Personal Data Protection and Processing Policy

This translation is provided for information only; the Turkish text is legally binding. Turkish text

In short: This policy explains the principles by which SHE VEC A.Ş. processes, transfers, retains and protects personal data; it covers everyone whose data is processed, including customers, visitors, business partners, employees and job applicants. Detailed information addressed to you is set out in the Privacy Notice.

1. Purpose and Scope

This Policy has been prepared to ensure that the personal data processing activities carried out by SHE VEC Sağlık ve Kozmetik Ürünleri Sanayi ve Ticaret A.Ş. (the “Company”) are conducted in compliance with Law No. 6698 on the Protection of Personal Data (the “Law”) and related legislation.

The Policy covers every natural person whose personal data is processed by the Company, including customers, potential customers, visitors, representatives of suppliers and business partners, job applicants and employees. In the event of any inconsistency between the Policy and the legislation, the provisions of the legislation apply.

2. Definitions

• Personal data (kişisel veri): Any information relating to an identified or identifiable natural person.
• Special categories of personal data (özel nitelikli kişisel veri): Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect, dress and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
• Data subject (ilgili kişi): The natural person whose personal data is processed.
• Data controller (veri sorumlusu): The person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
• Data processor (veri işleyen): The person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller.
• Destruction (imha): The erasure, destruction or anonymisation of personal data.

3. Principles Adopted in Processing Personal Data

The Company acts in accordance with the principles set out in Article 4 of the Law:

1. Lawfulness and compliance with the rules of good faith: Data is collected only by legitimate and lawful methods.
2. Accuracy and, where necessary, being kept up to date: At the data subject's request, data is corrected without delay.
3. Processing for specified, explicit and legitimate purposes: The purpose of processing is determined in advance and the obligation to inform is fulfilled.
4. Being relevant, limited and proportionate to the purpose: No more data is collected than the purpose requires; data that is not needed is not requested.
5. Retention for the period laid down in the legislation or necessary for the purpose of processing: At the end of that period, the data is destroyed.

4. Processing Conditions

As a rule, personal data is processed with the explicit consent of the data subject. Processing may be carried out without seeking explicit consent if one of the conditions listed in Article 5(2) of the Law exists: it is expressly provided for by law; actual impossibility; it is directly related to the conclusion or performance of a contract; the data controller's legal obligation; the data has been made public by the data subject; the establishment, exercise or protection of a right; legitimate interest, provided that the fundamental rights and freedoms of the data subject are not harmed.

Special categories of personal data are processed only if one of the conditions listed in the third paragraph of Article 6 of the Law exists and with the adequate measures determined by the Personal Data Protection Board in place. In the course of its activities, the Company's principle is not to collect special categories of personal data; such data may be processed only in notifications of undesirable effects (cosmetovigilance) and in cases arising from legislation concerning employees.

5. Obligation to Inform and Explicit Consent

The Company informs data subjects at the time personal data is obtained, in accordance with Article 10 of the Law. Information is provided through the Privacy Notice on the website, the information on the order and membership screens and the contract texts.

For activities that require explicit consent, consent is obtained through a separate tick box, in a manner that relates to a specific matter, is based on information and is given of free will. The privacy notice and the explicit consent text are drawn up as separate texts under different headings; for the privacy notice, only feedback confirming that the text has been read and understood may be obtained from the data subject, and no consent is requested. Consent is not imposed as a precondition for the provision of the service. The data subject may withdraw consent at any time.

6. Transfer of Personal Data

Personal data may be transferred to courier companies, payment institutions, IT and infrastructure providers, advisers and authorised public institutions and organisations in accordance with the conditions in Article 8 of the Law, only to the extent required by the purpose of processing and with the necessary contractual safeguards in place.

Transfers abroad are carried out within the framework of Article 9 of the Law, primarily where there is an adequacy decision or where appropriate safeguards such as a standard contract, an undertaking or binding corporate rules are provided. Transfers of a continuous nature are not based on explicit consent; explicit consent may be relied on only in the cases of incidental transfer provided for in the Law. The Board has not yet issued an adequacy decision for any country. Where the standard contract published by the Board is used as an appropriate safeguard for transfers abroad of a continuous nature (e.g. e-commerce infrastructure), the text of the contract is not amended, and the contract is notified to the Personal Data Protection Authority within 5 working days of completion of the signatures. Data processing agreements are concluded with suppliers acting as data processors.

7. Retention and Destruction

Personal data is kept for the period necessary for the purpose for which it is processed, taking into account the limitation and retention periods laid down in the legislation. Data whose retention period has expired is erased, destroyed or anonymised during periodic destruction cycles or at the request of the data subject. Destruction operations are recorded.

8. Data Security Measures

8.1. Technical measures

• Ensuring network and application security, using up-to-date security software,
• Transmitting data in encrypted form (SSL/TLS) and storing critical data in encrypted form,
• Access control based on an authorisation matrix, user-based authorisation and keeping log records,
• Regular backups, updates and vulnerability monitoring,
• Applying a strong password policy for access to systems.

8.2. Administrative measures

• Creating a personal data inventory and keeping it up to date,
• Awareness training and confidentiality undertakings for employees,
• Signing data processing and confidentiality agreements with suppliers and business partners,
• Carrying out periodic checks in line with the destruction policy,
• Having a defined response procedure to be applied in the event of a data breach.

9. Data Breach Notification

If it is discovered that processed personal data has been obtained by others by unlawful means, the situation is notified to the Personal Data Protection Board as soon as possible and within no more than 72 hours, and to the affected data subjects within the shortest reasonable time after the persons affected by the breach have been identified. Contracts with data processors include a requirement to notify the Company of a breach without delay.

10. Rights of the Data Subject and Applications

Data subjects may apply to the Company to exercise their rights listed in Article 11 of the Law. Application methods and procedures are set out in detail in the Privacy Notice. Applications are concluded free of charge within 30 days at the latest; the response is given in writing or electronically, and rejections are notified with reasons.

11. VERBİS Registration

The Company assesses each year its obligation to register with the Data Controllers' Registry Information System (VERBİS) within the framework of the exemption criteria determined by the Personal Data Protection Board (as at the date on which this policy was updated: data controllers with fewer than 50 employees per year and a total annual balance sheet of less than 100 million TL, whose main activity is not the processing of special categories of personal data). If the thresholds are exceeded, registration is made and the registry information is kept up to date.

12. Updating the Policy

This Policy may be revised in line with changes in legislation and updates to the Company's processes. The current version is published at www.shevec.com with its effective date indicated.

13. Contact

SHE VEC Sağlık ve Kozmetik Ürünleri Sanayi ve Ticaret A.Ş.
Address: Alaaddinbey Mah. 615. Sk. Ünlü Plaza 2 No: 2B, İç Kapı No: 1, Nilüfer / Bursa, Türkiye
Email: destek@shevec.com
Telephone: +90 850 304 08 32
KEP (registered electronic mail): shevecsaglik@hs01.kep.tr
MERSİS No. (Central Registry Number): 0769189526800001

Last updated: 05.10.2026