This is an English translation of the original Turkish text. In case of any discrepancy, the Turkish version shall prevail.
This privacy notice has been prepared for customers by Alpaya Doğal ve Kozmetik Ürünleri Sanayi ve Ticaret Anonim Şirketi (the “Company”) in its capacity as data controller, under Article 10 of the Turkish Personal Data Protection Law No. 6698 (the “Law” or “KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.
Through this privacy notice, we aim to properly manage compliance with KVKK and all other legislation on personal data with respect to all of our customers in connection with our services and sales. With this responsibility in mind, and in our capacity as data controller under the Law and related legislation, we process your personal data lawfully on the legal grounds and for the purposes set out below.
The Company reserves the right to update this notice at any time in line with changes in the legislation in force. You can follow any updates by visiting our website from time to time.
This notice aims to inform data subjects about the purposes for which personal data obtained in accordance with the Law is collected and processed; how it is protected, stored, used, transferred, deleted and anonymised in line with the Law; and the rights of data subjects in these matters, thereby fulfilling our obligation to inform.
Accordingly, the purposes for which the Company processes personal data, to whom and for what purposes the processed data may be transferred, our method and legal grounds for collecting personal data, and the rights of data subjects are explained in detail below.
In all of its personal data processing activities, the Company acts in compliance with all obligations required by KVKK and related legislation, and takes the necessary security measures to host your personal data securely and prevent its unlawful use.
Within the scope of the purchasing process, we lawfully process the personal data listed clearly in the table below, for the purposes stated:
| Personal data | Description | Purposes of processing | Legal grounds |
|---|---|---|---|
| Identity data | Name and surname. | Carrying out order and delivery processes; registering memberships so you can use our services; fulfilling obligations under distance sales contracts; communicating with customers and managing customer relationships; customer surveys and satisfaction communications; audit, data analysis, statistics, research and use in sales, marketing and advertising; informing you about site and mobile app updates; marketing analysis; showing advertising and marketing/communication activities of the Company, suppliers, advertisers and other third parties on the site or other third-party media (notifications, pop-ups, personalised offers, customised screens, advertising, etc.); registering your loyalty card membership and letting you benefit from its advantages; finance and accounting for payments; ensuring the legal, technical and commercial security of the Company and its business partners; fulfilling contractual and legal obligations and exercising our legal rights; recording and confirming the identity, address, contact and other necessary information of purchasers via the website and/or mobile apps and preparing all records and documents in electronic or paper form; ensuring transaction and information security and preventing fraudulent or illegal activities; informing public officials on public security matters upon request and as required by law; following up and resolving requests and complaints; planning and executing the Company’s commercial and business strategies; providing consultation services to customers and suppliers; improving the shopping experience; using as evidence in possible disputes; carrying out our activities in accordance with legislation; reviewing and auditing our business activities. | KVKK Article 5: expressly provided for by law; necessary for the conclusion or performance of a contract with the data subject; necessary for the Company to fulfil its legal obligations; necessary for the establishment, exercise or protection of a right; necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed. |
| Contact data | Mobile phone number, email and full address. | Carrying out order and delivery processes; membership registration; fulfilling obligations under distance sales contracts; communicating with customers and managing customer relationships; customer surveys and satisfaction communications; audit, data analysis, statistics, research, sales, marketing and advertising; informing you about site and mobile app updates; marketing analysis; using as evidence in possible disputes; carrying out and auditing our activities in accordance with legislation; ensuring transaction and information security; informing public officials upon request; following up and resolving requests and complaints; managing loyalty card membership; planning and executing commercial strategies; providing consultation services; improving the shopping experience; ensuring the legal, technical and commercial security of the Company and its business partners; fulfilling contractual and legal obligations; recording and confirming purchasers’ information and preparing related records and documents. | |
| Financial data | Information about payments and payment methods. | Carrying out order and payment processes; finance and accounting for payments; fulfilling obligations under distance sales contracts; ensuring the legal, technical and commercial security of the Company and its business partners; fulfilling contractual and legal obligations and exercising our legal rights; recording and confirming purchasers’ information and preparing related records and documents; ensuring transaction and information security; informing public officials upon request; using as evidence in possible disputes. | |
| Customer transaction data | Call centre records, promissory notes, invoices, cheques, cash desk account information, order information, request and complaint management information. | Carrying out order and payment processes; finance and accounting for payments; fulfilling obligations under distance sales contracts; ensuring the legal, technical and commercial security of the Company and its business partners; fulfilling contractual and legal obligations; recording and confirming purchasers’ information and preparing related records and documents; ensuring transaction and information security; informing public officials upon request; using as evidence in possible disputes. | |
| Marketing data | Shopping history of website and mobile app users, surveys, cookies and campaign participation information. | Improving the services offered by increasing the functionality and performance of the website; carrying out marketing analysis; improving the website, offering new features and personalising features according to your preferences; ensuring the legal and commercial security of the website, its visitors and our Company; understanding how you use the website/mobile app, including where you connect from, what content you view and how long you stay; carrying out analytics on the site and following visitor usage habits. | Explicit consent of the data subject. |
| Transaction security data | IP address, website log-in and log-out information, password information. | Carrying out information security processes; ensuring transaction and information security and preventing fraudulent or illegal activities; informing public officials upon request; improving the shopping experience; understanding how you use the website/mobile app. | KVKK Article 5: expressly provided for by law and the other grounds listed above. |
| Physical location security data | Camera recordings of customers using the physical premises of our branches and head office. | Ensuring the physical security of our head office and branches; using as evidence in possible disputes; informing public officials on public security matters upon request; ensuring the legal, technical and commercial security of the Company and its business partners. | KVKK Article 5: necessary to fulfil a legal obligation; legitimate interest of the data controller. |
It is your responsibility to ensure and check that all information, content, materials or data you provide to us are accurate, complete, correct and not misleading.
Your personal data is collected for the reasons stated above through the following channels:
Only your customer transaction data containing your requests and complaints may be transferred abroad, within the scope of consultation and support line services provided through service providers whose servers are located abroad, such as WhatsApp.
| Recipients | Purpose of transfer | Legal grounds |
|---|---|---|
| Our business partners, suppliers, contracted cargo/courier companies, banks for virtual POS payments, GSM operators | Carrying out payment and delivery processes; fulfilling obligations under distance sales contracts; ensuring the legal, technical and commercial security of the Company and its business partners; providing consultation services to customers and suppliers. | KVKK Articles 5 and 8: expressly provided for by law; necessary for the conclusion or performance of a contract; necessary for the Company to fulfil its legal obligations; necessary for the establishment, exercise or protection of a right. |
| Legally authorised public institutions and organisations, and legally authorised private persons and legal entities | Ensuring the legal, technical and commercial security of the Company and its business partners; fulfilling contractual and legal obligations and exercising our legal rights; informing public officials on public security matters upon request; using as evidence in possible disputes. | |
| Social media sites and channels, Company affiliates, service providers and/or subcontractors, customer communication and satisfaction programme partners | Ensuring that our business units carry out the work needed for the Company’s commercial activities and related business processes; planning and executing the Company’s commercial and business strategies; providing consultation services to customers and suppliers; improving the shopping experience; following up and resolving requests and complaints. |
The Company strives to maintain appropriate physical, technical and administrative security at its workplaces and in its information systems, in order to prevent personal data from being lost, misused, accessed without authorisation, disclosed or altered. We protect our website and other systems by taking the necessary technical and organisational measures against loss, destruction, unauthorised access, and alteration or disclosure of your personal data by unauthorised persons.
Where our website links to other applications, the Company accepts no responsibility for the privacy policies or content of those applications.
Your identity, contact, customer transaction and financial data are kept for 10 years. Marketing data is kept for 2 years. Records taken to ensure physical location security are kept for 3 months from the date of your last entry.
You can access the Company’s Personal Data Retention and Destruction Policy via www.acnevit.com and the “Alpaya” mobile application for detailed information on processing periods and the deletion, destruction and anonymisation process.
Under Article 11 of KVKK, you have the right to apply to our Company to:
You can submit your requests regarding these rights, together with information and documents identifying you, online via our website www.acnevit.com and our “Alpaya” mobile application, or prepare your request in line with the conditions set by the Personal Data Protection Authority and send it to the Company using the methods below:
Please check the current application methods and content requirements in the legislation beforehand. Applications that do not meet the content requirements set by the Personal Data Protection Authority, or that are sent by methods not accepted by the Authority, will not be accepted. The Company will conclude your request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on its nature. If fulfilling your request incurs a cost, we may only charge the fees set out in the tariff determined by the Personal Data Protection Board.
