KVKK Privacy Notice

Trade name: MAS PHARMA İLAÇ SANAYİ İÇ VE DIŞ TİCARET LİMİTED ŞİRKETİ. Address: Mimar Sinan Mah. Fatih Sultan Mehmet Cad. No: 6/93, Silivri / İstanbul, Türkiye. Tax office and number: Silivri Vergi Dairesi / 6121279506. Email: support@lava-derm.com. Website: https://lava-derm.com.

Identity: first and last name.

Contact: email address, phone number, delivery and billing address.

Customer transactions: order, cart and wishlist details; product questions, consultation, contact and support requests and correspondence.

Finance: chosen payment method, payment and refund status, and bank account (IBAN) details provided for a refund. For card payments, card details are processed in the bank’s secure payment infrastructure; the Company does not store card numbers.

Transaction security: account and session details, and technical records relating to security verification and the prevention of automated abuse.

Marketing and preferences: newsletter and notification preferences, language and currency preference, and a daily, short-lived, one-way technical identifier used to count product views (raw IP addresses are not stored for this purpose).

Special category data: if you share information about your skin condition or health in consultation or contact forms, it may qualify as health data. We process such data only to answer your request and on the basis of your explicit consent; please do not share health information that your request does not need.

Your personal data is processed to create and manage accounts; receive, confirm, invoice and deliver orders; carry out payments and refunds; manage withdrawal, return and complaint processes; answer customer and consultation requests; manage stock and orders; send order and security emails; ensure service and information security and prevent abuse; meet retention, reporting and inspection obligations under the law; manage legal disputes; and, if you consent, send commercial electronic messages about offers, new products and news.

Your personal data is processed on the following legal bases under Article 5 of KVKK: processing is directly related to concluding or performing a contract (Art. 5/2-c) (orders, delivery, payment, refunds and account operations); it is necessary to comply with a legal obligation of the controller (Art. 5/2-ç) (invoice, tax and consumer law records, requests from competent authorities); it is necessary to establish, exercise or protect a right (Art. 5/2-e) (complaints and disputes); and it is necessary for the controller’s legitimate interests, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f) (service security, abuse prevention, anonymous view statistics). Commercial electronic messages are based on the approval you give under Article 6 of Law No. 6563 and your explicit consent under Article 5/1 of KVKK; health data is processed on the basis of your explicit consent under Article 6 of KVKK.

In line with Article 8 of KVKK and limited to the purposes above, your personal data may be transferred to cargo and logistics companies to deliver orders; to banks and payment service providers to collect payments and make refunds; to suppliers providing hosting, email delivery, image storage and security services; to persons providing accounting, financial advisory and legal services; and, on request, to legally authorised public institutions (tax offices, the Ministry of Trade, Consumer Arbitration Committees and courts).

We use Resend (Resend, Inc.) to send email and Cloudflare (Cloudflare, Inc.) for image storage and to prevent automated abuse. Through these services, your name, email address, the content of emails sent to you, and technical data such as IP address and browser information may be transferred to servers abroad, in particular in the United States. These transfers are made under Article 9 of KVKK: where there is no adequacy decision, by providing one of the appropriate safeguards such as the standard contracts announced by the Personal Data Protection Board, and where this is not possible, on the basis of the occasional transfer grounds listed in Article 9(6) (for example, where it is necessary to perform a contract, or with your explicit consent).

Your personal data is collected electronically, partly by automated and partly by non-automated means, through the account, order, contact, product question, consultation and newsletter forms on the website, email correspondence, and cookies and similar technologies.

Your personal data is kept for as long as the purpose of processing requires and for the periods set by applicable law. Order, invoice and accounting records are kept for 10 years under Turkish Commercial Code No. 6102 and Tax Procedure Law No. 213; approval records for commercial electronic messages for 3 years after the approval is withdrawn; and product-view deduplication records for 90 days. When the period ends, your data is deleted, destroyed or anonymised.

By applying to the data controller, you have the right to learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether data is used for that purpose; know the third parties in Turkey or abroad to whom it is transferred; request correction if it is incomplete or inaccurate; request deletion or destruction under the conditions in Article 7 of KVKK; request that correction, deletion or destruction be notified to the third parties to whom the data was transferred; object to a result against you arising from analysis exclusively through automated systems; and claim compensation for damage caused by unlawful processing.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request in a signed petition containing information that identifies you to Mimar Sinan Mah. Fatih Sultan Mehmet Cad. No: 6/93, Silivri / İstanbul, Türkiye in writing, or send it to support@lava-derm.com using a secure electronic signature, a mobile signature, or the email address you previously provided to us and that is registered in our system. If the Company has a registered email (KEP) address, you can also apply via KEP. Your application must include your name, surname, signature (for written applications), Turkish ID number (for foreigners, nationality and passport or ID number), residential or business address for notification, email address for notification if any, phone number and the subject of your request. Your request is concluded free of charge as soon as possible according to its nature and within 30 days at the latest; if the process requires an additional cost, a fee under the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient, or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of the application date (KVKK, Art. 14).

This notice is for information only and does not constitute consent. For processing that requires explicit consent or approval (for example, sending commercial electronic messages), your consent is obtained separately from this notice and can be withdrawn at any time through the unsubscribe link in messages or by writing to support@lava-derm.com.