Data controller: NORM KOZMETİK PAZARLAMA SANAYİ VE TİCARET LİMİTED ŞİRKETİ Address: Mecidiye Mah. Selçuk Cad. Detay Blok No:85 İç Kapı No:1, 34930 Sultanbeyli / İstanbul · E-mail: info@lacinia.com.tr · KEP: normkozmetik@hs01.kep.tr
The personal data of people who shop and/or create an account on lacinia.com.tr (Lacinia) is processed as explained below, in accordance with Turkish Personal Data Protection Law No. 6698 (the "KVKK").
1. DATA PROCESSED AND PURPOSES
| Data category | Example | Purpose | Legal ground (KVKK Art. 5) |
|---|---|---|---|
| Identity | first name, surname | issuing orders and invoices | performance of a contract; legal obligation |
| Contact | e-mail, telephone, address | delivery, order notifications, support | performance of a contract |
| Transaction | order contents, amount, return records | sales, handling return and withdrawal rights | performance of a contract; legal obligation |
| Payment | payment method, amount, iyzico transaction reference | collection and refunds | performance of a contract |
| Account | email, customer account identifier and session verification information | membership services | performance of a contract |
| Marketing preferences | channel-specific consent/refusal, time, source and delivery records | campaign and reminder messages | explicit consent |
| Cookies and usage | on-site behaviour, device information | analytics and ad measurement (as set out in the Cookie Policy) | explicit consent / legitimate interest (strictly necessary cookies) |
| Support communication | the content of the messages you write to our support channels (Instagram/Facebook messages, e-mail, Trendyol) | handling your support request, classifying it, preparing a reply and translating it where needed | performance of a contract; legitimate interest of the data controller |
Method of collection: This data is collected when you sign up to the site, place an order, use the checkout page, fill in forms and write to our support channels, and through cookies while you browse the site — that is, electronically, by automated and non-automated means.
Card details (card number, CVV) are neither processed nor stored by us; on the checkout page they are sent directly to iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.). The "Save my card" option is entirely optional; if you choose it, the card is stored by the payment institution.
2. USE OF ARTIFICIAL INTELLIGENCE IN SUPPORT REQUESTS
The messages you send to our support channels are processed with the help of artificial intelligence so that we can answer your request faster and more accurately. Your message is classified by topic, used to prepare a draft reply for our agent, and translated if it is written in a foreign language.
Your reply is always given by a human agent. The AI only suggests a draft to our agent; no draft is sent to you without being reviewed and approved. No decision that produces a result against you is therefore taken about you solely by an automated system.
For this processing, the text of your message is transferred to the servers of our service provider Google located in the European Union. The transfer uses the minimum data: your name, username, e-mail address and telephone number are not sent as separate information; only the text of the last few messages of the conversation is sent. Google processes this data only on our instructions and does not use it to train its own AI models; a record may be kept for a limited period (about 30 days) for abuse monitoring.
Please do not share information about your health in support messages unless it is needed to resolve your request.
3. TRANSFERS
Data is transferred for delivery to our contracted shipping companies, for collection to iyzico, for issuing legal invoices to our private integrator authorised by the Revenue Administration (BirFatura), for e-mail and SMS sending to our messaging service providers, where Social Login is used to the relevant identity provider (e.g. Google) and where there is a legal obligation to the competent authorities. Where you consent to analytics or advertising cookies, measurement data may be transferred to the providers listed in the Cookie Policy (Google, Meta, Microsoft); this transfer is based on your explicit consent.
To handle your support requests, the content of your messages is transferred to Google Cloud EMEA Limited (Ireland). This transfer abroad is based on the standard contract published by the Personal Data Protection Board, one of the appropriate safeguards listed in the fourth paragraph of Article 9 of the Law; the standard contract has been signed with Google Cloud EMEA Limited and notified to the Personal Data Protection Authority. You can request a copy of the standard contract free of charge at info@lacinia.com.tr.
Depending on the channel your support request comes from, your messages are also held on that platform's own infrastructure: Instagram and Facebook messages are processed by Meta Platforms, e-mails by our e-mail service provider, and Trendyol questions and answers by Trendyol.
4. RETENTION PERIODS
Order, invoice and accounting records are kept for the periods set by tax and commercial law (up to 10 years); account data for the duration of the membership and, after it is closed, for the legal limitation period. Commercial-message consent records are retained for three years after consent expires, and other commercial-message records for three years from their creation. Marketing messages stop when consent is withdrawn; the limited records needed to respect the refusal and fulfil legal obligations are assessed separately. At the end of the period, data is erased, destroyed or anonymised.
Support correspondence is kept for the time needed to resolve your request and for the limitation period for possible disputes. Message texts transferred to the AI service provider may be kept for a limited period (about 30 days) for abuse monitoring only; otherwise they are not stored by the provider.
5. YOUR RIGHTS (KVKK Art. 11)
Under Article 11 of the Law you have the following rights:
- to learn whether your personal data is processed,
- to request information about it if it has been processed,
- to learn the purpose of processing and whether it is used in line with that purpose,
- to know the third parties in Türkiye or abroad to whom it is transferred,
- to request its correction if it has been processed incompletely or incorrectly,
- to request its erasure or destruction within the conditions of Article 7 of the Law,
- to request that correction, erasure or destruction be notified to the third parties to whom the data was transferred,
- to object to a result against you that arises from analysis of the processed data solely by automated systems,
- to claim compensation for loss suffered because of unlawful processing.
You can send your applications to info@lacinia.com.tr or in writing to the company address; applications are concluded free of charge within 30 days at the latest.
6. SEPARATE CONSENT
Data that must be given for orders and membership does not require separate consent (performance of a contract). Email marketing, SMS marketing and non-essential cookies have separate, optional choices; marketing boxes are not preselected. Refusing or withdrawing consent does not affect your shopping. Reading this notice does not grant marketing consent.