Personal Data Protection and Privacy Policy

PERSONAL DATA PROCESSING AND PRIVACY POLICY

This Privacy Policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) to fulfill our obligations regarding personal data that we have obtained or may obtain from you within the scope of the services provided through our website, www.santoshacircle.com, and our mobile application, SENKRON AŞ.

Santosha (“Santosha”), acting as the data controller, is located at Levent Mah. Ülgen Sk. No:96, Beşiktaş, Istanbul, Türkiye, and is registered with the Beşiktaş Tax Office under Tax Identification Number 4270122683.

Principles Governing the Processing of Personal Data

Your personal data is processed in accordance with the following principles set out in Article 4 of the KVKK:

a) Processing lawfully and fairly.

b) Ensuring that personal data is accurate and, where necessary, kept up to date.

c) Processing personal data for specific, explicit, and legitimate purposes.

d) Ensuring that personal data is relevant, limited, and proportionate to the purposes for which it is processed.

e) Retaining personal data only for the period prescribed by applicable legislation or necessary for the purposes for which it is processed.

Methods of Collection and Legal Grounds for Processing Personal Data

Your personal data may be collected by Santosha through automated or non-automated means for the purpose of providing our services.

Data may be collected electronically through registration processes, email, relevant websites, mobile applications, and social media accounts to which you have granted access, as well as through call centers or physically via post and courier services.

Your personal data is collected and processed based on the following legal grounds specified in Article 5 of the KVKK:

a) Where processing is expressly permitted by law.

b) Where processing is necessary to protect the life or physical integrity of a person who is unable to provide consent due to actual impossibility or whose consent is not legally valid, or to protect the life or physical integrity of another person.

c) Where processing is directly related to the establishment or performance of a contract and is necessary for processing the personal data of the parties to that contract.

d) Where processing is necessary for the data controller to fulfill its legal obligations.

e) Where personal data has been made public by the data subject.

f) Where processing is necessary for the establishment, exercise, or protection of a legal right.

g) Where processing is necessary for the legitimate interests of the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.

Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

Fulfilling contractual obligations established between you and Santosha.
Providing products and services through Santosha's website and mobile application, including product and service sales, training, and consultancy services.
Obtaining statistical information and preparing reports regarding customer satisfaction; planning and carrying out activities; conducting analyses, market research, and surveys; and personalizing marketing processes according to users' preferences, usage habits, and needs.
Determining and developing company strategies based on records provided by users; evaluating the performance and qualifications of business partners and suppliers; conducting audits; improving company operations; and analyzing operational efficiency.
Ensuring the legal, technical, and commercial security of individuals benefiting from Santosha's services; maintaining information security; and establishing information technology infrastructure.
Providing information to authorized public institutions and organizations as required by applicable legislation.
Managing and completing legal, financial, accounting, marketing, corporate communications, and logistics processes, as well as evaluating supply chain operations.
Establishing and improving system infrastructure; planning and conducting internal audits; and managing contractual processes and legal claims.
Planning and managing employees' access rights to information.
Planning and managing users' access rights and relationships with Santosha, including handling requests and complaints.
Ensuring the accuracy and currency of personal data.

Categories of Personal Data Processed

Santosha may process the following categories of personal data in accordance with applicable legislation:

Identity and Profile Information

Username, password, first name, surname, title, Turkish Republic identification number, MERSİS number, tax identification number, and membership registration date.

Contact Information

Address, telephone number, email address, and other contact details.

Location and User Information

Location information voluntarily indicated or provided by users while using Santosha's services, instructions and requests necessary for using the platform, and the date of the most recent information update.

Transaction and Service Information

Order numbers, ratings, reviews, notes, special requests, campaign and coupon usage information, and records relating to product or service orders.

Communication Records

Records of communications regarding orders, including telephone conversations and email correspondence.

Technical and Security Information

IP addresses processed for technical, administrative, legal, and commercial security purposes; system login credentials; and user activities such as password creation and password resets.

Customer Relations and Marketing Information

Personal data processed to obtain statistical information regarding customer relationships and satisfaction, including purchasing habits, favorite products and services, order frequency, usage habits, average spending amounts, financial information, and customer needs.

This information may also be processed for offering promotional campaigns, conducting market research and surveys, and personalizing marketing activities according to users' preferences, habits, and needs.

Special Categories of Personal Data

Under the KVKK, special categories of personal data include information relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Santosha does not process these categories of personal data.

Please do not share such information with Santosha.

Transfer of Personal Data to Third Parties and/or Abroad

Your personal data may be transferred for the purposes described above, based on your explicit consent and subject to the conditions specified in Articles 8 and 9 of the KVKK.

Personal data may be transferred to third parties under the following circumstances:

a) Where expressly permitted by law.

b) Where necessary to protect the life or physical integrity of a person who is unable to provide legally valid consent, or of another person.

c) Where directly related to the establishment or performance of a contract and necessary for processing the personal data of the contracting parties.

d) Where necessary for the data controller to fulfill its legal obligations.

e) Where personal data has been made public by the data subject.

f) Where necessary for the establishment, exercise, or protection of a legal right.

g) Where necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not prejudiced.

Personal data may be transferred abroad where one of the conditions specified in Articles 5 and 6 of the KVKK is met and an adequacy decision exists regarding the destination country, relevant sectors within that country, or the international organization concerned.

Access to Personal Data and Your Rights Under the KVKK

Pursuant to Article 11 of the KVKK, data subjects have the following rights:

a) To learn whether their personal data is being processed.

b) To request information regarding the processing of their personal data.

c) To learn the purposes of processing their personal data and whether such data is used in accordance with those purposes.

d) To know the third parties, within Türkiye or abroad, to whom their personal data has been transferred.

e) To request the correction of incomplete or inaccurate personal data and to request that such corrections be communicated to third parties to whom the data has been transferred.

f) To request the deletion or destruction of personal data where the reasons requiring its processing no longer exist, even if the data was originally processed in accordance with the law, and to request that such actions be communicated to third parties to whom the data has been transferred.

g) To object to decisions that produce an unfavorable result for the individual and are based exclusively on the analysis of personal data through automated systems.

h) To request compensation for damages arising from the unlawful processing of personal data.

Parties to Whom Personal Data May Be Transferred

Subject to the conditions specified in Articles 8 and 9 of the KVKK and based on your explicit consent, personal data may be transferred to:

Third-party service providers offering data storage, archiving, and hosting systems for Santosha's information security processes.
Sellers, consultants, instructors, employees, business partners, suppliers, associated personnel, and dealers working with Santosha.
Authorized public institutions and organizations where disclosure is required by applicable legislation.
Hosting service providers whose servers are located within Türkiye and/or abroad.
Courier companies and third parties responsible for delivering orders placed through Santosha's website or mobile application.
Individuals using Santosha's website or mobile application.
Users placing orders through Santosha's website or mobile application.
Third-party service providers, consultants, instructors, and healthcare professionals providing services through Santosha's website, mobile application, studios, facilities, or stores.
Third parties providing operational support services to Santosha.

Exceptions to Data Subject Rights

You have the right to request compensation if you suffer damages due to the unlawful processing of your personal data.

However, pursuant to Article 28(1) of the KVKK, the rights listed above may not be exercised in the following circumstances:

a) Where personal data is processed by natural persons exclusively for activities relating to themselves or family members residing in the same household, provided that the data is not disclosed to third parties and data security obligations are observed.

b) Where personal data is processed for research, planning, or statistical purposes through anonymization for official statistics.

c) Where personal data is processed for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public security, public order, economic security, privacy, or personality rights and does not constitute a criminal offense.

d) Where personal data is processed as part of preventive, protective, or intelligence activities conducted by public institutions and organizations legally authorized to ensure national defense, national security, public security, public order, or economic security.

e) Where personal data is processed by judicial authorities or enforcement bodies in connection with investigations, prosecutions, judicial proceedings, or enforcement procedures.

Retention, Deletion, Destruction, and Anonymization of Personal Data

Santosha retains personal data for the periods prescribed by applicable legislation and in accordance with its legal obligations.

Where no specific retention period is prescribed by law, personal data is processed and retained for as long as necessary, at Santosha's discretion and in accordance with customary commercial practices.

Upon expiration of the applicable retention period, personal data is deleted, destroyed, or anonymized.

Personal data for which the processing purpose has ended, or for which deletion or anonymization has been requested, may be retained where necessary for evidentiary purposes in potential disputes, the assertion of legal rights, or the establishment of a legal defense, subject to applicable statutory retention periods.

Where the reasons requiring the processing of personal data no longer exist, such data will be deleted, destroyed, or anonymized upon Santosha's decision or at the request of the data subject, even if the data was originally processed in compliance with applicable legislation.

Requests and Contact Information

As a personal data subject, you may submit requests regarding your rights under the KVKK by contacting:

Email: contact@santoshacircle.com

Your request will be evaluated and finalized as soon as possible and, in any event, within a maximum of 30 days, free of charge.

However, if fulfilling your request results in additional costs, a fee may be charged in accordance with the tariff determined by the Turkish Personal Data Protection Board.

Amendments to This Privacy Policy

Santosha reserves the right to unilaterally update this Privacy Policy where required by applicable legal obligations.