KVKK Disclosure Statement

1. Data Controller

Within the scope of the Personal Data Protection Law No. 6698 (“PDPL”), the data controller is LATELİER ALBA KOZMETİK SANAYİ VE TİCARET LİMİTED ŞİRKETİ. Pielurd is the company's consumer-facing brand.

2. Purposes of Processing Personal Data

• Establishing and carrying out product sales, distance sales agreements, and membership procedures.
• Managing payment, invoicing, order preparation, shipping, delivery, return, and support processes.
• Ensuring information security, transaction security, and preventing fraud and misuse.
• Managing consumer requests, complaints, and legal processes.
• Fulfilling obligations arising from tax, commercial, consumer, e-commerce, and other relevant legislation.
• When explicit consent is given, carrying out campaigns, marketing, personalization, and non-mandatory analytical activities.

3. Categories of Data Processed

Identity, contact, customer transaction, financial/payment status information, location/address, transaction security, marketing preferences, request-complaint, legal process, and online usage data may be processed. The full payment card number is not directly stored in Pielurd systems.

4. Method of Collection and Legal Basis

Personal data is collected automatically or partially automatically through the website, Shopify store infrastructure, forms, email, telephone, cookies, payment, and shipping integrations. Processing is based on the conditions of establishing/performing a contract, legal obligation, establishment-use-protection of a right, and legitimate interest as per Article 5/2 of the PDPL; for marketing and non-mandatory tracking activities where these conditions are not met, it is based on explicit consent.

5. Transfer

Data may be shared, limited to the specified purposes, with Shopify, payment, shipping, accounting/e-invoicing, hosting, security, customer service, comment, analytical, and advertising service providers; and with authorized public institutions and legal advisors. In cases where international transfer is required, appropriate safeguards specified in Article 9 of the PDPL and relevant secondary regulations will be applied.

6. Retention Period

Data is retained for the processing purpose, legal retention obligations, and statute of limitations; at the end of the period, it is deleted, destroyed, or anonymized according to the company's retention and disposal procedures.

7. Rights within the Scope of PDPL Article 11

• Learning whether your personal data is processed and requesting information if it has been processed.
• Learning the purpose of processing and whether it is used in accordance with the purpose.
• Knowing the third parties to whom it is transferred, domestically or abroad.
• Requesting rectification if it has been processed incompletely or inaccurately.
• Requesting deletion or destruction when conditions are met, and notification of these actions to third parties to whom it has been transferred.
• Objecting to a result against you arising from analysis by automatic systems.
• Requesting compensation for damages incurred due to unlawful processing.

8. Application

You can submit your application regarding your rights through the methods specified on the Data Subject Application page. Applications will be concluded as soon as possible, and within thirty days at the latest, depending on the nature of the request. If the process requires additional cost, a fee may be requested according to the tariff in the legislation.