Privacy Policy
PRIVACY AND PERSONAL DATA PROTECTION POLICY
1. PURPOSE AND SCOPE
This Privacy and Personal Data Protection Policy has been prepared to explain the principles governing the collection, use, storage, protection, and transfer of personal data of individuals who visit the roencosmetics.com.tr website, register on the website, make purchases, use communication channels, or otherwise communicate with GDM Global Dijital Pazarlama ve Kozmetik İthalat İhracat Sanayi Limited Şirketi.
This Policy covers:
the roencosmetics.com.tr website,
membership and order processes,
payment and delivery processes,
cancellation and return procedures,
customer service communications,
e-mail and telephone communications,
data processing activities carried out through cookies and similar technologies.
2. DATA CONTROLLER
Pursuant to Law No. 6698 on the Protection of Personal Data, your personal data is processed by the following company in its capacity as the data controller:
Trade Name: GDM Global Dijital Pazarlama ve Kozmetik İthalat İhracat Sanayi Limited Şirketi
Brand: Roen
Address: Atatürk Mahallesi Güner Sokak B1 Blok İç Kapı No: 272 Küçükçekmece / İstanbul
MERSIS No.: 0389190410700001
Tax Office: Halkalı Tax Office
Tax Identification No.: 3891904107
Telephone: 0555 074 66 36
E-mail: [email protected]
Website: roencosmetics.com.tr
Hereinafter referred to as the “COMPANY” or “DATA CONTROLLER”.
3. PERSONAL DATA THAT MAY BE PROCESSED
Depending on the nature of the service provided and the relationship established with the user, the following personal data may be processed.
3.1. Identity Information
First and last name,
Turkish Republic identification number,
Tax identification number,
Identity and title information required for issuing invoices,
Other identity information provided in connection with return or official application procedures.
The Turkish Republic identification number is processed only where required by applicable legislation, invoicing requirements, or the nature of the transaction.
3.2. Contact Information
Telephone number,
E-mail address,
Delivery address,
Billing address,
Other contact information voluntarily provided by the data subject.
3.3. Customer Transaction Information
Membership information,
Order number,
Order date,
Purchased products,
Order amount,
Shopping cart information,
Campaign and discount information,
Cancellation, return, and exchange records,
Delivery and shipping information,
Customer requests and complaints,
Customer service correspondence,
Product ratings and reviews.
3.4. Financial Information
Payment method,
Payment transaction information,
Collection and refund records,
Invoice information,
Bank account and IBAN information,
Transaction result and verification information transmitted to the COMPANY by payment service providers.
Online payments made by credit or debit card are processed using the iyzico payment infrastructure.
The full credit or debit card number, CVV/CVC security code, and similar sensitive card information may be processed directly by iyzico, the relevant bank, or the applicable payment service provider. The COMPANY does not directly store such information in its own systems.
3.5. Transaction Security Information
IP address,
Website access and exit records,
Device and browser information,
Session information,
Encrypted membership and user information,
Security verification records,
Suspicious transaction and fraud-prevention records,
Log records.
3.6. Legal Proceedings and Compliance Information
Consumer applications,
Notices and notifications,
Litigation, enforcement, mediation, and dispute information,
Correspondence with authorized public institutions,
Legal requests,
Defense and evidence records.
3.7. Marketing Information
Commercial electronic communication consents,
Campaign and communication preferences,
Purchase history,
Product interests and preferences,
Campaign usage information,
Advertising and marketing interactions,
Analytical information obtained through cookies and similar technologies.
3.8. Visual and Audio Information
Photographs of products and packages submitted in connection with damaged, incomplete, or incorrect product claims,
Videos submitted during return and customer service processes,
Visual materials shared by users through social media or communication channels,
Customer service call recordings, provided that prior notice has been given.
4. PURPOSES OF PROCESSING PERSONAL DATA
Personal data may be processed for the following purposes:
Performing website membership procedures,
Creating and managing user accounts,
Receiving orders and concluding distance sales agreements,
Preparing and delivering purchased products,
Conducting payment, collection, and refund transactions,
Ensuring payment security through iyzico, banks, and payment service providers,
Verifying bank transfer and EFT transactions,
Conducting cash or card-on-delivery payment processes,
Issuing invoices, e-invoices, and e-archive invoices,
Managing shipping and logistics operations,
Providing information regarding order status,
Managing order cancellations, withdrawal, returns, and exchanges,
Assessing claims concerning incorrect, incomplete, damaged, or defective products,
Resolving customer requests and complaints,
Providing after-sales support services,
Improving product and service quality,
Improving user experience,
Ensuring website security,
Preventing suspicious, unauthorized, or fraudulent transactions,
Conducting information security processes,
Maintaining statutory books, records, and documents,
Conducting tax, accounting, and financial operations,
Fulfilling legal obligations,
Responding to requests from authorized public institutions,
Following up on legal disputes and protecting legal rights,
Conducting campaign, advertising, and marketing activities where explicit consent or another appropriate legal basis exists,
Managing commercial electronic communication preferences,
Performing statistical analysis and reporting.
5. LEGAL BASES FOR PROCESSING PERSONAL DATA
Personal data may be processed, depending on the nature of the relevant processing activity, on the following legal bases:
Being expressly provided for by law,
Being directly related to the establishment or performance of a contract,
Being necessary for the data controller to fulfill its legal obligation,
Being necessary for the establishment, exercise, or protection of a right,
Being necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not adversely affected,
The explicit consent of the data subject.
Personal data required for receiving orders, shipping products, collecting payments, issuing invoices, and processing returns may be processed within the scope of establishing and performing the contract.
Electronic communications for advertising and marketing purposes, as well as the use of non-essential advertising or marketing cookies, may, depending on the nature of the relevant activity, be subject to the user’s approval or explicit consent.
The privacy notice and explicit consent statement are presented separately. Acceptance of the privacy notice does not constitute explicit consent to the processing of personal data.
6. METHODS OF COLLECTING PERSONAL DATA
Personal data may be collected automatically, partially automatically, or by non-automated means, provided that such means form part of a data recording system, through:
website membership forms,
order and payment screens,
delivery and billing forms,
contact and support forms,
return request forms,
e-mail correspondence,
telephone calls,
social media accounts,
shipping and delivery records,
iyzico and other payment service providers,
banks,
e-invoice and accounting systems,
cookies and similar technologies,
authorized public institutions,
business partners and service providers.
7. TRANSFER OF PERSONAL DATA
Personal data may be transferred, to the extent limited to and necessary for the relevant processing purpose, to the following categories of recipients:
iyzico and other authorized payment service providers,
Banks and card organizations,
Courier companies collecting cash-on-delivery payments,
Shipping and logistics companies,
E-commerce infrastructure providers,
Hosting and server service providers,
Software and information technology companies,
Cybersecurity service providers,
Accounting, e-invoice, and e-archive service providers,
Certified public accountants and auditors,
Customer service and call center providers,
SMS and e-mail service providers,
Advertising and marketing service providers where explicit consent or another appropriate legal basis exists,
Lawyers, legal advisers, and mediators,
Authorized public institutions,
Judicial and administrative authorities,
Other natural or legal persons authorized by law.
Name, surname, telephone, and address information transferred to courier companies may be used solely for delivery of the product, communication regarding delivery, and, where necessary, collection of cash-on-delivery payments.
Payment information may be shared with iyzico, banks, and payment service providers for the purposes of processing and verifying payments, ensuring transaction security, and, where necessary, issuing refunds.
8. TRANSFER OF DATA ABROAD
Where the servers of the e-commerce infrastructure, hosting, cloud, analytics, advertising, e-mail, SMS, security, or software services used on the website are located abroad, personal data may be transferred outside Türkiye.
Transfers of personal data abroad shall be carried out on the basis of the applicable conditions stipulated under Law No. 6698 on the Protection of Personal Data and relevant legislation.
This Policy may be updated if the service providers used by the COMPANY or the methods of data transfer change.
If the COMPANY does not transfer personal data abroad, this section shall be updated before the website goes live so that it accurately reflects the actual data processing activities.
9. COOKIES AND SIMILAR TECHNOLOGIES
Cookies may be used on roencosmetics.com.tr for the operation of the website, remembering user preferences, ensuring security, measuring performance, and carrying out advertising activities.
9.1. Strictly Necessary Cookies
These are cookies required for the operation of the website, session management, shopping cart, payment, security, and provision of services requested by the user.
9.2. Functional Cookies
These are cookies used to remember the user’s language, region, session, or website usage preferences.
9.3. Performance and Analytics Cookies
These are cookies used to measure how visitors use the website, detect errors, and improve website performance.
9.4. Advertising and Marketing Cookies
These are cookies that may be used to display advertisements relevant to users’ interests, measure advertising performance, and conduct remarketing activities.
Non-essential cookies are activated according to the user’s preferences. Where reasonably possible, the following options shall be presented to users through the cookie management interface:
Accept all,
Reject all,
Manage preferences.
The name, provider, purpose of use, and retention period of the cookies used shall be separately explained in the Cookie Policy to be published.
10. COMMERCIAL ELECTRONIC COMMUNICATIONS
Commercial electronic communications for campaigns, discounts, new products, advertising, and promotional purposes shall be sent where the relevant person has provided the consent required under applicable legislation.
The user may withdraw their consent to commercial electronic communications by:
using the rejection or unsubscribe link contained in the communication,
changing communication preferences in their user account,
contacting [email protected],
contacting 0555 074 66 36 by telephone.
Service messages concerning order confirmation, payment status, delivery, shipping, security, cancellation, and return processes may be sent as part of the performance of the contract, independently of marketing consent.
11. RETENTION OF PERSONAL DATA
Personal data shall be retained for:
the period necessary for the purpose for which it is processed,
the retention periods prescribed by applicable legislation,
the periods specified under tax and accounting legislation,
periods applicable to consumer disputes and limitation periods,
the period necessary for the establishment, exercise, or protection of a right.
Once the retention period has expired and there is no other legal basis requiring further processing, personal data shall be deleted, destroyed, or anonymized in accordance with applicable legislation.
12. SECURITY OF PERSONAL DATA
The COMPANY shall take appropriate technical and administrative measures, having regard to the nature of the personal data and the processing activities, to prevent personal data from:
being processed unlawfully,
being accessed by unauthorized persons,
being lost,
being altered,
being disclosed or damaged.
Accordingly, the following measures may be implemented:
access authorization,
user and password security,
secure connection methods,
logging and record-keeping,
backups,
protection against malware,
employee awareness,
confidentiality obligations,
service provider agreements,
encryption and access restrictions where necessary.
Taking into account that no method of data transmission over the internet can guarantee absolute security, reasonable security measures shall be implemented within the limits of available technical capabilities.
13. THIRD-PARTY WEBSITES
The website may contain links directing users to social media platforms, payment service providers, or websites operated by third parties.
The privacy, security, and personal data processing practices of third-party websites and applications are the responsibility of the relevant third party.
Users are advised to review the privacy policies of any third-party websites to which they are redirected.
14. CHILDREN’S PERSONAL DATA
Product sales and membership services on the website are generally intended for adults.
If it is determined that personal data belonging to a child has been processed without the information and consent of the child’s parent or legal guardian, such data may be assessed in accordance with applicable legislation and the necessary deletion, destruction, or other measures may be taken.
15. RIGHTS OF THE DATA SUBJECT
Individuals whose personal data is processed have the following rights under Law No. 6698 on the Protection of Personal Data:
To learn whether their personal data is being processed,
To request information regarding the processing of their personal data where it has been processed,
To learn the purpose of processing their personal data and whether it is being used in accordance with that purpose,
To learn the third parties to whom their personal data has been transferred domestically or abroad,
To request correction of incomplete or incorrectly processed personal data,
To request deletion or destruction of personal data where the statutory conditions are met,
To request notification of correction, deletion, or destruction to third parties to whom the personal data has been transferred,
To object to a result arising against the individual where the processed data is analyzed exclusively through automated systems,
To request compensation for damages where the individual has suffered damage due to unlawful processing of personal data.
16. APPLICATION PROCEDURE
Individuals wishing to submit a request concerning their personal data may apply using one of the following methods:
Written application address:
GDM Global Dijital Pazarlama ve Kozmetik İthalat İhracat Sanayi Limited Şirketi
Atatürk Mahallesi Güner Sokak B1 Blok İç Kapı No: 272 Küçükçekmece / İstanbul
E-mail: [email protected]
Telephone: 0555 074 66 36
Applications submitted by e-mail may be required to be sent from an e-mail address previously registered in the COMPANY’s systems for the applicant.
Applications should include the following information:
First and last name,
Signature, if the application is submitted in writing,
Turkish Republic identification number or, for foreigners, identification or passport number,
Address for notification,
E-mail address and telephone number, if available,
Subject matter of the request,
Information and documents supporting the request.
The COMPANY shall conclude the application as soon as reasonably possible and within the period prescribed by applicable legislation, depending on its nature.
If processing the application requires an additional cost, the fee schedule prescribed by applicable legislation may apply.
Additional information or documentation may be requested to verify the identity of the applicant and prevent disclosure of personal data to unauthorized persons.
17. POLICY CHANGES
The COMPANY may update this Policy due to changes in legislation, decisions of competent authorities, business processes, infrastructure used, or personal data processing activities.
The updated Policy shall enter into force as of the date it is published on roencosmetics.com.tr.
Effective Date: 28 July 2026
Last Updated: 28 July 2026
18. CONTACT
For questions regarding privacy and the protection of personal data:
GDM Global Dijital Pazarlama ve Kozmetik İthalat İhracat Sanayi Limited Şirketi
Address: Atatürk Mahallesi Güner Sokak B1 Blok İç Kapı No: 272 Küçükçekmece / İstanbul
MERSIS No.: 0389190410700001
Tax Office: Halkalı Tax Office
Tax Identification No.: 3891904107
Telephone: 0555 074 66 36
E-mail: [email protected]
Website: roencosmetics.com.tr