PRIVACY POLICY AND PERSONAL DATA PROTECTION NOTICE
Introduction
Hana Tekstil Dış Ticaret ve Sanayi A.Ş. ("Hana Tekstil") acts as the data controller and commits to complying with the Law on the Protection of Personal Data No. 6698 (“KVKK”). Hana Tekstil adopts the principles set out in the KVKK and fulfills its obligations concerning the processing, deletion, destruction, anonymization, transfer, and protection of personal data, as well as informing data subjects.
This Privacy and Personal Data Protection Policy is presented for the access of all individuals whose personal data is processed (“Data Subjects”).
1. Scope and Purpose
This Privacy and Personal Data Protection Policy outlines:
- How and on what legal grounds personal data is collected,
- The categories of data subjects,
- The types and examples of personal data collected,
- The business processes and purposes for which this data is used,
- The technical and administrative measures in place to ensure data security,
- To whom and for what purposes personal data may be transferred,
- Data retention periods,
- Practices related to profiling and segmentation,
- The rights of data subjects and how they can exercise these rights,
- Preferences for commercial communication,
- Personal data sharing with public authorities,
- Cookie usage and management.
2. Methods and Legal Grounds for Data Collection
Hana Tekstil collects personal data through its website, mobile applications, social media channels, cookies, call center, official correspondences, and other communication channels. This data is collected in audio, electronic, or written format based on the legal grounds specified in Article 5 of the KVKK:
- Clearly stipulated by law,
- Required for the performance of a contract,
- Publicized by the data subject,
- Required for the legitimate interests of the data controller without harming the data subject’s rights,
- Necessary for the establishment, exercise, or protection of a legal right.
3. Categories of Data Subjects
Hana Tekstil categorizes data subjects whose personal data is processed as follows:
- Registered Customers (Members)
- Guest Customers (Non-members)
- Online Visitors
- Product Recipients (third parties designated for delivery)
- Suppliers / Vendors / Representatives or Employees of Vendors
Additionally, in accordance with Articles 5 and 6 of the KVKK, personal data of other groups (e.g., consultants, educators, bloggers) may also be processed.
4. Data Categories and Examples
- a) Registered Customers (Members):
- Identity: Name, surname, date of birth, gender, ID number
- Location: City, district (delivery address)
- Contact: Phone number, email, address
- Financial: Tax office, billing info
- Membership Info: ID number, preferences, purchase history
- Security: Passwords, IP address
- Marketing: Cookies, behavioral data
- Legal: Contract approvals, communication consents
- Voice Data: Call center recordings
- Complaint Management: Feedback and resolutions
b) Guest Customers:
- Same categories apply, excluding membership data.
c) Online Visitors:
- Technical Info: IP address, login times, session data, cookies
- Security Data: Passwords and device data
d) Delivery Recipients:
- Identity & Contact: Name, address, phone, etc.
e) Suppliers/Vendors:
- Corporate Info: Tax ID, financial details, signature circulars, contact info
5. Purposes of Data Processing
Personal data is processed for the following purposes:
- Membership management
- Order fulfillment and delivery
- Improving website and mobile app experience
- Personalized campaigns and communication (with consent)
- Customer support and complaint resolution
- Legal compliance
- Security and fraud prevention
- Analysis, profiling, and segmentation (for better service and marketing)
- Data integrity and accuracy
6. Technical and Administrative Measures for Data Security
Hana Tekstil undertakes all necessary precautions to ensure the confidentiality, integrity, and security of your data:
- SSL protection for all website and mobile channels
- Limited access and authorization controls for employees
- Regular penetration tests and audits
- Encryption and anonymization of data in secondary processes
- Locked storage for physical documents
- Immediate deletion from third-party systems upon membership termination
- Incident response and breach notification protocols
7. Data Transfers
Personal data may be shared with:
- Logistics partners (for delivery)
- Call centers (for support)
- Electronic communication service providers (for SMS/email marketing with consent)
- Business partners (cookie-based targeting & analytics)
- Market research companies (customer satisfaction studies)
- Local and international partners (for services, infrastructure, reporting)
- Public institutions and courts (upon legal request)
All data transfers are carried out in accordance with data protection laws and through secure channels. If cross-border transfers are required, they are protected by contractual clauses aligned with KVKK and international standards.
8. Data Retention Periods
| Data Type | Retention Period | Legal Basis |
|----------------------------------------|------------------|------------------------------------|
| Call center recordings | 3 years | Law No. 6563 |
| Membership & order data | 10 years | Law No. 6098 |
| Financial & accounting data | 10 years | Law No. 6102, 213 |
| Cookies | Max. 540 days | Cookie Policy |
| Commercial message consent | 1 year post withdrawal | Law No. 6563 |
| Traffic data of online visitors | 2 years | Law No. 5651 |
| Job applications (CVs) | 1 year | Internal Policy |
| Supplier data | 10 years post-contract | Law No. 6102, 6098, 213 |
9. Profiling and Segmentation
Personal data may be used for:
- Personalized content and campaigns (with marketing consent)
- Product improvement and trend analysis
- Customer segmentation and predictive targeting
This is done using anonymized customer IDs, not directly identifiable data (e.g., name or contact).
10. Your Rights as a Data Subject
You have the right to:
- Learn whether your data is processed
- Request information about your data
- Learn processing purposes and if they are fulfilled
- Know the third parties your data is shared with
- Request correction, deletion, or anonymization of your data
- Object to decisions made by automated systems
- Seek compensation if data is processed unlawfully
To exercise these rights, you may use the “My Account” section of the LUOKK website/app or submit a request via the designated Data Subject Application Form in accordance with Article 13 of the KVKK.
11. Managing Your Marketing Preferences
You can update your preferences for receiving commercial electronic messages at any time via the “My Account” section. Canceling membership does not automatically cancel your marketing consent. Please ensure all relevant steps are completed.
For cookie preferences, refer to our Cookie Policy.
12. Sharing Data with Public Authorities
Hana Tekstil may share your personal data with relevant public authorities if legally obligated (e.g., in cases of crime prevention, national security, legal investigations, etc.).
13. Cookie Use and Management
Please refer to our Cookie Policy for detailed information on the types of cookies used, their purposes, storage periods, and how to manage them.
14. Deletion, Destruction, and Anonymization of Data
Hana Tekstil stores personal data for the legally required or business-necessary durations. Once this period expires, data is deleted, destroyed, or anonymized in accordance with the KVKK and relevant regulations.
We use methods that ensure data becomes completely inaccessible or irretrievable. A periodic destruction cycle of 6 months is followed.
15. Updates to This Policy
This Privacy Policy may be updated at any time. All updates will be made available on our platform and notified to members where necessary.
