KVKK Disclosure Statement

Clarification Text Under the Law on the Protection of Personal Data (KVKK)

Last updated: March 2026

This Clarification Text has been prepared by Mirissa Kozmetik ve Ticaret Limited Şirketi, acting as the data controller, pursuant to Article 10 of the Law No. 6698 on the Protection of Personal Data ("KVKK"). Through this text, you can learn for what purposes and on which legal grounds your personal data is processed, as well as your rights.

1. Identity of the Data Controller

Company NameMirissa Kozmetik ve Ticaret Limited Şirketi
AddressEsentepe Mah. Büyükdere Cad. Ferko Signature No:175 Interior Door No:6 Şişli / ISTANBUL
Emailhello@mirissa.com.tr
Websitemirissa.com.tr

2. Personal Data We Process

As Mirissa Kozmetik ve Ticaret Limited Şirketi, we may process your personal data in the following categories:

  • Identity Data: Name, surname
  • Contact Data: Email address, phone number, delivery and billing address
  • Customer Transaction Data: Order history, purchased products, return and complaint information
  • Financial Data: Payment method information (card numbers are not stored by us; payments are securely processed through iyzico)
  • Marketing Data: Email subscription preferences, campaign interactions
  • Technical Data: IP address, browser type, device information, cookie data, website usage statistics
  • Location Data: Delivery address, country/city information

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

  • Managing order and delivery processes
  • Responding to customer service and support requests
  • Fulfilling invoicing and accounting obligations
  • Fulfilling legal obligations, including tax and consumer-law requirements
  • Ensuring website security and functionality
  • Analyzing website usage and improving the user experience
  • Sending marketing communications by email, SMS or other channels where you have provided consent
  • Providing personalized product recommendations and campaign information
  • Preventing fraud and security breaches
  • Creating evidence in legal disputes and protecting legal rights

4. Legal Grounds for Processing Personal Data

Under Articles 5 and 6 of the KVKK, your personal data is processed on the following legal grounds:

  • Establishment or performance of a contract (Article 5/2-c): Order, delivery and return processes
  • Compliance with a legal obligation (Article 5/2-ç): Invoicing, tax and accounting obligations
  • Legitimate interest (Article 5/2-f): Website security, fraud prevention, analytics and performance measurement
  • Explicit consent (Article 5/1): Marketing communications, personalized advertising and marketing cookies

5. Parties to Whom Personal Data May Be Transferred

5.1 Domestic Transfers

Your personal data may be shared with cargo and logistics companies, our payment service provider iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), accounting and finance service providers, and authorized public institutions and organizations where legally required.

5.2 International Transfers (KVKK Article 9)

Within the scope of our website infrastructure and the e-commerce, analytics, advertising and digital services we use, some personal data may be transferred to service providers located abroad.

International transfers of personal data are carried out in accordance with Article 9 of Law No. 6698 and the relevant secondary legislation: where an adequacy decision exists, on the basis of that decision; where no adequacy decision exists, by providing one of the appropriate safeguards regulated by law; or, where applicable, on the basis of one of the exceptional transfer circumstances specified by the legislation.

The main foreign-based service providers we use in this context include:

  • Shopify Inc.: E-commerce infrastructure, order and store-management services.
  • Google LLC: Analytics and advertising services through Google Analytics and Google Ads.
  • Meta Platforms Inc.: Facebook and Instagram advertising and measurement services.
  • Pinterest Inc.: Advertising and traffic-measurement services.

Where personal data is transferred abroad, the transfer conditions and appropriate safeguards set out in Article 9 of the KVKK and the relevant legislation are applied according to the nature of the transfer.

For detailed information on data-processing activities carried out through cookies and similar technologies, please review our Cookie Policy.

6. Retention Periods for Personal Data

  • Order and invoice information: 10 years as required by tax legislation
  • Customer account information: For as long as the account remains active + 3 years after account deletion
  • Marketing communication data: Until the subscription is cancelled
  • Analytics cookie data: Up to 2 years
  • Marketing cookie data: Up to 90 days
  • Legal dispute data: Until the dispute is concluded

Data whose retention period has expired is securely deleted, destroyed or anonymized.

7. Your Rights Under the KVKK

Pursuant to Article 11 of the KVKK, you have the right to learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether it is being used in accordance with that purpose; know the third parties to whom it has been transferred in Türkiye or abroad; request correction if it has been processed incompletely or inaccurately; request deletion or destruction under the conditions stipulated by law; request that correction, deletion or destruction operations be notified to third parties to whom the data has been transferred; object to a result arising against you as a result of the processed data being analyzed exclusively through automated systems; and request compensation for damages if you suffer damage due to unlawful processing of personal data.

8. How You Can Exercise Your Rights

Under Article 13 of the KVKK, you can exercise your rights by applying through the following methods:

  • Email: Send an email to hello@mirissa.com.tr with the subject “KVKK Application”
  • Post: Send a wet-signed petition to Esentepe Mah. Büyükdere Cad. Ferko Signature No:175 Interior Door No:6 Şişli / ISTANBUL

Your application must clearly state your name, surname, Turkish ID number (or passport number if you are a foreign national), address for notification, email address and your request.

Your application will be concluded free of charge within a maximum of 30 days, depending on the nature of the request. If the process requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

9. Right to Complain to the Personal Data Protection Board

If your application is rejected, the response is found insufficient, or no response is provided within the prescribed period, you may file a complaint with the Personal Data Protection Board within 15 days from the date you learn of the response and, in any event, within 60 days from the date of your application.

  • Institution: Personal Data Protection Authority (KVKK)
  • Website: www.kvkk.gov.tr
  • Address: Nasuh Akar Mah. Ziyabey Cad. No:1407 Balgat / ANKARA

10. Changes to This Clarification Text

This Clarification Text may be updated in line with changes in legislation or our data-processing activities. You can always access the current version on this page. If significant changes are made, we will inform you by email or through our website.

11. Related Documents