Privacy Notice for Internet Website Users under the Scope of Personal Data Protection Law No. 6698

Purpose and Scope of Privacy Notice

We, Essi Beauty Cosmetics Import Export Education Tourism Health Industry Trade Inc. (“Essi Beauty”), registered with the MERSIS number 0380055302000001 at İzmir Trade Registry Directorate located at Alsancak Mahallesi Kıbrıs Şehitleri Cadde No: 26/11 Konak/İZMİR, place great importance on processing and storing your personal data in accordance with the Law No. 6698 on the Protection of Personal Data (“Law”) and ensuring the security of your personal data with great sensitivity.

With respect to the personal data that we process within the scope of the Law, we act as the “data controller” towards the relevant individuals whose personal data is processed. In this regard, we would like to inform you transparently about the collection, processing, purposes, methods, and your rights arising from the Law concerning your personal data through this privacy notice.

This privacy notice is prepared to inform you in the most transparent way about the identity of us as the data controller, the methods and legal basis of collecting your personal data, the purposes of processing these data, to whom and for what purposes these data can be transferred, the duration of data processing, and your rights specified in Article 11 of the Law, in accordance with Article 10 of the Law entitled “Obligation of Data Controller to Inform Data Subject.”

Method of Collecting Your Personal Data and Legal Basis

Your personal data can be collected automatically or non-automatically, in written or electronic form, through our clinic’s affiliated units, call center, software used to conduct activities within the Company, as well as by written or electronic means. Your personal data will be created and updated as long as your relationship with the Company continues, and can be processed and kept both digitally and physically.

Your personal data is processed by Essi Beauty based on the following points, within the scope of the personal data processing conditions specified in Article 5/1 of the Law, through obtaining explicit consent as required by the first paragraph of Article 5 of the Law, or as stipulated in the second paragraph of Article 5, which states: “a) being clearly prescribed by laws,” “c) being necessary for the data controller to fulfill its legal obligation,” “e) processing is mandatory for the establishment, exercise, or protection of a right,” “f) processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”:

Conducting appointment activities on our website and confirming the identity information of the person making transactions on our website,

Contacting you as necessary within the scope of the communication form and conducting transactions,

Fulfilling the legal and regulatory requirements arising from the Law No. 5651 on Regulating Broadcasting in the Internet Environment and Combating Crimes Committed Through These Publications, the Regulation on the Improvement and Evaluation of Quality in Health No. 29399, and all relevant laws and secondary regulations, and taking necessary measures within this scope,

Carrying out the duties and responsibilities of authorized public institutions and organizations, as well as public institutions of a professional nature,

Fulfilling requests for information and documents requested by judicial authorities and/or administrative authorities,

Carrying out listing, reporting, verification analysis, and generating statistical and scientific information about the use of products and services offered in all our centers and units within the Company and improving our products and services, increasing satisfaction with our products and services, and making customizations related to users within this scope,

Conducting research, promotion, and necessary information about our products and services, evaluating complaints and suggestions, and contacting you directly through communication channels shared with the Company,

Fulfilling risk management and quality improvement activities,

Taking all necessary technical and administrative measures for system and application security,

Processing data necessary for the performance of a contract to which the data subject is a party, provided that it is directly related to the establishment or performance of the contract.

Processed Personal Data

Personal data, as defined in Article 3 of the Law, refers to any kind of information related to an identified or identifiable real person, and constitutes the personal data mentioned in this Privacy Notice. Your personal data is processed in compliance with the Law in a secure manner for legal obligations or to provide better service in Company operations and transactions.

In this context, the personal data processed by Essi Beauty about you on the Internet Site are as follows:

• Identity Information: (Data group containing information about personal identity)
• Name, Surname
• Contact: (Data group that can be used to reach the person)
• Phone Number, Email Address
• Message Information (Written text data group prepared for communication purposes)
• Text Content
• Transaction Security (Data category used to ensure transaction security)
• Security Keys, Log Records, IP Addresses, Cookies

Transfer of Your Personal Data

By ensuring the appropriate level of security required by the Law and relevant legislation, your personal data will be transferred to the following parties for the purposes specified above:

Authorized public institutions and organizations within the scope of the purposes of the request,

Domestic organizations with which we have contractual relations to conduct our activities,

Your personal data can be transferred within the framework of the personal data processing conditions specified in Article 8 of the Law.

Data Processing and Retention Period

Your personal data will be processed in accordance with the Law and all legal provisions and time limits contained in the Company and the clinics and centers affiliated with it, and will be processed within the scope of the processing periods stated in this Privacy Notice. In case there are changes in data processing periods in the laws, the newly determined periods will be taken into account.

Your personal data, as required by the principle of limited retention, will be processed only within the scope of the purposes described in this Privacy Notice and the practices and customs of the Company’s operations and commercial life, and will be deleted, destroyed, or anonymized after the expiration of the periods or procedures required by law.

Rights of the Data Subject

As data subjects under Article 11 of the Law, you have the following rights:

• To learn whether personal data is processed,
• To request information if personal data has been processed,
• To learn the purpose of processing personal data and whether they are used in line with the purpose,
• To know the third parties to whom personal data is transferred at home or abroad,
• To request the correction of personal data in case of incomplete or incorrect processing and to request the notification of the transaction made within this scope to third parties to whom personal data is transferred,
• To request the deletion or destruction of personal data within the framework of the conditions stipulated in the Law and to request the notification of the transaction made within this scope to third parties to whom personal data is transferred, despite being processed in accordance with the Law and other relevant provisions,
• To object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
• To request compensation for the damages in case personal data is processed illegally.

If you wish to exercise these rights, you can always contact Essi Beauty management. Requests arising from the Law will be made through the “Data Subject Application Form.” You can submit your request by filling out the Data Subject Application Form available at the website www.essiguzellik.com, sending a signed copy of the form by hand or through a notary to the address Güneşli Mahallesi Eşrefpaşa Cad. No: 408 Konak/İzmir, sending it electronically to the email address kvkk@essiguzellik.com, or by sending it through other methods determined by the Personal Data Protection Board in accordance with Article 13 of the Law. More comprehensive regulations regarding this can be found in the Essi Beauty Personal Data Application and Response Procedure and Essi Beauty Personal Data Protection and Processing Policy on the website www.essiguzellik.com.

In accordance with Article 13 of the Law, our company will conclude the application requests within a maximum of 30 (thirty) days, free of charge, depending on the nature of the request. If the request is rejected, the reasons for the rejection will be provided in writing or electronically with justification.

Contact information for Essi Beauty is provided at the end of this privacy notice. In this context, Essi Beauty will fulfill the relevant requests of the data subject if the data subject exercises the rights specified in Article 11 of the Law.

For any questions, suggestions, or requests regarding our company, you can contact us.