Personal Data Protection Notice

1. Identity of the Data Controller

Lumera Deri Kozmetik Sanayi Ticaret Limited Şirketi ("Deriza" or the "Company") acts as the data controller in relation to your personal data under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK").

2. Categories of Personal Data

Personal data may be processed when you visit www.deriza.com, create an account, place an order, contact us or use after-sales services.

3. Purposes of Processing

• Managing membership and customer accounts,
• Receiving and fulfilling orders,
• Preparing and, where requested, personalizing products,
• Managing payments, invoicing and accounting,
• Managing shipping and delivery,
• Managing returns, exchanges and after-sales support,
• Handling customer requests and complaints,
• Maintaining information and transaction security and preventing misuse,
• Complying with legal obligations and competent authority requests,
• Establishing, exercising or protecting legal rights,
• Improving operations and service quality where an appropriate legal ground exists,
• Conducting marketing and advertising activities where the required permissions have been obtained.

4. Methods of Collecting Personal Data

Personal data may be obtained through the website, membership and order forms, payment processes, customer service, email, telephone, contact, return and exchange requests, cookies and similar electronic channels by fully or partly automated means.

Where applicable, personal data may also be obtained by non-automated means provided that the processing forms part of a data filing system.

5. Legal Grounds for Processing

Formation or Performance of a Contract — KVKK Art. 5/2-c

Data required for orders, membership, payment, delivery, personalization, returns, exchanges and customer services may be processed on this legal ground.

Compliance with a Legal Obligation — KVKK Art. 5/2-ç

Data necessary for tax, accounting, e-commerce, consumer transactions and other statutory obligations may be processed.

Establishment, Exercise or Protection of a Right — KVKK Art. 5/2-e

Data may be processed where necessary to manage disputes, retain transaction records, handle requests and protect legal rights.

Legitimate Interest — KVKK Art. 5/2-f

Provided that fundamental rights and freedoms are not adversely affected, necessary data may be processed for system security, fraud prevention and service improvement.

Explicit Consent — KVKK Art. 5/1

Where no other statutory processing condition applies, activities such as targeted advertising, remarketing, certain analytics activities or non-essential cookies may be based on explicit consent.

6. Transfer of Personal Data

Subject to the conditions of Articles 8 and 9 of the KVKK, personal data may be transferred on a limited and proportionate basis to:

• Shipping and logistics providers: for delivery and return shipments,
• Banks and payment service providers: for payment and refund transactions,
• IT, hosting and security providers: for website, infrastructure and security services,
• Accounting, legal, audit and professional advisers: for business and legal obligations,
• Competent public authorities and judicial bodies: where required by law.

7. International Transfers of Personal Data

Depending on the technical structure of cloud, information technology, security, analytics or similar services used by Deriza, certain personal data may be transferred outside Türkiye.

International transfers are carried out under an applicable mechanism provided by Article 9 of the KVKK, including adequacy decisions, appropriate safeguards, standard contractual clauses or other mechanisms permitted by applicable legislation.

Explicit consent may be relied upon where required under the applicable statutory conditions.

8. Commercial Electronic Communications

Promotional SMS and emails are sent where the conditions and approvals required under applicable Turkish commercial electronic communication legislation have been satisfied.

Commercial electronic communication consent is managed separately from this KVKK notice and, where applicable, from explicit consent for personal data processing.

9. Retention of Personal Data

Personal data is retained for the period required for the relevant processing purpose and any mandatory retention period prescribed by law.

When the processing purpose and any other legal basis for retention cease to exist, personal data is deleted, destroyed or anonymized in accordance with applicable legislation.

10. Your Rights Under the KVKK

• Learn whether your personal data is processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether it is used accordingly,
• Learn the third parties to whom it is transferred in Türkiye or abroad,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction where statutory conditions are met,
• Request notification of correction, deletion or destruction to recipients where applicable,
• Object to a result arising against you exclusively through automated analysis,
• Claim compensation if you suffer damage due to unlawful processing.

11. Applications to the Data Controller

Requests are answered as soon as possible and no later than 30 days, depending on their nature. Where the processing of a request results in an additional cost, the tariff determined by the Turkish Personal Data Protection Board may apply.

12. Updates to This Notice

This notice may be updated due to changes in personal data processing activities, technologies or applicable legislation. The current version is published on the Deriza website.