Privacy Notice (KVKK)

PERSONAL DATA PROTECTION DISCLOSURE TEXT (KVKK NOTICE)

SECTION 1 – INTRODUCTION

1.1 Purpose

The protection of personal data is among the top priorities of Botanik Kozmetik ve Dış Ticaret Limited Şirketi (the “Company”), the owner of the SHIFA Handmade brand.

Within the scope of this Personal Data Protection and Processing Policy (the “Policy”); the purposes for which personal data are processed, the methods of collection, to whom and for what purposes they may be transferred, retention periods, and the rights of data subjects are explained in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”).

1.2 Identity of the Data Controller

Pursuant to KVKK, the data controller is:

Title: Botanik Kozmetik ve Dış Ticaret Limited Şirketi
Brand: Shifa Handmade
Address: Fenerbahçe Mahallesi İğrip Sokak No:13 Interior Door No:1 Kadıköy/İstanbul
Phone: +90 545 940 35 50
E-mail: magaza@shifahandmade.com
MERSIS No: 0181086189000001
Tax Office / No: Göztepe / 1810861890

Product Return Address:
Yenikent Mah. Mustafa Ertekin Cad. Bizimkent Sitesi Hanımeli Sok. No:214
35430 Urla / İzmir

1.3 Scope

This Policy covers all personal data of natural persons who have a relationship with the Company, including but not limited to website visitors, members, customers, suppliers, business partners, and individuals submitting requests or complaints, processed fully or partially by automated means or as part of a data recording system.

SECTION 2 – PROCESSING OF PERSONAL DATA

2.1 Principles of Processing

Personal data are processed in accordance with the following principles:

  • Lawfulness and fairness
  • Accuracy and being up-to-date where necessary
  • Processing for specific, explicit, and legitimate purposes
  • Being relevant, limited, and proportionate to the purpose
  • Retention for the period stipulated in relevant legislation

2.2 Purposes of Processing

Collected personal data are processed for the following purposes:

  • Execution of order processes
  • Delivery of products
  • Processing of payments
  • Issuance of invoices
  • Management of returns and exchanges
  • Customer relationship management
  • Evaluation of requests and complaints
  • Execution of logistics activities
  • Fulfillment of legal obligations
  • Conducting financial and accounting processes

Subject to explicit consent:

  • Sending commercial electronic communications
  • Informing about campaigns and discounts
  • Providing personalized offers
  • Conducting marketing activities
  • Performing customer behavior analysis and profiling

2.3 Method and Legal Basis for Data Collection

Personal data are collected through:

  • Website membership and order forms
  • Contact forms
  • E-mail
  • Cookies
  • Call centers
  • E-commerce infrastructure systems

Data processing is based on the following legal grounds under Articles 5 and 6 of KVKK:

  • Establishment or performance of a contract
  • Fulfillment of legal obligations
  • Establishment, exercise, or protection of a right
  • Legitimate interests of the Company

Where required, explicit consent is obtained. Processing activities aimed at ensuring the security of commercial operations, preventing fraud, maintaining information security, and serving as evidence in legal disputes are carried out based on the Company’s legitimate interests.

SECTION 3 – TRANSFER OF PERSONAL DATA

3.1 Domestic Transfer

Personal data may be shared with:

  • Courier companies
  • Payment institutions and banks
  • E-commerce infrastructure providers
  • Accounting and financial consultants
  • Legally authorized public institutions

in accordance with Article 8 of KVKK.

3.2 International Transfer

Subject to explicit consent, personal data may be transferred abroad to service providers offering:

  • Server services
  • E-mail infrastructure
  • Cloud computing
  • Customer relationship management (CRM) systems
  • Payment infrastructures
  • Fraud prevention systems
  • Information security systems
  • Marketing and analytics tools

provided that adequate safeguards determined by the Personal Data Protection Board are ensured pursuant to Article 9 of KVKK.

SECTION 4 – RETENTION AND DESTRUCTION

Personal data are retained in accordance with:

  • Tax Procedure Law
  • Turkish Commercial Code
  • Regulation on Distance Contracts
  • Relevant consumer legislation

and for statute of limitation periods for potential legal disputes.

Upon expiration of retention periods, personal data shall be:

  • Deleted
  • Destroyed
  • Anonymized

SECTION 5 – RIGHTS OF THE DATA SUBJECT

Pursuant to Article 11 of KVKK, data subjects have the right to:

  • Learn whether their personal data are processed
  • Request information if processed
  • Learn the purpose of processing
  • Know third parties to whom data are transferred
  • Request correction
  • Request deletion or destruction
  • Object to processing
  • Claim compensation in case of damage

5.1 Application Method

Applications may be submitted via:

  • Email: magaza@shifahandmade.com
  • Written application to:
    Fenerbahçe Mahallesi İğrip Sokak No:13 Interior Door No:1 Kadıköy/İstanbul

Applications shall be concluded within 30 days.

SECTION 6 – ENTRY INTO FORCE

This Policy entered into force on … / … / 2026.

The Company reserves the right to amend this Policy where necessary.