Protection of Personal Data Disclosure Text

Your personal data is processed by our Company, whose credentials are provided below, in its capacity as data controller, as defined in Article 3 and subject to the obligation to inform under Article 10 of the KVKK (Personal Data Protection Law):

• Title: Hoito Kozmetik Sanayi ve Ticaret A.Ş.
• Address: [Company address]
• MERSİS No: [MERSİS No]
• Tax Office / No: [Tax Office] / [Tax No]
• Website: hoito.com.tr
• Email: info@hoito.com.tr
• KEP address: [KEP address]
• Phone: [Phone]

Depending on the nature of your relationship with our company, your personal data may be processed in the following categories:

• Identity Information: such as name, surname, and, where necessary, Turkish ID number.
• Contact Information: email address, phone number, delivery and billing address.
• Customer Transaction Information: membership information, request and complaint records, call/support records.
• Shopping and Order Information: cart and order content, purchased products, order number, invoice and return/cancellation records.
• Financial / Payment Information: records related to payment transactions. Your credit card information is not stored by our Company; payment transactions are carried out through virtual POS with the relevant banks and payment institutions.
• Transaction Security / Log Information: IP address, cookie records, browser and device information, access and transaction log records.
• Marketing Information: habit and preference analyses, campaign/communication delivery records, communication approval status.
• Legal Transaction Information: records related to legal applications, requests, and dispute processes.
• Visual and Audio Records: visual/audio content you send to us and social media interactions (if any).

Your personal data is processed in accordance with the principles and conditions set out in Articles 4, 5, and 6 of the KVKK (Personal Data Protection Law) for the following purposes:

• Establishing and fulfilling order and sales contracts, and ensuring product delivery,
• Performing and tracking payment transactions,
• Managing customer relations, evaluating requests and complaints, and providing customer support,
• Executing return, cancellation, and exchange processes,
• Creating membership records and managing membership processes,
• Carrying out marketing, campaign, discount, and promotional activities, and sending commercial electronic communications, provided your explicit consent is obtained,
• Fulfilling legal obligations arising from relevant legislation (tax, commercial, consumer legislation, etc.),
• Ensuring information security and transaction security, and preventing fraud,
• Operating and developing the website, and conducting analytical/statistical studies.

Your personal data is collected through automatic and partially automatic methods via the hoito.com.tr website and membership/order forms, email and call channels, our social media accounts (e.g., @hoitokozmetik), marketplace platforms where we operate (Trendyol, Hepsiburada, Amazon), and cookies used on our website.

This data is processed based on the following legal grounds set forth in Articles 5 and 6 of the KVKK:

• Directly related to the establishment or performance of a contract (KVKK Art. 5/2-c): order, payment, and delivery processes.
• Fulfillment of a legal obligation (KVKK Art. 5/2-ç): invoicing, statutory retention, and reporting obligations.
• Establishment, exercise, or protection of a right (KVKK Art. 5/2-e): dispute and request processes.
• Legitimate interest of the data controller (KVKK Art. 5/2-f): security, fraud prevention, and service quality improvement.
• Explicit consent (KVKK Art. 5/1 and Art. 6/2): sending marketing communications, non-essential cookies, and international transfers requiring explicit consent.

Your personal data may be transferred to the following parties, limited to the fulfillment of the purposes specified above, in accordance with the conditions stipulated in Articles 8 and 9 of the KVKK (Personal Data Protection Law):

• Cargo and logistics companies: for the purpose of ensuring the delivery of orders,
• Banks, payment institutions, and virtual POS providers: for the purpose of processing payment transactions,
• Marketplace platforms (Trendyol, Hepsiburada, Amazon): for the purpose of fulfilling orders placed through the relevant channel,
• E-mail and SMS / message sending service providers: for the purpose of sending notifications and, with your consent, marketing communications,
• Analytics and advertising service providers (Google Analytics 4, Google Tag Manager, Google Ads, Meta Pixel, TikTok Pixel): for the purpose of analyzing site usage and measuring advertisements,
• Authorized public institutions and organizations, and judicial/administrative authorities: for the purpose of fulfilling legal obligations.

Due to the fact that some service providers' servers are located abroad, your personal data may be transferred abroad. International transfers are carried out by obtaining your explicit consent under Article 9 of the KVKK or by providing appropriate safeguards (undertaking, standard contract, or adequacy decision) stipulated in the Law.

Your personal data is stored for the period required by the purpose for which it is processed, and in any case, taking into account the minimum/maximum storage periods and statute of limitations stipulated in the relevant legislation (tax, commercial, consumer, and debt law legislation, etc.).

Upon expiry of the retention period or cessation of the processing purpose, your personal data will be deleted, destroyed, or anonymized within the framework of our Company's Personal Data Retention and Disposal Policy.

Our company takes all necessary administrative and technical measures to ensure the appropriate level of security in order to prevent the unlawful processing of your personal data and unlawful access to data, and to ensure the preservation of data, in accordance with Article 12 of the KVKK. In this context, measures such as access authorization, encryption, firewalls, logging, personnel awareness training, and confidentiality commitments with service providers are implemented.

Pursuant to Article 11 of the KVKK, by applying to our Company, which is the data controller, you have the following rights regarding your personal data:

• To learn whether your personal data has been processed,
• To request information if your personal data has been processed,
• To learn the purpose of the processing of your personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom your personal data has been transferred domestically or abroad,
• To request the rectification of your personal data if it has been processed incompletely or incorrectly,
• To request the erasure or destruction of your personal data within the framework of the conditions stipulated in the KVKK and relevant legislation,
• To request that the rectification, erasure, and destruction operations be notified to third parties to whom the data has been transferred,
• To object to an unfavorable outcome arising from the analysis of processed data exclusively through automated systems,
• To request compensation for damages if you suffer damage due to the unlawful processing of your personal data.

You can submit your requests regarding your rights listed in Article 11 of the KVKK to our Company using the following methods, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller:

• Written application: By hand or by post to [Company address] with a wet-signed petition,
• Via KEP: To the registered electronic mail address [KEP address],
• Via e-mail: From your e-mail address registered in our system to info@hoito.com.tr.

Your application must clearly state your name-surname, signature (for written applications), contact information, and your request. Our Company will finalize your request free of charge as soon as possible and within a maximum of 30 (thirty) days, depending on its nature. In the event that your application is rejected, you find the response insufficient, or no response is given within the specified period, you reserve the right to file a complaint with the Personal Data Protection Board within thirty days from the date you learn of the response and, in any case, within sixty days from the date of application.