The Policy on Protection of Personal Data

We, Sora Kozmetik Sanayi ve Ticaret Anonim Şirketi, respect the personal data you share with us and care about the protection of fundamental rights and freedoms, especially the privacy of your private life. We would like to inform you in detail about the protection of your personal data in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), the manner in which your personal data is received, the purposes for which it is processed, the legal reasons and our mutual rights and obligations.

Your personal data, as Data Controller, Sora Kozmetik Sanayi ve Ticaret Anonim Şirketi, in accordance with the provisions of KVKK and within the framework described below, may be obtained, recorded, maintained, explained, transferred to third parties or abroad to the extent permitted by the legislation or processed in other ways.

Collection of Your Personal Data

Your personal data can be collected either verbally, in writing or electronically whether automatic or non-automated in order to perform its obligations under the legislation, to make collections, to issue invoices and to organize delivery of the products.

Purposes for Processing of Your Personal Data

Personal data can be processed in order for planning and execution of commercial activities, informing the authorized institutions and organizations from the legislation, to obtain technological services in matters not included in our field, to deliver the orders, to make collections, to issue invoices, to solve customer complaints, to trace and manage any alerts you may send us as part of our cosmetic vigilance obligations, to determinate your personal preferences in relation to the products in our website, to secure online transactions, to prevent fraud payment incidents and to manage debt collection, to manage your participation in any events to which you have signed up, to send commercial electronic messages if you explicitly permit, to perform company and partnership law transactions, and in accordance with the relevant legislation, planning and execution of the necessary audit activities, planning of corporate sustainability activities execution, conducting activities to protect the reputation of our company, management of demand and complaint processes, planning and execution of corporate governance and communication activities, by our Company.

Transfer of Your Personal Data

Your personal data is shared in accordance with the law and good faith, accurate and, where necessary, up to date, specific, clear and legitimate purposes, linked to the purpose for which it is processed, limited and measured, in accordance with the principles of retention for the time required by the applicable legislation or for the purpose for which it was processed. Your personal data might be transferred to Ministry of Commerce, domestic/international/foreign/ international, public/private institutions and organizations, companies, consultants, or solution partners of our company and consultants or solution partners and other group companies, other authorized institutions and organizations, suppliers or subcontractors, the other person or organizations allowed by Turkish Commercial Code and other relevant legislation, may be shared with legal authorities, public and/or private law legal persons and other persons or organizations that are authorized or required by the provisions of other legislation, upon official request.

Furthermore, in accordance with Articles 5 and 8 of KVKK and / or in the presence of exceptions in the relevant legislation, the personal data may processed and shared data with third parties without the consent of the Data Subject if

It is explicitly stipulated in the law,

It is compulsory for the protection of the life or body integrity of the person or someone else who is unable to disclose his consent due to the impossibility or whose consent is not granted legal validity,

Provided that any contract between the data owner and the Company is directly related to the establishment or performance of the contract, the processing of personal data is required,

It is compulsory to fulfill the legal obligations,

The data owner has been publicized by himself,

Data processing is mandatory for the establishment, use or protection of a right,

The processing of data for the legitimate interests of the Company is mandatory, without prejudice to the fundamental rights and freedoms of the data holder.

Method and Legal Reason of Personal Data Collection

Your personal data is collected in all verbal, written or electronic media in order to provide the services provided by the Company within the framework of the legal framework determined in accordance with the purposes mentioned above and to ensure that our Company fulfills its contractual and legal responsibilities completely and accurately. Your personal data collected for this legal reason may also be processed and transmitted for the purposes specified in paragraphs (1) and (2) of this Policy within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.

The Rights of the Data Subject

If you, as a data subject, submit your claims regarding your rights to our Company in the following ways, our Company will finalize your request as soon as possible according to its nature and within thirty (30) days at the latest. However, if a fee is foreseen by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged.

As a data subject, you have right to;

• Learn whether or not her/his personal data have been processed;

• Request information as to processing if her/his data have been processed;

• Learn the purpose of processing of the personal data and whether data are used in accordance with their purpose;
• Know the third parties in the country or abroad to whom personal data have been transferred;
• Request rectification in case personal data are processed incompletely or inaccurately;
• Request deletion or destruction of personal data within the framework of the conditions set forth under article 7 of the KVKK;
• Request notification of the operations made as per indents (e) and (f) to third parties to whom personal data have been transferred;
• Object to occurrence of any result that is to her/his detriment by means of analysis of personal data exclusively through automated systems;
• Request compensation for the damages in case the person incurs damages due to unlawful processing of personal data by applying to the data controller.

You may submit your request in order to use of these rights in writing or in accordance with another method if a separate method is determined by the Personal Data Protection Board.

You can exercise your rights stated in Article 11 of the KVKK in written or through other methods to be declared by the Board of Protection of Personal Data, including the necessary information to identify your identity and your explanations for your right to use.

Deletion, Destruction, and Anonymization of Personal Data

Pursuant to Article 7 of the KVKK, although personal data are processed in accordance with the relevant legislation, personal data are deleted, destroyed or made anonymized by the Company upon the request of the person or automatically in case the reasons requiring processing are eliminated.

The procedures and principles regarding this matter shall be fulfilled in accordance with the KVKK and the Regulation on the Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28 October 2017 and numbered 30224.

Personal data is deleted, destroyed or made anonymous within 3 (three) months of the date when our obligation to delete, destroy or anonymize personal data arises.

When you contact our Company and request that your personal data to be deleted or destroyed;

• all conditions for processing personal data have been removed; Your personal data subject to the request will be deleted, destroyed or made anonymous. Your request will be finalized within thirty (30) days at the latest and you will be notified.

• notifies the third parties if all the data processing conditions have been removed and the personal data subject to the request has been transferred to third parties; It is ensured that necessary transactions are carried out within the scope of the Regulation.

• If the conditions for processing personal data have not been completely removed, your request may be rejected and explained in accordance with the third paragraph of Article 13 of the KVKK and you will be notified in writing or electronically within thirty days (30) at the latest.