Privacy & Personal Data Protection (KVKK)

As OXO Global Sağlık ve Güzellik Limited Şirketi, we attach importance to the privacy and security of your personal data.

Data Controller Information

Trade Name: OXO Global Sağlık ve Güzellik Limited Şirketi

Address: Yakuplu Mahallesi, Dereboyu Caddesi, Beysan Sanayi Sitesi No: 41, 34522 Beylikdüzü/İstanbul

MERSİS No: 0649116475100001

Tax Identification No: 6491164751

KEP Address: [email protected]

Email: [email protected]

Phone: 0850 532 96 96

This text has been prepared for the purpose of informing you about the processing of personal data of our customers, independent distributors, and website users, under Law No. 6698 on the Protection of Personal Data (“KVKK”).

Your personal data are processed according to the nature of your relationship with OXO Global and to the extent necessary for the relevant process. Not every data category is processed to the same extent for all users.

Membership and Distributorship Processes

Name, surname, date of birth, identity information, contact details, address, membership number, sponsorship and organization information are processed for the evaluation of the membership application, creation of the account, conduct of the distributorship relationship, and ensuring the accuracy of records.

These processes are based on the legal grounds that they are directly related to the establishment or performance of a contract and the fulfillment of legal obligations arising from applicable legislation.

Order, Invoicing and Delivery Processes

Name, surname or title, contact details, billing and delivery addresses, order content, and payment and transaction information are processed for carrying out the product sale, issuing the invoice, delivering the order, and conducting withdrawal and return processes.

These processes are based on the legal grounds of establishment or performance of a contract and fulfillment of legal obligations.

Bonus and Commission Processes

Distributor identity and membership information, eligible sales volumes, organization relationships, entitlement records, bank account and IBAN information, and necessary financial information are processed for calculating, paying, and accounting for bonuses and commissions and for keeping the related records.

These processes are based on the legal grounds of performance of the distributorship agreement and fulfillment of legal obligations.

Customer Support and Applications

Your contact details, requests and complaints, related order or membership records, and information you share within the scope of your application are processed for answering questions, resolving issues, concluding applications, and protecting rights in disputes.

These processes are based, according to the nature of the request, on the legal grounds of performance of a contract, fulfillment of legal obligations, or establishment, exercise, or protection of a right.

Transaction and Account Security

IP address, session and access logs, and transaction security information are processed for protecting accounts, preventing unauthorized access, examining suspicious transactions, and ensuring system security.

These processes are based on the legal grounds of relevant legal obligations and the Company’s legitimate interest, provided that your fundamental rights and freedoms are not harmed.

Optional Processes

For optional profile information such as gender and for personalization, analysis, or marketing processes based on explicit consent, the relevant data and purpose of use are explained separately and the required explicit consent is obtained separately.

Not giving consent to optional processes does not prevent you from benefiting from membership and shopping services that do not require such data.

Your personal data may be collected through the following channels:

• • Membership, order, and contact forms on the website.
• • Personal account and virtual office transactions.
• • Registration, login, and account linking via a Google account.
• • Payment, delivery, withdrawal, and return processes.
• • Applications made via email, phone, and WhatsApp.
• • Physical documents required for legal or financial processes.
• • Cookies used and transaction security logs generated by the system.

Your personal data are collected limited to the scope necessary for the relevant process.

In registration, login, or account linking via a Google account, name, surname, email address, and Google account ID transmitted by Google with the user’s consent are processed. These data are processed for creating the membership record, identity verification, and providing secure login to the account, under Article 5/2-c of the KVKK (establishment and performance of a contract). For members with a linked Google account, the email address transmitted from Google is used as the membership email address. Members may remove the Google link at any time from their profile pages.

Your personal data may be shared with the following recipient groups to the extent necessary for carrying out the relevant process:

• Courier and logistics companies: Name, contact, address, and shipment information necessary for delivery and return processes.

• Banks and payment institutions: Identity, account, and transaction information necessary for payments, refunds, and bonus payments.

• Accounting and financial service providers: Information necessary for invoicing, accounting, tax, and financial record processes.

• Information technology service providers: Information necessary for website, virtual office, data hosting, communication, and system security services.

• Legal service providers: Information necessary for conducting disputes and protecting legal rights.

• Competent public authorities and judicial bodies: Information necessary within the scope of notification and information obligations arising from legislation.

Information made available to the sponsor or relevant upline organization members within the distributorship organization is limited to the scope necessary for managing the organization and carrying out the Compensation Plan. Contact and financial information is not opened without limit to the entire organization. The scope of access is explained separately with respect to the report and service used.

For domestic transfers, the conditions set out in Article 8 of the KVKK are taken as the basis.

For services involving transfer abroad, the data subject to transfer, purposes, recipient groups, and the transfer mechanism to be applied are explained separately for the relevant process. The transfer is carried out by satisfying the conditions provided in Article 9 of the KVKK.

Your personal data are retained for the retention periods provided in applicable legislation or for the period necessary for the purpose of processing.

When the retention period ends and there is no other legal ground requiring processing, your data are deleted, destroyed, or anonymized in accordance with legislation.

Appropriate technical and administrative measures are applied for the protection of personal data, such as restricting access, authorization, protecting records, and controlling processes conducted with service providers.

Under Article 11 of the KVKK;

• You may learn whether your personal data are processed and, if processed, request information.
• You may learn the purpose of processing, whether the data are used in accordance with their purpose, and the third parties to whom they are transferred.
• You may request correction of incomplete or inaccurate data and, when the legal conditions are met, their deletion or destruction.
• You may request that correction, deletion, and destruction operations be notified to third parties to whom the data have been transferred.
• You may object to results arising against you solely as a result of automated analysis and request compensation for damage arising from unlawful processing.

You may submit your applications in writing to our company address, to our KEP address, or to [email protected] from an email address previously notified to us and registered in our systems. Other application methods stated in legislation may also be used.

Your application must include the information necessary to identify your identity and your request.

Applications are concluded as soon as possible according to the nature of the request and within at most 30 days. Processes are as a rule free of charge; where they require an additional cost, the fees set in legislation may apply.

Where the legal conditions are met, you may lodge a complaint with the Personal Data Protection Board.

The logo, images, design, text, and other content on www.oxoglobal.org are protected by the intellectual property rights of the relevant rights holders. This content may not be used for commercial purposes without authorization.

Users are obliged to provide accurate information, protect the security of their accounts, and use the site in accordance with the law.

Creating fake memberships, unauthorized access to others’ accounts, and transactions that endanger system security are prohibited.

OXO Global may restrict access to the relevant account in cases of unlawful use, in accordance with legislation and the agreement. Users’ legal rights are reserved.

In product sales, payment, delivery, and return processes, the relevant agreements and applicable legislation are taken as the basis.

Links given to third-party sites do not mean that the content of those sites is approved by OXO Global. The Company’s liabilities arising from law are reserved.

Cookies necessary for the operation of the website, management of sessions, and account security may be used.

For cookies used for analysis, advertising, and marketing purposes, the explicit consent required by legislation is obtained. The purposes, providers, and retention periods of the cookies used are explained in the cookie notice; users are enabled to manage and change their preferences.

Campaign and promotional messages are sent after obtaining the consents required by applicable legislation. Not giving marketing consent does not prevent you from becoming a member or shopping. Consents given may be withdrawn via the opt-out and preference management channels provided.

This text is for information purposes. Alone it does not constitute explicit consent or approval of commercial electronic messages. Required consents are obtained separately from the disclosure.