures to prevent unlawful processing. Personal data security issues are reported promptly. Personal data are minimized wherever possible. In addition to administrative measures taken for personal data, specific protocols and procedures have been established and implemented for the processing of special categories of personal data. We also monitor personal data security. Necessary security measures are taken regarding access to physical environments containing personal data, and such environments are protected against external risks (fire, flood, etc.). Network security and application security are also ensured.

ARTICLE 6 – RETENTION PERIOD OF PERSONAL DATA

Your personal data are retained for as long as necessary to fulfill the purposes stated in this notice (for a period of 10 years from the termination of the contract), unless a shorter or longer retention period is required or permitted under applicable law. Accordingly, statutory limitation periods and legally prescribed durations are primarily taken into account, as well as reasonable periods required for data processing. Upon expiration of such periods, personal data are destroyed by deletion or disposal.

ARTICLE 7 – RIGHTS OF THE DATA SUBJECT

As data subjects whose personal data are processed, if you submit your requests regarding your rights to us, our Company will conclude such requests free of charge as soon as possible and no later than thirty (30) days, depending on the nature of the request. However, if the transaction requires an additional cost, the fee determined by the Personal Data Protection Board may be charged. In this context, you have the right to:

  • Learn whether your personal data are processed,
  • KVKK.Article7List2
  • Learn the purpose of processing and whether data are used in accordance with that purpose,
  • Know the third parties to whom personal data are transferred,
  • Request correction of incomplete or inaccurate personal data and request notification of such correction to third parties,
  • Request deletion or destruction of personal data when the reasons requiring processing no longer exist, even if processed in compliance with the Law, and request notification of such action to third parties,
  • Object to the occurrence of a result against you through analysis of data exclusively by automated systems,
  • KVKK.Article7List8

Pursuant to the "Communiqué on the Procedures and Principles of Application to the Data Controller," you may submit your requests under Article 11 of the Law by:

  • Applying in person with identity verification to Akçaburgaz, 3034th Street No:23, 34522 Esenyurt/İstanbul/TÜRKİYE, or
  • Sending your application to info@bilgeilackozmetik.com.tr.

Our Company will finalize applications in accordance with Article 13 of the Law within a maximum of 30 (thirty) days. In case of rejection, the reason(s) for rejection will be provided in writing or electronically with justification.