KVKK Disclosure Statement

Clarification Text on the Law on the Protection of Personal Data (KVKK)

Last updated: March 2026

This Clarification Text has been prepared by Mirissa Kozmetik ve Ticaret Limited Şirketi, in its capacity as data controller, in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 ("KVKK"). Through this text, you can learn about the purposes for which your personal data is processed, the legal basis for such processing, and your rights.

1. Identity of the Data Controller

Company Title Mirissa Kozmetik ve Ticaret Limited Şirketi
Address Esentepe Mah. Büyükdere Cad. Ferko Signature No:175 İç Kapı No:6 Şişli / İSTANBUL
E-mail hello@mirissa.com.tr
Website mirissa.com.tr

2. Processed Personal Data

As Mirissa Kozmetik ve Ticaret Limited Şirketi, we may process your personal data in the following categories:

  • Identity Data: Name, surname
  • Contact Data: E-mail address, phone number, delivery and billing address
  • Customer Transaction Data: Order history, purchased products, return and complaint information
  • Financial Data: Payment method information (card number is not stored by us; processed securely via the iyzico payment infrastructure)
  • Marketing Data: E-mail subscription preferences, campaign interactions
  • Technical Data: IP address, browser type, device information, cookie data, site usage statistics
  • Location Data: Delivery address, country/city information

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

  • Execution of order and delivery processes
  • Fulfilling customer service and support requests
  • Fulfilling invoicing and accounting obligations
  • Fulfilling legal obligations (tax legislation, consumer law, etc.)
  • Ensuring website security and functionality
  • Analyzing site usage and improving user experience
  • Conducting marketing communications via e-mail, SMS, or other channels with your consent
  • Providing personalized product recommendations and campaign notifications
  • Preventing fraud and security breaches
  • Establishing evidence in legal disputes and protecting legal rights

4. Legal Grounds for Processing Personal Data

Your personal data is processed within the framework of the following legal grounds under KVKK Article 5 and 6:

  • Establishment or performance of a contract (Article 5/2-c): Order, delivery, and return processes
  • Fulfilling a legal obligation (Article 5/2-ç): Issuing invoices, tax, and accounting obligations
  • Legitimate interest (Article 5/2-f): Site security, fraud prevention, analytics, and performance measurement
  • Explicit consent (Article 5/1): Marketing communications, personalized advertisements, marketing cookies

5. Parties to Whom Personal Data is Transferred

5.1 Domestic Transfers

Your personal data may be shared with cargo and logistics companies, our payment service provider iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), accounting and financial service providers, and authorized public institutions and organizations when legally required.

5.2 International Transfers (KVKK Article 9)

Due to our website infrastructure and the digital services we use, some of your personal data may be transferred abroad. These transfers are carried out based on your explicit consent or the adequate protection measures determined by the Personal Data Protection Board, within the scope of KVKK Article 9.

  • Shopify Inc. (Canada): E-commerce infrastructure, order, and store infrastructure management. Canada is considered among the countries providing adequate protection by the Board.
  • Google LLC (USA): Processing of analytical and advertising data via Google Analytics and Google Ads services.
  • Meta Platforms Inc. (USA): Facebook and Instagram advertising services.
  • Pinterest Inc. (USA): Pinterest advertising and traffic tracking services.

Your explicit consent is requested for these transfers, and you can review our Cookie Policy to manage your cookie preferences.

6. Personal Data Retention Periods

  • Order and invoice information: 10 years as required by tax legislation
  • Customer account information: As long as the account is active + 3 years from account deletion
  • Marketing communication data: Until subscription is canceled
  • Analytical cookie data: Maximum 2 years
  • Marketing cookie data: Maximum 90 days
  • Legal dispute data: Until the dispute is resolved

Data whose retention period has expired is securely deleted, destroyed, or anonymized.

7. Your Rights Under KVKK

In accordance with Article 11 of the KVKK, you have the following rights:

  • Right to be informed: To learn whether your personal data is being processed
  • Right to access: To request information about your processed personal data
  • Right to rectification: To request the correction of inaccurate or incomplete data
  • Right to erasure: To request the deletion or destruction of your personal data
  • Right to restriction of processing: To request the cessation of data processing under certain conditions
  • Right to object: To object to data processing based on legitimate interests
  • Right to data portability: To request the transfer of your data to you or another data controller in a structured format
  • Right to compensation: To request compensation for damages incurred due to unlawful data processing

8. How to Exercise Your Rights

In accordance with KVKK Article 13, you can apply using the following methods to exercise your rights:

  • E-mail: By sending an e-mail to hello@mirissa.com.tr with the subject "KVKK Application"
  • Mail: By sending a petition with a wet signature to Esentepe Mah. Büyükdere Cad. Ferko Signature No:175 İç Kapı No:6 Şişli / İSTANBUL

Your application must include your name, surname, Turkish ID number (if you are a foreign national, your passport number), your address for notifications, your e-mail address, and a clear statement of your request.

Your application will be concluded free of charge within a maximum of 30 days, depending on the nature of the request. If the process requires an additional cost, a fee may be requested according to the tariff determined by the Personal Data Protection Board.

9. Right to Complain to the Personal Data Protection Board

In case your application is rejected, the answer is found insufficient, or no answer is given within the specified period; you have the right to file a complaint with the Personal Data Protection Board within 15 days from the date you learn about the answer, and in any case, within 60 days from the date of application.

  • Institution name: Personal Data Protection Authority (KVKK)
  • Website: www.kvkk.gov.tr
  • Address: Nasuh Akar Mah. Ziyabey Cad. No:1407 Balgat / ANKARA

10. Changes to the Clarification Text

This Clarification Text may be updated in line with legal regulations or changes in our data processing activities. You can always access the current text on this page. In case of significant changes, we will inform you via e-mail or our website.

11. Related Documents