Privacy Policy

This is a translation provided for information. In case of any discrepancy, the Turkish version is binding.

Personal Data Protection and Privacy Policy

Onnahair Personal Data Protection Policy

• PURPOSE AND SCOPE

The Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti Policy on the Processing and Protection of Personal Data has been prepared with the main aim of ensuring transparency and accountability within the framework of the legislation on personal data. This policy aims to inform and enlighten individuals whose personal data is processed by Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti. The Policy covers all natural persons whose personal data is processed by our company. Onnahair also has a separate policy on the processing and protection of personal data specific to its employees. This policy applies to matters not addressed in that policy.

• DEFINITIONS

The definitions that need to be explained for the integrity of the text used in the Policy are as follows:

• Explicit consent: Consent relating to a specific matter, based on information and given of free will.
• Relevant user: Persons who process personal data within the data controller's organisation or in line with the authority and instructions received from the data controller, except the person or unit responsible for the technical storage, protection and backup of the data.
• Anonymisation of personal data: Making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data.
• Personal data: Any information relating to an identified or identifiable natural person.
• Processing of personal data: Any operation performed on data, such as obtaining, recording, storing, keeping, changing, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, wholly or partly by automated means or by non-automated means provided that they form part of a data filing system.
• Disposal of personal data: Deletion, destruction or anonymisation of personal data.
• Deletion of personal data: Making personal data inaccessible and unusable in any way for the relevant users.
• Destruction of personal data: Making personal data inaccessible, irretrievable and unusable by anyone in any way.
• Board: Personal Data Protection Board.
• KVKK: Personal Data Protection Law No. 6698.
• Special category personal data: Data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
• Policy: Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti Policy on the Processing and Protection of Personal Data
• Onnahair: Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti
• Data processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by it.
• Data filing system: The filing system in which personal data is structured and processed according to certain criteria.
• Data subject or relevant person: The natural person whose personal data is processed.
• Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.

IDENTITY OF THE DATA CONTROLLER

Information on the identity of the data controller for all personal data processing activities covered by this policy is given below.

• Data controller: Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti
• Address: Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti
• Email address: info@onnahair.com

You can also access information about the data controller via VERBİS.

GENERAL PRINCIPLES IN THE PROCESSING OF PERSONAL DATA

Article 4 of the KVKK lists the basic principles to be followed when processing personal data. These principles are taken into account and applied meticulously in all personal data processing activities carried out by Onnahair. The principles and related explanations are set out below:

• Acting lawfully and in good faith: In fulfilling its obligation to process and protect personal data, Onnahair acts in accordance with the general principles of law and the rule of good faith set out in Turkish Civil Code No. 4721.
• Ensuring that personal data is accurate and up to date: It is very important for the protection of individuals' rights that personal data provides accurate and up-to-date information about them. Onnahair takes the reasonable level of care that can be expected of it to ensure that the personal data it processes is accurate and up to date.
• Processing personal data for specific, explicit and legitimate purposes: The purposes to be achieved by processing personal data are the most important criterion in determining whether a processing activity is lawful. Accordingly, the KVKK requires data processing activities to be carried out for specific, explicit and legitimate purposes. In line with this principle, Onnahair carries out personal data processing for specific, explicit and legitimate purposes required by its commercial activities.
• Being relevant, limited and proportionate to the purposes for which they are processed: Onnahair processes personal data to the extent sufficient to achieve the purposes determined within its commercial activities. Onnahair also acts in line with the principle of being limited and proportionate by avoiding processing personal data that is not needed.
• Keeping data for the period provided for in the relevant legislation or necessary for the purpose for which it is processed: Onnahair keeps the personal data it processes for as long as it takes for the processing purposes that can be assessed within the processing conditions to cease. When those purposes cease, Onnahair will stop keeping the relevant personal data.

LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

The KVKK lists the legal grounds for processing personal data in Article 5. If the purposes for which a data controller processes personal data can be assessed within the legal grounds listed in the KVKK, that data controller may process personal data lawfully. Accordingly, Onnahair carries out personal data processing activities where its purposes can be assessed within the legal grounds for processing set out in the KVKK.

The legal grounds for processing personal data in the KVKK are set out below:

• The explicit consent of the data subject,
• It being expressly provided for by law,
• It being necessary to protect the life or physical integrity of the person, or of another person, who is unable to give consent due to actual impossibility or whose consent is not legally valid,
• Processing of personal data of the parties to a contract being necessary, provided that it is directly related to the conclusion or performance of the contract,
• It being necessary for the data controller to fulfil its legal obligation,
• The data having been made public by the data subject,
• Data processing being necessary for the establishment, exercise or protection of a right,
• Data processing being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

LEGAL GROUNDS FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

Onnahair may process special categories of personal data where the legal grounds for processing set out in Article 6 of the KVKK exist. Special categories of personal data are not processed for any purpose that would enable discrimination between individuals or in a way that would expose an individual to unlawful treatment. In addition, Onnahair takes additional security measures, as provided in the relevant legislation, to ensure the security of special categories of personal data. The legal grounds for processing special categories of personal data in Article 6 of the KVKK are:

• Explicit consent of the data subject of the special category data,
• For personal data other than data relating to health and sexual life, the cases provided for by law,
• For personal data relating to health and sexual life, processing only by persons under an obligation of confidentiality or by authorised institutions and organisations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing.

EXPLANATIONS ON THE CATEGORISATION OF PERSONAL DATA

Data categories are used in the information notices provided to data subjects regarding personal data. These categories have been prepared within the framework of the VERBİS system, and examples of the data types that may fall within each category are shown below.

Personal Data Category

Examples of Data in the Category

Identity

such as first name, surname, mother's and father's names, mother's maiden name, date of birth, place of birth, marital status, identity card serial number, Turkish ID number.

Contact

such as address number, email address, contact address, registered electronic mail address (KEP), telephone number.

Location

Location information of where the person is.

Personnel

such as payroll information, disciplinary investigations, employment start and end records, asset declarations, CV information, performance appraisal reports.

Legal Transactions

such as information in correspondence with judicial authorities, information in case files.

Customer Transactions

such as call centre records, invoices, promissory notes, cheque information, information on counter receipts, order information, request information.

Physical Premises Security

such as entry and exit records of employees and visitors, camera recordings.

Transaction Security

such as IP address information, website login and logout information, password information.

Risk Management

such as information processed to manage commercial, technical and administrative risks.

Finance

such as balance sheet information, financial performance, credit and risk information, asset information.

Professional Experience

such as diploma information, courses attended, in-service training, certificates, transcripts

Marketing

Purchase history, surveys, cookie records, information obtained through campaigns.

Health Information

such as information on disability, blood group, personal health information, and information on devices and prostheses used.

STORAGE AND DESTRUCTION OF PERSONAL DATA

Onnahair calculates the retention period for personal data taking into account the periods set out in the relevant legislation. Even after these periods expire, individuals' personal data will continue to be processed and stored if there are processing purposes that satisfy any of the conditions for processing personal data in the KVKK. When the purposes that satisfy the processing conditions in the KVKK end, Onnahair will destroy the personal data. Such destruction is carried out ex officio every six months in accordance with the relevant legislation, or concluded where requests from data subjects require it. Onnahair destroys personal data using deletion, anonymisation or destruction techniques depending on the media in which the data is held. Detailed information on these techniques can be found in the Guide on the Deletion, Destruction or Anonymisation of Personal Data published by the Board.

WEBSITE, FORMS AND VIDEOS

This section concerns the www.onnahair.com website. The data controller is Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti., Esentepe Mah. Kore Şehitleri Cad. No:11/A Şişli 34394 Istanbul; email: info@onnahair.com. For details, see the KVKK Information Notice.

Website and Forms

The Onnahair website runs on our own server. The site uses no advertising or tracking cookies, third-party fonts or embedded social network content; fonts, images and videos come from our own server. Information you send through the forms reaches our own form service; from there it is transferred only to the admin panel, which only our authorised staff can access, and to our request management service provider to follow up the request. Survey responses and job applications are not transferred to this service provider. The page and form a request came from are recorded. The form service limits the number of submissions against misuse and filters out automated submissions; for this, the IP address is held in memory only briefly and is not recorded.

Photos

Photos of your hair or scalp that you optionally send in the system finder may constitute health data and are therefore processed only with your explicit consent (Article 6 of the KVKK). Photos are not opened on the server before passing a virus scan; a file that cannot be scanned is kept in a separate, encrypted quarantine. Embedded location and device information is removed, the file is stored encrypted and deleted automatically after at most 90 days. Photos are only viewed in the admin panel and views are logged. Photos are not sent by email, are not transferred to the request management service provider and are not used for promotion.

Retention Periods

Request messages and survey responses in the admin panel are stored encrypted and deleted after at most 90 days. Photos are stored for at most 90 days, job application details for at most 180 days. The technical copy in our form service is also archived daily after being transferred to the admin panel and deleted after at most 90 days. Access logs kept by the server hosting our site for security purposes (including IP addresses) are deleted automatically after at most 15 days. Request records transferred to the request management service provider are kept for the period required by the purpose of processing and the periods set out in the relevant legislation; at the end of that period they are deleted, destroyed or anonymised.

Transfer Abroad

The server of our website and form service is located in our hosting provider's data centre in the European Union (Finland); therefore, personal data you send via the website is transferred abroad. Transfer abroad is carried out in accordance with Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad: as long as there is no adequacy decision for the destination country, the standard contract announced by the Personal Data Protection Board is signed and the contract is notified to the Personal Data Protection Authority. Transfers to other service providers that may be located abroad are subject to the same rules.

Videos

Videos on the site are served from our own server. No Instagram or other social network player is embedded in the page, no cookies of these services are used and no request is sent to Instagram or any other service while a video plays. The video file is only downloaded when you press the play button. If you click a link to our Instagram page, Instagram's (Meta Platforms) own privacy policy and terms apply.

SHARING PERSONAL DATA WITH THIRD PARTIES

Due to the requirements of banking activities, Onnahair may share personal data with persons/institutions located in Turkey. To keep track of personal data sharing, Onnahair has divided the persons with whom data is shared into the categories below:

Data Recipient Group

Examples

Natural Persons or Private Legal Entities

Such as banks.

Suppliers

Such as information technology providers, courier companies and raw material suppliers.

Authorised Public Institutions and Organisations

Such as information technology providers, courier companies and raw material suppliers.

RIGHTS OF THE DATA SUBJECT

The rights granted to data subjects under Article 11 of the KVKK are listed below:

• To learn whether personal data is being processed,
• To request information about it if personal data has been processed,
• To learn the purpose of processing personal data and whether it is used in line with that purpose,
• To know the third parties in Turkey or abroad to whom personal data has been transferred,
• To request the correction of personal data if it has been processed incompletely or incorrectly,
• To request the deletion or destruction of personal data processed in accordance with the KVKK and other relevant laws once the reasons requiring its processing no longer exist, and to request that the action taken be notified to third parties to whom the personal data has been transferred,
• To object to a result to the detriment of the person arising from the analysis of the processed data exclusively by automated systems,
• To request compensation for damage suffered as a result of unlawful processing of personal data.

You can submit your requests under Article 11 of Law No. 6698, which “sets out the rights of the data subject”, to the data controller in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller. To do so, it is sufficient to apply to the following addresses:

• Address: Onna Saç Sistemleri Sanayi ve Ticaret Ltd. Şti
• Email address: info@onnahair.com

Our company will conclude requests regarding the rights listed above as soon as possible after they are submitted and within thirty days at the latest, free of charge. In order to respond to applications made by data subjects, Onnahair may request additional information and documents to verify the applicant's identity and to clarify the request. If such information and documents are not provided, the data subject's application may not be answered.

MEASURES FOR THE SECURITY OF PERSONAL DATA

Onnahair takes all reasonable care and diligence to ensure the confidentiality and security of the personal data it processes. Within the framework of Article 12 of the KVKK, Onnahair also takes, to a reasonable level, all technical and administrative measures necessary to ensure data confidentiality and security. Together with these administrative and technical security measures, the aim is to prevent unlawful processing of personal data, to prevent unlawful access to personal data and to keep personal data at an appropriate level of security.

Where personal data is processed on its behalf by another natural or legal person (data processor), Onnahair will ensure that the above measures are also taken by those data processors.

If personal data is unlawfully obtained by third parties, the data subjects, the Board and other relevant public institutions and organisations will be notified in accordance with the relevant legislation.

When taking measures for the security of personal data, the Personal Data Security Guide (Technical and Administrative Measures) published by the Board is taken into account.