PRIVACY POLICY
For visitors located in the European Economic Area, the United Kingdom and Switzerland
| Controller | Normactive Kozmetik San. ve Tic. Ltd. Şti. (“Normactive”, “we”, “us”) |
|---|---|
| Address | Alsancak Mah. Kıbrıs Şehitleri Cad. No: 24/12, 35220 Konak / İzmir – Türkiye |
| info@normactive.com | |
| Website (the “Site”) | www.normactive.com |
| EU representative (Art. 27 GDPR) | |
| Effective / last updated | 30 July 2026 |
1. Scope of this Policy
This Privacy Policy applies where you visit the Site from the European Economic Area (“EEA”), the United Kingdom or Switzerland. It explains what personal data we collect about you, why we collect it, on what legal basis we process it, with whom we share it, how long we keep it and what rights you have.
We process your personal data in accordance with Regulation (EU) 2016/679 (the “GDPR“), the UK GDPR and the Data Protection Act 2018 where applicable, the Swiss Federal Act on Data Protection where applicable, and the national laws implementing Directive 2002/58/EC (the “ePrivacy Directive“) in relation to cookies.
Because we are established in Türkiye, we also process personal data in accordance with Turkish Law No. 6698 on the Protection of Personal Data. A separate Privacy Notice and Cookie Policy applies to visitors located in Türkiye. Where both texts apply to you, whichever provides the higher level of protection prevails.
The Site is a business-to-business information and promotional website. It does not sell products online, does not accept orders and does not process payment card data. It is not directed at children and we do not knowingly collect personal data from persons under 16.
2. Who We Are and How to Reach Us
Normactive Kozmetik San. ve Tic. Ltd. Şti. is the controller of the personal data described in this Policy. You can reach us at info@normactive.com or at the postal address above.
Where Article 27 GDPR requires it, we appoint a representative established in the European Union to act as an additional point of contact for data subjects and supervisory authorities. The identity and contact details of our EU representative are published in this section as soon as the appointment takes effect. Appointing a representative does not affect our own liability as controller.
We have not appointed a Data Protection Officer, as our processing does not meet the criteria set out in Article 37 GDPR. All privacy enquiries are handled at the address above.
3. Personal Data We Collect
3.1. Information you provide to us
| Context | Personal data |
|---|---|
| Contact form | Name and surname, e-mail address, telephone number, the content of your message, and the submission metadata (date, time, IP address) |
| Newsletter subscription | Name and surname, e-mail address, company name, country, consent record (date, time, IP address), and your interaction with the messages we send (delivery, opening, clicks) |
| Distributor account | Company name, country, name and surname of the authorised person, corporate e-mail address, telephone number, account credentials, login and logout records, and records of documents viewed or downloaded |
| Correspondence | Any information you choose to include when you write to us by e-mail or post |
3.2. Information collected automatically
When you visit the Site, our hosting provider generates server log records containing your IP address, the date and time of access, the pages requested and technical session information. Where you consent to it, we also collect data through analytics and marketing cookies and similar technologies: cookie and advertising identifiers, device and browser characteristics, pages viewed, time spent, click-stream and interaction data. Section 5 and the Annex describe the cookies we use.
We do not collect special categories of personal data within the meaning of Article 9 GDPR through the Site, and we do not ask you to provide any.
4. Purposes and Legal Bases
| Purpose | Personal data | Legal basis |
|---|---|---|
| Responding to enquiries submitted through the contact form and keeping a record of the correspondence | Contact form data | Art. 6(1)(f) – our legitimate interest in responding to business enquiries and evidencing our communications; Art. 6(1)(b) where your enquiry relates to steps taken at your request prior to entering into a contract |
| Operating the distributor login area and managing the distributorship relationship | Distributor account data, access and download records | Art. 6(1)(b) – performance of a contract with you or with the company you represent; Art. 6(1)(f) – our legitimate interest in securing the portal and evidencing transactions |
| Sending our newsletter and other marketing communications | Newsletter data | Art. 6(1)(a) – your consent; Art. 13 ePrivacy Directive as implemented nationally |
| Keeping the Site available, secure and functional; detecting and preventing fraud, abuse and unauthorised access | Server log records, strictly necessary and functional cookies | Art. 6(1)(f) – our legitimate interest in network and information security and in the proper operation of the Site |
| Measuring and improving how the Site is used; measuring the effectiveness of our advertising | Analytics and marketing cookie data | Art. 6(1)(a) – your consent, and consent under the national law implementing Art. 5(3) ePrivacy Directive |
| Complying with legal obligations and establishing, exercising or defending legal claims | Any of the above, as relevant | Art. 6(1)(c) where a Union or Member State legal obligation applies; otherwise Art. 6(1)(f) – our legitimate interest in complying with the law applicable to us and in defending our rights |
Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your interests or fundamental rights and freedoms. You may request further information about that assessment, and you may object to the processing, as described in section 9.
Turkish law requires us to retain certain traffic records. Because a Turkish legal obligation is not a Union or Member State obligation within the meaning of Article 6(1)(c) GDPR, we rely on Article 6(1)(f) for that processing, on the basis of our legitimate interest in complying with the law of the country in which we are established and in maintaining the security of the Site.
5. Cookies and Similar Technologies
Strictly necessary cookies are placed without your consent because they are essential for the Site to function and for its security. All other cookies — functional, analytics and marketing — are placed only after you give your consent through the cookie banner displayed when you first visit the Site.
You can accept all cookies, reject all non-essential cookies, or make a category-by-category choice. Rejecting is as easy as accepting, and refusing consent does not restrict your access to the Site. You may change or withdraw your choice at any time through the “Cookie settings” link in the footer of the Site. Where you do not renew it, your consent is treated as expiring after six months and you will be asked again.
The Annex to this Policy lists the cookies used, their provider, purpose, duration and the country in which the relevant servers are located.
6. Who We Share Your Personal Data With
We do not sell your personal data. We share it only with:
- our hosting and domain provider and the software agency that develops and maintains the Site, acting as processors on our instructions;
- Google, for website analytics and tag management, where you have consented;
- Meta, for advertising measurement, where you have consented;
- Intuit Mailchimp, for the dispatch of our newsletter, where you have subscribed;
- our professional advisers, including lawyers and auditors, where necessary;
- competent public authorities and courts, where we are legally required to do so or where it is necessary to establish, exercise or defend legal claims.
Each processor acts under a written contract that meets the requirements of Article 28 GDPR.
7. International Transfers
7.1. Transfers to Turkey
We are established in Turkey and personal data collected through the Site is accessed and stored there. Where you provide your personal data to us directly through the Site, that collection is not a transfer within the meaning of Chapter V GDPR, because there is no exporter established in the EEA; we are subject to the GDPR directly under Article 3(2) and we apply it in full to that processing.
Where personal data is instead made available to us by a party established in the EEA — for example by an EEA distributor or an EEA-based service provider acting on our behalf — that disclosure is a transfer under Chapter V. The European Commission has not adopted an adequacy decision in respect of Türkiye, and we therefore carry out such transfers on the basis of the Standard Contractual Clauses adopted in Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum where the UK GDPR applies, supported by a transfer impact assessment and by the measures described in section 8.
7.2. Onward transfers to the United States
Where you consent to analytics and marketing cookies or subscribe to our newsletter, personal data is also processed by providers in the United States. Where the relevant provider is certified under the EU-US Data Privacy Framework (and its UK Extension and the Swiss-US framework, as applicable), we rely on that certification; otherwise, and in all cases as a fallback, we rely on the Standard Contractual Clauses.
7.3. Obtaining a copy of the safeguards
You may request a copy of the safeguards we rely on, with commercially confidential information redacted, by writing to info@normactive.com.
8. Security
We take appropriate technical and organisational measures to protect your personal data, including transport encryption (TLS), role-based access control and access logging, credential management for distributor accounts, network security, firewall, anti-malware and back-up systems, contractual confidentiality and data protection commitments with our service providers, staff awareness training, and documented retention and deletion procedures. No system can be guaranteed to be completely secure, but we review these measures regularly.
9. Retention
| Personal data | Retention period |
|---|---|
| Server log and traffic records | One year from creation |
| Contact form records | Two years after the enquiry is closed, and thereafter until the applicable limitation period expires |
| Newsletter data and consent records | Until you unsubscribe; consent and objection records are kept for a further three years as evidence |
| Distributor account, access and download records | For the duration of the commercial relationship and ten years thereafter |
| Cookie data | As set out in the Annex |
| Records of consent given through the cookie banner | For as long as the consent is valid and thereafter until the applicable limitation period expires |
At the end of the applicable period we delete or irreversibly anonymise the data.
10. Your Rights
Subject to the conditions and exceptions in the GDPR, you have the right to:
- access your personal data and obtain a copy of it (Art. 15);
- have inaccurate personal data rectified and incomplete data completed (Art. 16);
- have your personal data erased (Art. 17);
- obtain restriction of processing (Art. 18);
- receive your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller, where the processing is based on consent or contract and is carried out by automated means (Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21(1)), and to object at any time and without giving reasons to processing for direct marketing purposes, including profiling related to it (Art. 21(2));
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3));
- lodge a complaint with a supervisory authority (Art. 77).
You are not subject to any decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.
To exercise any of these rights, write to info@normactive.com. We respond within one month of receipt; that period may be extended by two further months where necessary, in which case we will tell you within the first month. We do not charge a fee unless your request is manifestly unfounded or excessive. We may ask you for information to confirm your identity.
You may complain to the supervisory authority of the Member State of your habitual residence, place of work or the place of the alleged infringement. In the United Kingdom, the competent authority is the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.
11. Consequences of Not Providing Personal Data
Providing personal data is voluntary. If you do not complete the contact form we cannot respond to your enquiry; if you do not provide the data needed for a distributor account we cannot grant you access to the restricted area. Refusing analytics and marketing cookies or the newsletter has no consequence for your use of the Site.
12. Changes to this Policy
We may update this Policy where our processing, the technologies we use or the applicable law change. The current version, together with its effective date, is always published on the Site. Where a change requires your consent, we will ask for it again.
13. Contact
Normactive Kozmetik San. ve Tic. Ltd. Şti., Alsancak Mah. Kıbrıs Şehitleri Cad. No: 24/12, 35220 Konak / İzmir – Türkiye. E-mail: info@normactive.com.
Annex – Cookies Used on the Site
| Cookie / technology | Provider – server location | Category | Purpose | Duration |
|---|---|---|---|---|
| Session cookie | Normactive (first party) – Türkiye | Strictly necessary | Maintains session continuity while you browse | Session |
| Cookie preference cookie | Normactive (first party) – Türkiye | Strictly necessary | Stores the choice you make on the cookie banner | 6 months |
| Security and load-balancing cookies | Normactive and hosting provider – Türkiye | Strictly necessary | Security checks, abuse detection, distribution of server load | Session – 12 months |
| Language / preference cookie | Normactive (first party) – Türkiye | Functional (consent) | Stores your language and display preferences | 12 months |
| Google Tag Manager | Google – USA | Tag management (consent) | Deploys the tags below; does not itself set cookies | – |
| _ga, _ga_<container id> | Google Analytics – USA | Analytics (consent) | Distinguishes visitors and produces traffic statistics | 24 months |
| _gid | Google Analytics – USA | Analytics (consent) | Distinguishes visitors on a daily basis | 24 hours |
| _fbp | Meta – USA | Marketing (consent) | Measures advertising performance and attributes visits | 180 days |
| fr | Meta – USA | Marketing (consent) | Advertising delivery and measurement | 90 days |
Effective date: 30 July 2026