KVKK Privacy Notice

Data Controller

In accordance with the Personal Data Protection Law No. 6698 ("KVKK"), your personal data may be processed by Norm Kozmetik Pazarlama Sanayi ve Ticaret Limited Şirketi ("Company") as the data controller within the scope explained below.

Purpose of Processing Personal Data

Your collected personal data is processed within the scope of personal data processing conditions specified in Articles 5 and 6 of KVKK for the purposes of providing products and services, managing customer relations, fulfilling legal obligations, conducting marketing activities, and ensuring communication activities.

Transfer of Personal Data

Your collected personal data may be transferred to our business partners, suppliers, shareholders, legally authorized public institutions, and private individuals in accordance with the personal data processing conditions specified in Articles 8 and 9 of KVKK, in line with the purposes stated above.

Personal Data Collection Method and Legal Basis

Your personal data is collected electronically through our website. Your collected personal data is processed based on the legal grounds of "existence of explicit consent" and "data being made public by the data subject" specified in Article 5 of KVKK.

Use of Artificial Intelligence in Support Requests

Messages you send to our support channels are processed with the help of artificial intelligence so that we can answer you faster and more accurately. Your message is classified by subject, used to prepare a draft reply for our representative, and translated if it is written in another language.

Your reply is always sent by a human representative. Artificial intelligence only suggests a draft to our representative; no draft is sent to you without being reviewed and approved. For this reason, no decision producing a legal effect or similarly significant adverse effect is taken about you solely by automated means.

For this processing, the text of your message is transferred to servers of our service provider Google located in the European Union. The transfer is made with the least data possible: your name, username, e-mail address and telephone number are not sent as separate information; only the text of the last few messages of the conversation is transmitted. Google processes this data solely on our instructions and does not use it to train its own artificial intelligence models; limited logging (about 30 days) may be kept for abuse monitoring.

Please do not share information about your health in support messages unless it is necessary to resolve your request.

For the purpose of handling your support requests, the content of your messages is transferred to Google Cloud EMEA Limited (Ireland). This transfer abroad relies on the standard contract published by the Personal Data Protection Board, one of the appropriate safeguards listed in Article 9(4) of the Law; the standard contract has been signed with Google Cloud EMEA Limited and notified to the Personal Data Protection Authority. You may request a copy of the standard contract free of charge from the application address given in this notice.

Depending on the channel your support request arrives through, your messages also reside on that platform's own infrastructure: Instagram and Facebook messages are processed by Meta Platforms, e-mails by our e-mail service provider, and Trendyol questions and answers by Trendyol.

Support correspondence is retained for as long as needed to resolve your request and for the statute of limitations applicable to possible disputes. Message texts transferred to the artificial intelligence service provider may be kept only for a limited period (about 30 days) for abuse monitoring; they are not otherwise retained by that provider.

Rights of the Data Subject

You have the following rights under Article 11 of KVKK:

• To learn whether your personal data is being processed
• To request information if your personal data has been processed
• To learn the purpose of processing your personal data and whether it is used in accordance with its purpose
• To know the third parties to whom your personal data is transferred domestically or abroad
• To request correction of your personal data if it has been processed incompletely or incorrectly
• To request deletion or destruction of your personal data within the framework of conditions stipulated in Article 7 of KVKK
• To request notification of the correction, deletion or destruction of your personal data to the third parties to whom the data has been transferred
• To object to a result occurring against you through analysis of your processed data exclusively by automated systems
• To claim compensation for damages arising from unlawful processing of your personal data

Contact

To exercise the above rights, you can send an email to [email protected].