Privacy and Cookie Policy

1. Data Controller and Scope

Lumera Deri Kozmetik Sanayi Ticaret Limited Şirketi ("Deriza") acts as the data controller within the meaning of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK").

This Privacy and Cookie Policy provides general information on the processing of personal data of visitors, members and customers of www.deriza.com and on the use of cookies and similar technologies.

Where required, separate privacy notices may be presented at specific processing points such as membership registration, checkout, customer contact or commercial electronic communication consent.

2. Categories of Personal Data

Identity Data: Name, surname and other identity information where required by law or the relevant transaction.
Contact Data: Telephone number, email address, delivery and billing addresses.
Customer Transaction Data: Orders, products, invoices, deliveries, returns, exchanges, requests, complaints and customer service records.
Transaction Security Data: IP address, login and session records, device, browser and security logs.
Financial Transaction Data: Payment method and payment/refund transaction records. Card data may be processed directly within the systems of payment service providers and banks.
Marketing Data: Where permitted, shopping preferences, campaign preferences, analytics, advertising and targeting data.
Cookie and Online Usage Data: Cookie identifiers, session information and permitted website usage data.

3. Methods of Data Collection

Personal data may be collected through the website, registration and checkout forms, payment transactions, customer service, email, telephone, contact and return/exchange requests, cookies and similar electronic channels by fully or partly automated means and, where applicable, by non-automated means forming part of a data filing system.

4. Purposes and Legal Grounds for Processing

Formation or Performance of a Contract

Personal data may be processed where necessary to receive and process orders, prepare or personalize products, process payment, arrange delivery, provide customer service and manage exchanges or returns.

Compliance with Legal Obligations

Personal data may be processed for invoicing, accounting, consumer transactions, responses to competent authorities and other statutory record-keeping obligations.

Establishment, Exercise or Protection of a Legal Right

Data may be processed where necessary to handle requests and complaints, manage disputes, retain transaction records and protect the legal rights of customers or Deriza.

Legitimate Interests

Provided that fundamental rights and freedoms are not adversely affected, necessary data may be processed for information and system security, fraud prevention, operational improvement and service quality measurement.

Processing Based on Explicit Consent

Where no other legal processing condition applies, activities such as personalized advertising, targeting, remarketing and non-essential cookies may be carried out on the basis of explicit consent. Refusal to give such consent does not prevent access to core shopping services that do not require consent.

5. Disclosure and Transfer of Personal Data

Personal data may be disclosed, on a limited and proportionate basis and in accordance with Articles 8 and 9 of the KVKK, to:

Shipping, logistics and delivery providers,
Payment institutions, banks and financial service providers,
IT, hosting, security and technical service providers,
Accounting, legal, audit and professional advisers,
Competent public authorities and judicial bodies where legally required.

International Transfers

Depending on the technology, cloud, analytics, security or other services used, certain personal data may be transferred outside Türkiye.

International transfers are carried out under an applicable mechanism provided by Article 9 of the KVKK, including an adequacy decision, appropriate safeguards such as standard contractual clauses, or other transfer mechanisms permitted by applicable legislation. Explicit consent may be relied upon where required and legally appropriate.

6. Cookie Policy

Deriza may use cookies and similar technologies to ensure the secure and proper functioning of the website, manage user preferences and, to the extent permitted by the user, measure website performance and conduct marketing activities.

You Control Your Cookie Preferences

Cookies requiring consent should not be enabled by default. Users can accept, reject or subsequently change their choices through the cookie preference panel.

The current cookie preference panel may display the name, provider, purpose, category and retention period of cookies in use. This information should be updated whenever third-party technologies are changed.

7. Commercial Electronic Communications

Promotional SMS and email communications are sent where the approvals required under applicable Turkish commercial electronic communication legislation have been obtained. Commercial communication consent is managed separately from privacy notices and, where required, explicit consent under data protection law.

8. Retention and Security of Personal Data

Personal data is retained for the period necessary for the relevant processing purpose and for mandatory statutory retention periods. When the processing purpose and any other legal basis for retention cease to exist, the data is deleted, destroyed or anonymized in accordance with applicable legislation.

Deriza implements administrative and technical measures appropriate to the nature and risk of the processed data in order to prevent unlawful processing or unauthorized access and to ensure secure storage.

9. Your Rights Under the KVKK

Subject to the conditions of Article 11 of the KVKK, you may have the right to:

Learn whether your personal data is processed,
Request information if it has been processed,
Learn the purpose of processing and whether it is used accordingly,
Learn the third parties to whom data is transferred in Türkiye or abroad,
Request correction of incomplete or inaccurate data,
Request deletion or destruction where the statutory conditions are met,
Request notification of correction, deletion or destruction to recipients where applicable,
Object to a result arising against you exclusively through automated analysis,
Claim compensation where you suffer damage due to unlawful processing.

10. How to Submit a Request

Requests concerning rights under the KVKK may be submitted to Deriza using one of the methods permitted by the applicable Turkish legislation.

In writing to Atıfbey Mahallesi 67. Sokak No:33 D:16 Gaziemir / İzmir, Türkiye,
Via registered electronic mail (KEP), secure electronic signature or mobile signature,
From an email address previously registered in Deriza's systems and associated with your identity to destek@deriza.com,
Through other methods permitted by the Turkish Personal Data Protection Board.

Requests are answered as soon as possible and no later than 30 days, depending on their nature. Where processing of the request causes an additional cost, the tariff determined by the Turkish Personal Data Protection Board may apply.

11. Updates to This Policy

This Policy may be updated due to changes in technologies, processing activities or applicable legislation. The current version is published on the Deriza website.