KVKK INFORMATION AND CONSENT TEXT

This Information Text has been prepared by ENROUSH KOZMETİK TİCARET ANONİM ŞİRKETİ (“Company”) for the purpose of informing the Company’s customers regarding the processing of their personal data by the Company within the scope of the Law on the Protection of Personal Data No. 6698 (“Law”).

a) Methods of Obtaining Personal Data and Legal Reasons
Your personal data is collected in electronic or physical environment. Your personal data collected for the legal reasons specified in this Information Text can be processed and shared within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data
Your personal data is processed for the purposes of planning and executing the activities required for customizing the products and services offered by the Company according to the tastes, usage habits and needs of the relevant persons and recommending and introducing them to the relevant persons within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law, carrying out the necessary work by the business units and carrying out the relevant business processes to benefit the relevant persons from the products and services offered by the Company, carrying out the necessary work by the relevant business units and carrying out the relevant business processes to carry out the commercial activities carried out by the Company, planning and executing the commercial and/or business strategies of the Company and ensuring the legal, technical and commercial-occupational security of the Company and the relevant persons who have a business relationship with the Company.

c) Parties with whom Personal Data may be shared and Sharing Purposes
Your personal data may be shared with the Company's business partners and suppliers, legally authorized institutions and organizations and legally authorized private law legal entities within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, for the planning and execution of the activities required for the customization of the products and services offered by the Company according to the tastes, usage habits and needs of the relevant persons and for their recommendation and promotion, for the necessary work to be carried out by the business units and the execution of the relevant business processes in order for the relevant persons to benefit from the products and services offered by the Company, for the necessary work to be carried out by the relevant business units and the execution of the relevant business processes in order for the commercial activities carried out by the Company, for the planning and execution of the Company's commercial and/or business strategies and for the provision of the legal, technical and commercial-occupational security of the Company and the relevant persons who have a business relationship with the Company.

d) Rights of Data Owners and Exercise of These Rights
If you, as personal data owners, submit your requests regarding your rights specified below to the Company using the methods specified under the heading Exercise of Rights by Data Owners, your requests will be evaluated and finalized by our Company as soon as possible and in any case within 30 (thirty) days.

As a personal data owner, you have the following rights in accordance with Article 11 of the Law:

To learn whether your personal data has been processed,
To request information about your personal data if it has been processed,
To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
To know the third parties to whom your personal data has been transferred domestically or abroad,
To request correction of your personal data if it has been processed incompletely or incorrectly and to request notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
To request deletion or destruction of your personal data if the reasons requiring its processing are eliminated despite the fact that it has been processed in accordance with the provisions of the Law and other relevant laws and to request notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
To object to the emergence of a result against the person by analyzing your processed data exclusively through automated systems,
To request compensation for the damages incurred due to the unlawful processing of your personal data.
The second paragraph of Article 28 of the Law lists the cases where data owners do not have the right to request, and in this context;

Personal data processing is necessary for the prevention of crime or criminal investigation,

Personal data made public by the relevant person,
Personal data processing is necessary for the execution of audit or regulatory duties and disciplinary investigation or prosecution by authorized and authorized public institutions and organizations and professional organizations with the status of public institution based on the authority granted by the law,
Personal data processing is necessary for the protection of the economic and financial interests of the State regarding budget, tax and financial issues,
The above-mentioned rights cannot be used in relation to data.
According to the first paragraph of Article 28 of the Law, since the data will be outside the scope of the Law in the following cases, the requests of data owners will not be processed in terms of this data either:
Processing of personal data by real persons within the scope of activities related entirely to themselves or their family members living in the same residence, provided that they are not disclosed to third parties and that the obligations regarding data security are complied with.
Processing of personal data for purposes such as research, planning and statistics by making them anonymous with official statistics.

Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy or personal rights or does not constitute a crime.

Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order or economic security.

Processing of personal data by judicial authorities or enforcement authorities regarding investigation, prosecution, trial or execution procedures.

Use of Rights by Data Owners

Data owners may use the “Form Regarding Applications to be Made by Personal Data Owners to the Data Controller” located at www.enroush.tr to exercise the rights mentioned above.

Applications shall be made with one of the following methods, together with documents that will identify the relevant data owner:

The form shall be filled out and a signed copy shall be delivered by hand, via a notary or by registered letter to Fatih Sultan Mehmet Mah. Poligon Cad. Buyaka 2 Sitesi 2 Blok Apt. No:8 B/62 Umraniye Istanbul,

The form shall be signed with a secure electronic signature regulated within the scope of the Electronic Signature Law No. 5070 and sent by registered e-mail to privacy@enroush.tr,

The Company shall respond to data owners who wish to exercise the aforementioned rights within the framework of the limits set forth in the Law, within a maximum of thirty (30) days as set forth in the Law.

The Company may request information from the relevant person in order to determine whether the applicant is the personal data owner, and may ask questions to the personal data owner regarding his/her application in order to clarify the issues specified in the application.