Privacy Policy

This policy explains how we protect your personal data on the English pages of sensmoi.com, how long we keep it and the principles we work by. These pages present sens moi products to wholesale buyers and distributors; nothing is sold on them. You can find what data we process, for what purposes and on what legal basis, to whom we transfer it and your rights, separately and in summary form, in our Data Protection Notice (KVKK). For cookies, see our Cookie Policy.

Data controller: HomeXCare Kozmetik Sanayi ve Ticaret Limited Şirketi · Etiler Mah. Nisbetiye Cad. Şirin Apartmanı No: 110 İç Kapı No: 11 Beşiktaş/İstanbul · [INFORMATION REQUIRED: privacyEmail] · registered electronic mail (KEP): [INFORMATION REQUIRED: sellerKep]

1. Our principles

We process personal data in accordance with the principles in Article 4 of Law No. 6698 on the Protection of Personal Data (6698 sayılı Kişisel Verilerin Korunması Kanunu, "KVKK"):

• lawfully and in accordance with the rules of good faith;
• so that it is accurate and, where necessary, up to date;
• for specified, explicit and legitimate purposes;
• in a way that is relevant, limited and proportionate to those purposes;
• keeping it only for the period laid down in the legislation or required by the purpose.

In practice, this means:

• There are no accounts. You can read every page without registering.
• The enquiry form asks only for what we need to answer a business enquiry: your company, your name, your contact details, your country, your type of business, the products you are interested in and your message. The telephone number is optional.
• The enquiry form asks for no marketing consent, and sending an enquiry does not put you on a mailing list.
• Analytics and marketing cookies run only if you allow them.
• We do not sell your personal data, and we do not rent it to third parties for advertising purposes.

2. Privacy when you send an enquiry

• Your enquiry is stored in our site's administration system, and our staff who handle wholesale enquiries are notified by e-mail. Only authorised staff can see it.
• We use your details to answer your enquiry and for the business correspondence that follows it.
• The site does not send an automatic e-mail to the address you enter: our staff reply to you.

3. Security measures

Under Article 12 of the KVKK, the technical and administrative measures we take to protect your data include the following:

• Encrypted connections across the whole site (HTTPS/TLS).
• Access to the admin panel only for authorised staff; an account is locked for 15 minutes after five failed login attempts, and a session ends after at most 8 hours. Access is limited under the "only as much access as needed" principle.
• Encrypted storage of the database and backups at provider level. Access and error logs are kept.
• All secret keys are stored on the server side. Rate limiting and input validation on the enquiry form.
• Contracts with service providers that include data processing and confidentiality obligations. KVKK standard contracts for transfers abroad.
• Confidentiality obligations and awareness training for staff.

If a data breach occurs, we notify the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) and the people affected as soon as possible, in accordance with Article 12 of the KVKK and the Board's decisions.

4. Service providers and transfers abroad

To run the site, we work with hosting, database and e-mail delivery service providers. These providers process your data only on our instructions and in order to provide their service. Because some of these providers are located abroad, data is transferred abroad.

These transfers are made under KVKK Art. 9, using standard contracts and with notification to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). The list of recipients, their countries and the legal basis for the transfer are set out in section 5 of our Data Protection Notice (KVKK).

5. Retention periods

Data	Period	Basis
Enquiries and the related correspondence, if no business relationship follows	2 years (proposal)	Legitimate interest, proportionality
Correspondence that becomes part of a business relationship	The periods laid down in commercial and tax legislation	Legal obligation
Server, access and security logs	180 days (proposal)	Legitimate interest, security
Google Analytics event data (if you gave consent)	Up to 14 months (proposal; Google Analytics setting)	Explicit consent
Cookies	The period stated for each cookie in our Cookie Policy	Explicit consent / necessity

Data whose retention period has ended is periodically erased, destroyed or anonymised. If there is a dispute, an investigation or an official request, the relevant data may be kept until that process has been concluded.

6. Children

sens moi is a household chemical, and the site is not designed for people under 18. We do not knowingly collect personal data from children. We do not show targeted advertising based on personal data to people we know, or should reasonably know, to be children (Regulation on Commercial Advertising and Unfair Commercial Practices (Ticari Reklam ve Haksız Ticari Uygulamalar Yönetmeliği), Art. 25/A).

7. Automated decision-making

We do not make any decision about you that produces legal effects solely by automated systems.

8. Links to other sites

Our site may contain links to our social media accounts and to the corporate website of HomeXCare (www.homexcare.com). The sites concerned are responsible for their own privacy practices.

9. Your rights and contact

You can find your rights under Article 11 of the KVKK and how to apply in sections 7 and 8 of our Data Protection Notice (KVKK). For questions, you can write to [INFORMATION REQUIRED: privacyEmail]. We reply to your application within 30 days at the latest. Your right to lodge a complaint with the Personal Data Protection Board is reserved.

10. Changes

We update this policy when necessary. We announce significant changes on the site.