Personal Data Protection and Processing Policy
1. Purpose and scope
This Personal Data Protection and Processing Policy has been prepared to explain the principles regarding the processing, protection, and storage of personal data obtained through activities carried out via [website address] operated by [full commercial title of the company], in accordance with the Personal Data Protection Law No. 6698 and related legislation.
This policy covers personal data belonging to website visitors, members, customers, potential customers, individuals purchasing products or services, individuals contacting our company through communication channels, and other relevant individuals.
2. Identity of the data controller
The data controller within the scope of Personal Data Protection Law No. 6698 is:
Commercial title: [Full commercial title of the company]
Brand: She Is Wow
MERSIS number: [MERSIS number]
Tax number: [Tax number]
Address: [Full address of the company]
Email: [KVKK application email address]
Phone: [Phone number]
Website: [Website address]
has been determined.
3. Processed personal data
Depending on the nature of the products and services offered by our company, the following categories of personal data may be processed:
Identity data
Name, surname, date of birth, and, when necessary, information related to identity verification.
Contact data
Phone number, email address, delivery address, billing address, city, district, and postal code.
Customer transaction data
Order information, purchased products, order date, payment status, delivery information, return and exchange requests, membership information, cart and favorite product information.
Financial data
Payment method, payment and billing information, bank account details related to refund transactions, and transaction records.
Full credit or debit card information may not be stored directly by our company; payment transactions may be carried out by authorized payment institutions.
Transaction security data
IP address, session records, device information, browser information, traffic data, login/logout records, and technical records related to website security.
Legal action data
Correspondence with authorized persons, institutions, and organizations, dispute records, requests, complaints, and legal follow-up information.
Marketing data
Shopping preferences, campaign usage information, cookie records, commercial electronic communication permissions, and campaign interactions.
Request and complaint data
Correspondence with customer service, support requests, comments, evaluations, reasons for returns and exchanges.
4. Purposes of processing personal data
Your personal data may be processed for the following purposes:
- Creating and managing membership accounts
- Receiving, preparing, and delivering orders
- Executing payment and billing processes
- Managing return, exchange, and right of withdrawal processes
- Responding to customer requests and complaints
- Providing after-sales support services
- Developing products and services
- Ensuring website security
- Preventing unauthorized access and fraud
- Executing accounting and financial processes
- Fulfilling legal obligations
- Responding to requests from authorized institutions and organizations
- Providing information on campaigns, discounts, and new products
- Conducting customer satisfaction activities
- Performing statistical analysis and reporting
- Carrying out advertising and marketing activities
- Determining commercial and business strategies
Marketing and commercial electronic communication activities are carried out based on the explicit consent of the data subject, where necessary, or other legal conditions specified in the applicable legislation.
5. Legal grounds for processing personal data
Your personal data may be processed based on the following legal grounds, depending on the processing activity:
- Directly related to the establishment or performance of a contract
- Fulfilling the data controller's legal obligation
- Processing is necessary for the establishment, exercise, or protection of a right
- Legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
- Explicitly stipulated in laws
- Made public by the data subject themselves
- Having explicit consent
Explicit consent should not be used as a mandatory condition for the establishment of a contract or the provision of a service; the illumination and explicit consent processes should be conducted separately. The KVKK Board has also published a decision regarding making the service conditional on explicit consent and the improper illumination on the website.
6. Method of collecting personal data
Your personal data may be collected by fully or partially automated means or by non-automated means as part of a data recording system.
Data may be obtained through the following channels:
- Website membership and order forms
- Payment and delivery screens
- Contact and support forms
- Email and phone calls
- Social media accounts
- Cookies and similar tracking technologies
- Cargo and logistics companies
- Payment service providers
- Marketplace and e-commerce infrastructures
- Return and exchange forms
- Campaign and newsletter subscriptions
7. Transfer of personal data
Your personal data may be shared with the following individuals and organizations, limited to the processing purpose and with necessary security measures in place:
- Cargo and logistics companies
- Payment institutions and banks
- E-commerce infrastructure providers
- Software, hosting, and IT service providers
- Accounting and financial advisory service providers
- Legal advisors and other professional consultants
- Call center and customer support service providers
- Advertising, analysis, and marketing service providers
- Authorized public institutions and judicial authorities
- Other persons and organizations legally authorized to receive information
The transfer is carried out only to the extent necessary for the performance of the relevant service, fulfillment of legal obligations, and continuation of company activities.
8. Transfer of data abroad
Personal data may be transferred abroad if the website infrastructure, cloud services, email services, analytical tools, advertising platforms, or similar digital services use servers located abroad.
Data transfer abroad is carried out under appropriate safeguards and necessary conditions within the scope of Article 9 of Law No. 6698 and related secondary legislation. The provisions for data transfer abroad were amended in 2024 and the new regulations came into force on June 1, 2024.
If foreign-based services such as Shopify, Google Analytics, Meta Pixel, email marketing applications, or similar are used, this section should be further detailed according to the company's actual data flow.
9. Personal data retention period
Personal data is retained for the period required by the processing purposes and limited to the statute of limitations or retention periods stipulated in the relevant legislation.
Personal data whose retention period has expired or whose processing reason has ceased to exist is destroyed using appropriate methods of deletion, destruction, or anonymization.
In the event of a legal dispute, investigation, or request from an authorized authority, the relevant data may be stored until the process is completed.
10. Security of personal data
Our company takes appropriate technical and administrative measures to:
- Prevent unlawful processing of personal data
- Prevent unlawful access to personal data
- Ensure the secure storage of personal data
for this purpose.
Within this scope, access authorizations, password policies, secure connection methods, backup systems, logging and monitoring processes, personnel authorizations, and service provider controls may be implemented.
Taking necessary administrative and technical measures for personal data security is among the fundamental obligations of the data controller.
11. Cookies
Cookies may be used on our website to enhance user experience, ensure the secure operation of the site, remember preferences, measure traffic, perform analysis, advertising, and marketing activities.
Non-essential cookies are offered to the user's preference in accordance with relevant legislation. Cookie types, purposes of use, providers, and retention periods are explained in the separately published Cookie Policy.
12. Commercial electronic communications
Commercial electronic communications for marketing purposes such as campaigns, discounts, new product announcements, stock notifications, and similar may be sent via email, SMS, or other communication channels, provided that the necessary permissions are obtained.
Users can change their commercial electronic communication preferences at any time by using the unsubscribe link in the messages or by contacting our company.
13. Rights of the data subject
Individuals whose personal data is processed under Article 11 of Law No. 6698 have the following rights:
- To learn whether their personal data has been processed
- To request information if their personal data has been processed
- To learn the purpose of processing and whether it is used in line with its purpose
- To know the third parties to whom the data has been transferred
- To request correction of incomplete or incorrectly processed data
- To request the deletion or destruction of data under the conditions stipulated in the Law
- To request notification of correction or deletion operations to third parties to whom the data has been transferred
- To object to an unfavorable outcome resulting from analysis by automated systems
- To demand compensation for damages incurred due to unlawful processing
these rights.
These rights are one of the essential elements of the obligation to inform.
14. Application method
You can submit your requests regarding your personal data to our company through the following methods:
Email: [KVKK application email address]
Postal address: [Full address of the company]
Registered e-mail (KEP) address: [KEP address, if any]
The application must contain the following information:
- Name and surname
- Signature
- TR ID number or passport/ID number for foreigners
- Address for notification
- Email address and phone number, if any
- Subject of the request
- Information and documents supporting the request
Applications are answered free of charge within the legal period, depending on the nature of the request. If the process incurs an additional cost, the fees determined in the legislation may be requested.
15. Policy updates
Our Company may update this policy in line with changes in legislation, company activities, technologies used, or personal data processing procedures.
The current policy becomes effective on the date it is published on the website.
Last updated: [Day/Month/Year]