This is a translation provided for information. In case of any discrepancy, the Turkish version is binding.
INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
Data Controller's:
- Trade name / Name and surname: Onna Saç Sistemleri San. ve Tic. Ltd. Şti
- Address: Esentepe Mah. Kore Şehitleri Cad. No:11/A Şişli/ISTANBUL
- Phone: +90 (212) 255 44 44
- Email: info@onnahair.com
We have prepared this information notice to inform you about the processing, storage and transfer of your personal data under Personal Data Protection Law No. 6698 (“KVKK”) and related legislation.
Which of Your Personal Data Is Processed and What Are the Purposes of Processing?
We collect the data below within the scope of our activities and in order to carry out our commercial relationship arising from FSEK.
Identity and Contact Information: Name and surname, Turkish ID number, signature, tax ID number, contact information, address. Photo: carrying out information security processes, before and after photos, and carrying out promotional activities
Purposes of Processing Personal Data
Carrying out information security processes, carrying out activities in compliance with legislation, carrying out finance and accounting work, following up and carrying out legal affairs, carrying out communication activities, carrying out / auditing business activities, organisation and event management, carrying out contract processes, ensuring the security of movable property and resources, providing information to authorised persons, institutions and organisations, ensuring the security of data controller operations, carrying out management activities, carrying out audit/ethics activities, carrying out goods and/or service procurement processes, carrying out logistics activities, carrying out goods/service sales processes,
Legal Grounds for Processing Personal Data
In order to achieve the purposes listed above, your personal data is processed by the Data Controller on the following grounds set out in the relevant legislation and Article 5 of the KVKK:
- It being expressly provided for by law,
- processing of personal data of the parties to a contract being necessary, provided that it is directly related to the conclusion or performance of the contract,
- It being necessary for the data controller to fulfil its legal obligation,
- are processed on the legal grounds that data processing is necessary for the establishment, exercise or protection of a right, and that data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Methods of Collecting Personal Data
Your personal data listed in categories above is collected through your CV, contracts, declarations, and the information and documents you provide to us by mobile phone.
Do We Transfer Your Personal Data to a Third Party?
- As required by legal regulations and the legislation we are subject to, your personal data is shared with persons expressly authorised by legislation, primarily the Radio and Television Supreme Council. In addition, your personal data is shared with authorised persons or institutions upon a court decision or a request from authorised administrative authorities.
- Your personal data will be shared with third parties processing the data in order to fulfil the obligations under the assignment-of-rights agreement between us arising from FSEK (Law No. 5846 on Intellectual and Artistic Works).
What Are Your Rights as a Data Subject?
Under the KVKK and related legislation, regarding your personal data, you have the right:
- to learn whether your personal data is processed,
- to request information if your personal data has been processed,
- To learn the purpose of processing personal data and whether it is used in line with that purpose,
- to know the third parties in Turkey or abroad to whom your personal data has been transferred,
- to request the correction of your personal data if it has been processed incompletely or incorrectly,
- to request the deletion or destruction of your personal data under the conditions set out in the KVKK legislation,
- when you request the correction of incomplete or incorrect data or the deletion or destruction of your personal data, to request that this be notified to the third parties to whom we have transferred your personal data,
- to object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems, and
- to request compensation for damage you suffer due to unlawful processing of personal data.
How Can You Exercise Your Rights?
To exercise the rights listed above, you can apply to the Data Controller's business address above with a written, wet-signed petition. In your application to exercise the rights above, the explanations regarding the right you wish to exercise must be stated clearly and understandably. Information and documents relating to the application must be attached to it.
How Long Does It Take to Answer Your Requests Regarding the Processing of Your Personal Data?
Your requests regarding your personal data are assessed and answered within 30 days at the latest from the date they reach the relevant department. If your application is assessed negatively, the reasons for rejection are sent to you primarily by email or post to the address you gave in the application, or, if possible, by the method through which the request was made.
Personal Data Processed Through Our Website
This section has been prepared to inform you, in accordance with Article 10 of Law No. 6698 and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, about your personal data processed through the forms on the www.onnahair.com website and during use of the site.
Data Controller
Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti., Esentepe Mah. Kore Şehitleri Cad. No:11/A Şişli 34394 Istanbul. Phone: +90 (212) 255 44 44, email: info@onnahair.com
Your Personal Data That Is Processed
- Identity information: name and surname.
- Contact information: telephone number, email address.
- Customer transaction information: subject of the request, requested appointment date and time, language of the conversation, your message, the choices you make in the system finder (such as lifestyle, hair colour, texture, length and density), the page from which you sent the form.
- Your satisfaction survey responses, suggestions and complaints; your name if you wish.
- Information you send in the job application form.
- Visual record: the photo of your hair or scalp that you optionally send in the system finder. Because this photo may contain information on hair loss or the condition of the scalp, it may constitute health data, that is, special category personal data.
- Transaction security information: our form service keeps your IP address in memory only briefly, without recording it, to limit excessive and automated submissions. The server hosting our site keeps technical access logs (IP address, date and time, requested page, browser information) for security and error tracking; these logs are deleted automatically after at most 15 days.
Purposes of Processing
- Responding to your request, planning your appointment and giving price information,
- carrying out a hair analysis and recommending a suitable system for you,
- assessing job applications,
- measuring service quality and assessing suggestions and complaints,
- following up requests and carrying out communication activities,
- carrying out information security processes and preventing misuse of the site.
Legal Grounds and Method of Collection
Your personal data is collected electronically and by automated means through the forms on our website. Your information in the appointment, hair analysis, price information, contact and job application forms is processed on the legal grounds that it is directly related to the conclusion of a contract (Article 5/2-c of the KVKK) and our legitimate interest, provided that it does not harm your fundamental rights and freedoms (Article 5/2-f of the KVKK); your survey responses, information on the page from which the form was sent and transaction security information are processed on the legal grounds of our legitimate interest (Article 5/2-f of the KVKK) and the fulfilment of our legal obligations (Article 5/2-ç of the KVKK).
Because photos of your hair and scalp may constitute health data, they are processed only on the basis of the explicit consent (Article 6 of the KVKK) you give with the separate consent box in the form. Sending a photo is not mandatory; not sending a photo or not giving explicit consent does not prevent you from using the hair analysis and system recommendation service.
Processing and Protection of Photos
Only photos in JPEG and PNG format are accepted. The photo passes a virus scan; embedded data such as location (GPS) and device information is removed, the photo is saved again and stored encrypted. Only our authorised specialists can see the photo, in the details of your request in the admin panel; every view is logged. The photo is not transferred to the request management service provider or by email, is not used for promotion and is not shared with third parties.
Transfer of Personal Data
Your identity, contact and request details sent via the website forms (excluding photos, survey responses and job applications) are transferred, for the purpose of following up your request and limited to that purpose, to the request management service provider from which we receive services as a data processor. Suppliers from which we receive information technology services such as server hosting and email notifications can access your personal data only to the extent required by the service and as data processors. Your personal data may also be transferred to legally authorised public institutions and judicial authorities upon request and to the extent required by legislation (Article 8 of the KVKK). The server of our site and form service is located in our hosting provider's data centre in the European Union (Finland); therefore, personal data you send via the website is transferred abroad. Transfer abroad is carried out in accordance with Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad: as long as there is no adequacy decision for the destination country, the standard contract announced by the Personal Data Protection Board is signed and the contract is notified to the Personal Data Protection Authority. Transfers to other service providers that may be located abroad are subject to the same rules.
Retention Period
Request messages, survey responses and photos in our admin panel are stored encrypted and deleted automatically after at most 90 days from the date of sending. Job application details are kept for at most 180 days for assessment. The technical copy in our form service, which receives the forms, is also archived daily after being transferred to the admin panel and deleted after at most 90 days. Access logs kept by the server hosting our site for security purposes (including IP addresses) are deleted automatically after at most 15 days. Request records transferred to the request management service provider are kept for the period required by the purpose of processing and the periods in the relevant legislation; at the end of these periods they are deleted, destroyed or anonymised.
Your Rights and How to Apply
You can also exercise your rights under Article 11 of the KVKK listed above for personal data processed through our website: to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in line with that purpose, to know the third parties in Turkey or abroad to whom it has been transferred, to request correction if it has been processed incompletely or incorrectly, to request deletion or destruction under Article 7 of the KVKK and that these actions be notified to the third parties to whom it was transferred, to object to a result to your detriment arising from analysis exclusively by automated systems, and to request compensation if you suffer damage due to unlawful processing. You can withdraw the explicit consent you gave for your photo at any time; in that case your photo is deleted. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
In accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can send your application in writing, including your name and surname, signature, Turkish ID number (or, if you are a foreign national, your nationality and passport or ID number), your address for notifications, your email address and telephone number if any, and the subject of your request, to Esentepe Mah. Kore Şehitleri Cad. No:11/A Şişli 34394 Istanbul; or send it to info@onnahair.com signed with a secure electronic signature or mobile signature, or from the email address you previously notified to us and that is registered in our system. Your application is concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, if you find the answer insufficient or if no answer is given in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of the application date (Article 14 of the KVKK).
Videos on the Website
The promotional videos on our site are served from our own server. No Instagram or other social network player is embedded in the page, no cookies of these services are used and no information about you is sent to these services when you watch a video. The video file is only downloaded when you press the play button. If you click a link to our Instagram page, Instagram's (Meta Platforms) own privacy policy applies.
EXPLICIT CONSENT DECLARATION FORM OF THE DATA SUBJECT
Pursuant to Personal Data Protection Law No. 6698, I accept, declare and undertake that I consent to the processing of my personal data, my special category personal data and my contact information; to the processing by Onna Saç Sistemleri San. ve Tic. Ltd. Şti of all my personal data, including data provided by me verbally, in writing and/or electronically that identifies or serves to identify my identity and contact information; to its sharing for commercial purposes with sponsor companies where sharing is required under the relevant legislation; and to the processing of the personal and contact data detailed below within the scope defined in Personal Data Protection Law No. 6698.
- Data clearly belonging to an identified or identifiable natural person, processed wholly or partly automatically or non-automatically as part of a data filing system, containing information on the person's identity; name and surname
- Information clearly belonging to an identified or identifiable natural person, processed wholly or partly automatically or non-automatically as part of a data filing system, such as telephone number, address, email address, fax number and IP address
- Personal data clearly belonging to an identified or identifiable natural person, processed wholly or partly automatically or non-automatically as part of a data filing system, relating to records and documents taken on entering physical premises and during stays within them; camera and audio recordings, photos
- Data clearly belonging to an identified or identifiable natural person; photos, audio and camera recordings, data in documents that are copies of documents containing personal data
- I ACCEPT that I give my explicit consent to the processing of my relevant personal data, including my special category personal data as defined in the KVKK, to its use and sharing limited to the purpose of processing within the relevant process, and to its storage for the necessary period, and that I have been duly informed on this matter; and that I have read and understood this text and the Information Notice
Explicit Consent Text for Sending Photos
Knowing that photos of my hair and scalp that I optionally send via the system finder on the website may constitute health data, I give my explicit consent to their being processed by the data controller Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti. for a hair analysis and a recommendation of a suitable system for me, and to their being stored for at most 90 days from the date of sending. I know that my photo will not be transferred to the request management service provider or by email, will not be used for promotion and will not be shared with third parties; that giving explicit consent is not mandatory; and that I can withdraw my consent at any time by notifying info@onnahair.com. This explicit consent is given by ticking the separate, unticked consent box in the system finder form; it is independent of the general explicit consent declaration above.