Privacy / Personal Data Notice.
1. Data controller
K LAB KOZMETIK San. Tic. Ltd. Şti., Ankara. info@klabcosmetic.com. We process your data under the Turkish Personal Data Protection Law No. 6698 (KVKK) — aligned with EU GDPR principles.
2. Data processed
Identity (name), contact (email, phone, address), customer activity (orders, support tickets), marketing (newsletter consent, cookie IDs), security (IP, logs), financial (order totals; card data handled exclusively by iyzico under PCI-DSS).
3. Purposes
(a) order fulfilment, (b) customer service, (c) legal obligations, (d) marketing with explicit consent, (e) security and fraud prevention, (f) anonymous analytics.
4. Legal basis
KVKK Art. 5/2 contract performance, legal obligation, legitimate interest; explicit consent for marketing.
5. Sharing
Carriers (Hepsijet, MNG Kargo, DHL), payment processor (iyzico), e-mail provider, hosting (Hostinger), public authorities on lawful request, professional advisors when legally required. No routine cross-border transfers; Google Analytics receives anonymised data only with consent.
6. Retention
Order/customer data: 10 years (commercial law). Marketing consent: while active + 6 months logs. Cookies: per cookie policy. Then deleted, destroyed or anonymised.
7. Your rights (KVKK Art. 11)
Right to access, information, rectification, erasure, objection, data portability, automated decision review, and compensation for damages.
8. How to exercise
Send a signed request with ID verification to info@klabcosmetic.com. Responded within 30 days, free of charge as a rule.
9. Consent
Marketing communications, advertising cookies and personalised recommendations require your explicit opt-in. Withdraw any time via info@klabcosmetic.com; lawfulness of prior processing is not affected.
10. Updates
This notice may be updated to reflect legal changes; the latest version is always published here.