Personal Data Protection Notice

Your personal data is processed by Gold Parts Dış Ticaret Limited Şirketi (Brand: Ventus Hair System) as the data controller under Turkish Law No. 6698 on Personal Data Protection ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR").

Data Controller Information:
• Company: Gold Parts Dış Ticaret Limited Şirketi
• Address: Merkez Mah. Abide-i Hürriyet Cad. BlackOut (Bolkan Center) A Blok No:211 D.No:64 PK:34384 Şişli / İstanbul, Turkey
• Email: support@ventushair.com
• MERSIS No: 0396123073400001

EU/EEA Representative (GDPR Art. 27):
Our EU representative is in the process of being appointed. Until then, you may contact us directly at support@ventushair.com for any GDPR-related inquiries.

The following categories of personal data may be collected through our website:

Identity Information:
• Full name, national ID number (for individual invoices), tax ID number (for corporate invoices)

Contact Information:
• Email address, phone number, shipping address, billing address

Transaction Data:
• Order details, order history, return requests, payment information (card details are NOT stored by us — processed in iyzico's PCI-DSS certified environment)

Digital Identifiers:
• IP address, cookie data, browser type, session data, site usage analytics

Marketing Data:
• Shopping preferences, campaign participation, Ventus Points balance and point transactions (earnings, redemptions, clawbacks), partner referral code usage, customer-partner binding data

Legal Process Data:
• Agreement consent logs (IP address, timestamp, agreement version), consent declarations

Your personal data is processed for the following purposes:

• • Creating and managing your membership account


• • Processing orders (order placement, payment processing, shipment tracking, delivery, recovery/reminder processes for orders interrupted at the payment step)


• • Issuing invoices and fulfilling accounting obligations


• • Managing returns and right of withdrawal processes


• • Customer relationship management and responding to support requests


• • Operating the Ventus Points loyalty program (processing and tracking point earnings, redemptions, and clawbacks)


• • Managing customer-partner binding data and calculating partner point earnings under the partner referral program


• • Fulfilling legal obligations (KVKK, Consumer Protection, E-Commerce, Tax Laws)


• • Ensuring website security and preventing fraud


• • Sending commercial electronic communications with your explicit consent (campaigns, discounts, announcements)


• • Statistical analysis and service quality improvement (with anonymized data)

Your personal data is processed based on the following legal grounds under KVKK Article 5 and GDPR Article 6:

a) Explicit Consent (KVKK Art. 5/1 · GDPR Art. 6(1)(a)):
Commercial electronic messaging, marketing profiling, non-essential cookie usage

b) Performance of a Contract (KVKK Art. 5/2-c · GDPR Art. 6(1)(b)):
Order creation, payment processing, shipping, returns, loyalty program operation, recovery of interrupted checkouts — data processing necessary for the performance of the membership and sales agreement

c) Legal Obligation (KVKK Art. 5/2-ç · GDPR Art. 6(1)(c)):
Invoice issuance (Tax Procedure Law), consumer rights (Law No. 6502), e-commerce records (Law No. 6563), tax legislation retention obligations

d) Legitimate Interest (KVKK Art. 5/2-f · GDPR Art. 6(1)(f)):
Website security, fraud prevention, service quality improvement — provided it does not override the fundamental rights and freedoms of the data subject

Your personal data may be transferred to the following parties in accordance with KVKK Articles 8-9 and GDPR Articles 44-49:

Domestic Transfers (Turkey):

• • iyzico Ödeme Hizmetleri A.Ş.: Secure payment processing


• • Yurtiçi Kargo: Delivery logistics


• • Paraşüt (Mikro Yazılımevi): Invoicing and accounting


• • Contracted Application Centers (Partners): Limited to the purposes of coordinating application processes, appointment tracking, and verifying partner referral program rights (first-last name, ordered product code, and contact information if applicable)


• • Competent public authorities: As required by law (court orders, prosecution requests, etc.)

International Transfers:

• • Supabase (USA): Database infrastructure — data stored with encryption


• • Vercel (USA): Web hosting services


• • Google Analytics: Anonymous site usage statistics (with your consent)

International transfers are carried out based on Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection as required by GDPR Article 46 and KVKK Article 9.

Your personal data is retained for the duration required by the processing purposes and within the framework of legal retention obligations:

• • Account information: Duration of active account + 3 years after closure


• • Order and invoice data: 10 years (Tax Procedure Law Art. 253, Turkish Commercial Code Art. 82)


• • Agreement consent logs: 10 years (burden of proof)


• • Commercial messaging consents: Until consent is withdrawn + 1 year


• • Cookie data: Until end of session or up to 2 years, depending on cookie type


• • Customer support correspondence: 3 years

Personal data whose retention period has expired is deleted, destroyed, or anonymized through periodic destruction processes.

The following types of cookies are used on our website:

Essential Cookies:
Necessary for the proper functioning of the website, including session management and security. These cookies do not require consent.

Analytics Cookies:
Used to collect site usage statistics via Google Analytics. Activated only with your explicit consent.

Marketing Cookies:
May be used to measure the effectiveness of advertising and marketing campaigns. Activated only with your explicit consent.

You can manage your cookie preferences through the cookie banner at the bottom of our site. You may also block or delete cookies through your browser settings; however, some site functions may be limited.

Our company implements the following technical and organizational measures to ensure the security of your personal data, in accordance with KVKK Article 12 and GDPR Article 32:

Technical Measures:

• • All data communication is protected with SSL/TLS encryption (256-bit)


• • Payment data is processed in iyzico's PCI-DSS certified infrastructure


• • Database access is restricted through Row Level Security (RLS) policies


• • Passwords are stored using hash algorithms, never in plain text


• • 3D Secure payment verification is mandatory

Organizational Measures:

• • Access to personal data is limited to authorized personnel as per job descriptions


• • Employees and business partners are bound by confidentiality agreements


• • Personal data processing inventories and policies are regularly updated


• • In case of a data breach, the relevant authority and affected individuals are notified as required by KVKK Art. 12/5 and GDPR Art. 33-34

Under KVKK Article 11 and GDPR Articles 15-22, you have the following rights regarding your personal data:

• a) Right to know whether your personal data is being processed


• b) Right to request information if your data has been processed


• c) Right to know the purpose of processing and whether data is used in accordance with its purpose


• d) Right to know the third parties to whom your data is transferred domestically or abroad


• e) Right to request correction of incomplete or inaccurately processed data


• f) Right to request deletion or destruction of your personal data (Right to Erasure / "Right to be Forgotten")


• g) Right to request notification of corrections/deletions to third parties


• h) Right to object to automated decision-making that produces legal effects


• i) Right to claim compensation for damages arising from unlawful processing


• j) (GDPR) Right to data portability — receive your data in a structured, machine-readable format


• k) (GDPR) Right to restrict processing under certain conditions


• l) (GDPR) Right to lodge a complaint with a supervisory authority (in your country of residence)

You may contact us through the following channels to exercise the rights listed above:

1. Via Email:
Send an email with the subject "Data Protection Request" from your registered email address to support@ventushair.com.

2. Via Registered Email (KEP):
Send your request to goldpartsdisticaret@hs01.kep.tr.

3. Via Written Application:
Send your signed petition via registered mail to: Merkez Mah. Abide-i Hürriyet Cad. BlackOut (Bolkan Center) A Blok No:211 D.No:64 PK:34384 Şişli / İstanbul, Turkey.

Required Information:

• • Full name (and signature if written application)


• • National ID number (passport number for foreign nationals)


• • Residential or business address for notification


• • Email address and phone number (if available)


• • Subject of your request

Requests will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest. If the process requires additional cost, fees may be charged according to the tariff determined by the Turkish Personal Data Protection Board.

Supervisory Authorities:
• Turkey: Kişisel Verileri Koruma Kurumu (KVKK)
• EU/EEA: You may lodge a complaint with the data protection authority in your country of residence. A list of EU DPAs is available at edpb.europa.eu.

Within the scope of the AI-powered Personal Transformation Analysis (hair simulation) service offered on our website, your personal data is processed under the following principles:

a) Processed Data and Processing Method:
The portrait photo you upload to use this service is subjected to face detection and alignment locally on your device using browser-based libraries (face-api.js). The aligned face image and the hair mask are sent over a secure connection to Google Cloud Vertex AI (Imagen 3) API services for the inpainting simulation. The generated hair simulation image and your original photo are associated with your profile and stored in our Supabase cloud database. In addition, rating feedback and simulation outputs provided to the system may be processed by our Company in an anonymized manner or in accordance with data security standards to increase the accuracy of our artificial intelligence models, train the system, and improve service quality.

b) Disclaimer:
The generated images are purely representative and estimated hair prosthesis simulations created by artificial intelligence. Differences may occur between actual application/product results and simulation outputs. Our company does not warrant or guarantee the exact accuracy of the simulation results. If a user is unsatisfied with the simulation result, this does not directly reflect the quality or actual performance of our hair replacement systems; therefore, it is strongly recommended that the user does not give up on hair prosthesis applications based on the simulation result.

c) Sharing and Third Parties:
The responsibility for sharing the simulation results (via social media, sending to a friend, or other means) rests entirely with the user. The user agrees and warrants not to share the generated images in a misleading, deceptive, or untruthful manner. Our company accepts no legal or criminal liability arising from shared images.

d) Voluntary Sharing and Public Gallery:
The user may choose to publish their hair simulation results (before/after photos) on the platform to inspire other users (share_consent). In this case, the photos will be completely anonymized, without associating your name or other personal data, and can be published in the comparison area of the Ventus homepage upon admin approval. The user can withdraw this sharing consent at any time via the 'My Account' panel or by contacting our support team. Upon withdrawal, the image will be removed from publication within 72 hours at the latest.

This Privacy Notice may be revised due to changes in legislation or updates to our data processing activities. The updated notice will be published at ventushair.com/kvkk.

Registered members will be notified by email in case of significant changes.

Last Updated: June 21, 2026