Customer Personal Data Privacy Notice

Protection of personal data is important to DALİYAN İÇ VE DIŞ TİCARET LİMİTED ŞİRKETİ (the “Company”). As data controller, the Company acts in accordance with the principles and obligations of Personal Data Protection Law No. 6698 (“KVKK”). This notice informs people whose personal data are processed through the Seoul Secrets website (the “Site” or “Website”) (“Users”).

Data Categories and Examples

The Company processes the following categories of personal data for registered customers and guest customers who shop without registering. Membership-specific information applies to registered customers.

Identity

Name, surname, date of birth, gender and Turkish identity number. Guest customer records do not include gender in the source category list.

Contact

Mobile telephone, email address, postal address, postcode and landline telephone.

Payment

Tax office, invoice information and payment method information.

Membership

Membership information, membership ID and password (registered customers).

Customer transactions

Purchased products, order amount and date, order information, commercial communication permissions, campaigns/competitions used and coupons used. Guest customer transaction records also include call centre recordings and campaigns used.

Transaction security

IP address and user transaction logs; IP address for guest customers.

Marketing

Marketing SMS, emails or call centre calls based on commercial electronic communication consent; cookie records, targeting information and assessments of habits and preferences.

Visual and audio data

Call centre recordings and photos added to product reviews.

Legal transactions

Service start and end times, service type, the accepted membership agreement where applicable, and other legal texts and agreements enabling use of the Company’s services.

Requests and complaints

Complaints and requests about purchased products or services submitted through the site, social media accounts or call centre, and records of their assessment and management.

Purposes and Legal Grounds for Processing

Article 5 of KVKK sets out the legal grounds for processing. The following purposes and grounds apply as specified below.

Registered Customers

Compliance with statutory requirements: identity, contact, payment, membership, customer transaction, transaction security, marketing, visual/audio, legal transaction and request/complaint data are processed to fulfil obligations under applicable laws, such as contacting customers about legally required information and notices. Legal ground: processing expressly provided for by law (Article 5/2-a).
Membership verification and registration: identity, contact, membership, transaction security and legal transaction data are processed to verify member information and complete membership procedures. Legal ground: processing necessary for the establishment or performance of a contract and directly related to the parties (Article 5/2-c).
Order processing: identity, contact, payment, membership and customer transaction data are processed to receive, manage and track orders, process payments, issue invoices and manage delivery. Legal ground: Article 5/2-c.
Sales and after-sales support: identity, contact, payment, membership, customer transaction, transaction security and visual/audio data are processed to provide sales and after-sales support. Legal ground: Article 5/2-c.
Legal obligations: all listed data categories may be processed to respond to authorised institutions or organisations, make required notifications, and comply with applicable legislation, especially electronic commerce and consumer protection requirements. Examples include responding to an authority's request about suspected unlawful transactions and issuing legal or product safety notices. Legal ground: processing necessary for the data controller to fulfil a legal obligation (Article 5/2-ç).
Protection of rights: all listed categories may be processed to establish and exercise rights in disputes or breaches of terms, conduct legal proceedings, detect suspicious, irregular or unlawful access or transactions, and protect customers' and the Company's rights. Legal ground: processing necessary to establish, exercise or protect a right (Article 5/2-e).
Understanding site use: membership, contact, customer transaction and marketing data are processed to understand how users use and interact with the Site and improve user experience, platform content and functionality. Legal ground: processing necessary for the data controller's legitimate interests without harming fundamental rights and freedoms (Article 5/2-f).
Service improvement and customer support: identity, contact, payment, membership, customer transaction, transaction security, visual/audio, legal transaction and request/complaint data are processed to detect and prevent site problems, review and audit business activities, receive and resolve requests, questions and complaints, improve products, services and user experience, contact users through surveys or similar methods to understand satisfaction, preferences, requests and complaints, and process gift vouchers and discount coupons assigned to accounts. Legal ground: Article 5/2-f.
Marketing with consent: identity and contact data are used, with explicit consent, to inform customers of campaigns, opportunities and solutions. Communication preferences can be changed through Membership Information on the Site. Legal ground: explicit consent (Article 5/1).

Guest Customers

Compliance with statutory requirements: identity, contact, payment, customer transaction, transaction security, marketing, visual/audio, legal transaction and request/complaint data are processed to fulfil applicable legal obligations, including contacting customers about statutory information and notices. Legal ground: Article 5/2-a.
Orders, sales and after-sales support: identity, contact, payment, membership where applicable, customer transaction, transaction security and visual/audio data are processed to receive, manage and track orders, process payments and invoices, manage delivery and provide sales and after-sales support. Legal ground: Article 5/2-c.
Legal obligations: identity, contact, payment, membership where applicable, customer transaction, transaction security, marketing, visual/audio, legal transaction and request/complaint data may be processed in response to authorised institutions or organisations and to fulfil notification duties and applicable electronic commerce and consumer protection obligations, including legal and product safety notices. Legal ground: Article 5/2-ç.
Protection of rights: identity, contact, payment, customer transaction, transaction security, marketing, visual/audio, legal transaction and request/complaint data may be processed to protect and exercise rights in disputes or breaches of terms, conduct legal proceedings and detect suspicious, irregular or unlawful transactions. Legal ground: Article 5/2-e.
Understanding site use: contact, customer transaction and marketing data are processed to understand use and interaction and improve user experience, platform content and functionality. Legal ground: Article 5/2-f.
Service improvement and customer support: identity, contact, payment, customer transaction, transaction security, visual/audio, legal transaction and request/complaint data are processed to detect and prevent site problems, review and audit operations, resolve requests and complaints, improve products and services, conduct satisfaction surveys and similar enquiries, and process assigned gift vouchers and discount coupons. Legal ground: Article 5/2-f.
Marketing with consent: identity and contact data are used with explicit consent to communicate campaigns, opportunities and solutions. Preferences may be changed through the Commercial Electronic Message Management System (İYS) or the opt-out facility in the message received. Legal ground: Article 5/1.

Methods of Collecting Personal Data

The Company collects personal data through electronic channels such as the Website, call centre and email by fully or partially automated means. In certain situations, data are also collected physically through non-automated means as part of a data filing system, for example when documents are sent by post.

Recipients and Purposes of Data Transfers

The Company transfers personal data only for the purposes stated in this notice and in accordance with Articles 8 and 9 of KVKK.

Authorised persons, institutions and organisations: identity, contact, payment, membership, customer transaction, transaction security, marketing, visual/audio, legal transaction and request/complaint data may be shared when requested by authorised parties or when notification is required by a legal obligation. Legal grounds: Articles 5/2-a and 5/2-ç.
Partner sellers and courier companies: identity, contact and customer transaction data are transferred to prepare and deliver ordered products and manage orders. Legal ground: Article 5/2-c.
Service providers and business partners: identity, contact, membership, customer transaction, marketing and request/complaint data are transferred to ensure compliance with group company policies and rules, carry out audits and reporting, develop products and services, improve shopping experience and customer satisfaction and loyalty, and cooperate with third parties for these purposes. Legal grounds: Articles 5/2-c and 5/2-f.
Suppliers, business partners and authorised payment institutions: identity, contact, payment, membership, customer transaction, transaction security, marketing, visual/audio, legal transaction and request/complaint data may be transferred to obtain third-party product or service support, such as cooperation with infrastructure providers used for sending email. Legal grounds: Articles 5/2-c and 5/2-f.

If registered or guest customers contact the Company through its corporate WhatsApp line, personal data will be sent abroad because WhatsApp is a service provided from abroad. Customers who do not wish to send personal data abroad through WhatsApp may use the Company's other contact methods.

Your Rights Regarding Personal Data

Under Article 11 of KVKK, you have the right to:

Learn whether your personal data are processed.
Request information if your data have been processed.
Learn the purpose of processing and whether data are used for that purpose.
Know the third parties to whom data are transferred in Türkiye or abroad.
Request correction of incomplete or inaccurate data.
Request deletion or destruction under the conditions of Article 7.
Request that recipients be informed of corrections, deletion or destruction under Article 7.
Object to a result against you arising from analysis exclusively by automated systems.
Seek compensation for damage caused by unlawful processing.

To exercise your rights, you may access My Account on the Company's Website or mobile site and make the relevant changes, updates or deletions. You may also apply using the methods described in the Application Form on the Company's electronic commerce platform:

Email your request from the address registered in our systems to info@seoulsecrets.com.
Send your written request, with documents verifying your identity, to Feneryolu Mah. Selçuk Sindal Sk. B No: 2-4 İç Kapı No: 12 Kadıköy / İstanbul.

You may also use other methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller.

Cookies

The Company uses cookies on the Website. The Cookie Policy describes the cookies used, their purposes and how long they remain active. Please consult the Cookie Policy for details.

Changes to This Notice

The Company may amend this notice at any time. Changes take effect immediately when the revised notice is published. Necessary information will be provided to keep you informed of changes.