Privacy Notice

This notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data, in order to inform visitors to the myaromex.com website.

The findings set out here are based on an inspection of the live website and of the tag manager container running on it, carried out on 4 September 2026. No measurement tool or data collection point other than those listed here was identified.

1. Data controller

• Data controller: Esin Deniz, sole proprietorship
• Brand and website: Aromex, myaromex.com
• Line of business: 479114, retail trade over the internet
• Tax office: Başakşehir Vergi Dairesi Müdürlüğü
• Tax identification number: 2911234592
• Business address: Bahçeşehir 1. Kısım Mah. Cenk Koray Cad. Akasya 02.04 Sitesi C2 Blok No: 11 İç Kapı No: 12 Başakşehir / İstanbul
• E-mail: info@myaromex.com
• WhatsApp link: wa.me/905304265799

Aromex is the brand name used in the commercial activity carried out by Esin Deniz. References in this notice to our business mean the Esin Deniz sole proprietorship.

2. Personal data processed

2.1. Data processed automatically, without you entering anything

• The address of the page you visit
• Page view and on-site interaction data
• The contact link click event
• Event name and event ID
• Cookie identifiers: on the Meta side _fbp and, where present, _fbc; on the Google Analytics side its own cookies
• Your IP address
• Your browser identification string, technically known as the user agent

These records do not contain your name, telephone number or e-mail address. They consist of identifiers generated at browser and device level. The IP address, the browser identification string and cookie identifiers qualify as personal data.

2.2. Data processed if you contact us

• If you write to us over the WhatsApp link, your telephone number and the content of your message reach our business.
• If you call us using the telephone link, the information you choose to share during that call reaches our business.
• If you write to us using the e-mail link, the information you choose to share in that message reaches our business.

You decide what information to share through these channels. You are not required to share information that is not necessary for your request to be handled.

2.3. Data that is not collected through the website

• None of the site's eight pages contains a form.
• There is no field on the site where you could enter information such as a name, telephone number, e-mail address or postal address.
• For this reason, unless you contact us yourself, no information that directly identifies you reaches our business.

3. Collection method

• Data arising from a site visit is collected electronically and by fully automated means, through the tag manager, the measurement tags and cookies.
• The IP address and the browser identification string are processed server-side together with the request itself, independently of any cookie.
• Data you send us through the contact channels is collected by partially automated means, via WhatsApp, telephone and e-mail.
• The following tools run on the site.

- Google Tag Manager, container ID GTM-NXV9G7SF. This is the tag manager that loads the other measurement tools onto the site.

- Google Analytics 4, measurement ID G-N2X3P7TV7B. It collects page view and on-site interaction data.

- Meta Pixel, pixel ID 1375195121462015. It sends the page view event and the contact link click event.

- Server-side bridge. The event generated by the site is sent to a server endpoint operating on behalf of myaromex.com. This endpoint is aromex-capi.vercel.app, runs on Vercel infrastructure, and forwards the event to the Meta Conversions API.

- Website hosting is provided by the Natro JetSite service. Its infrastructure is provided by Webnode.

• The fields carried by the server-side bridge are exactly the following: event name, event ID, page address, the _fbp cookie in your browser and, where present, the _fbc cookie. The server adds the IP address of the request and the browser identification string to these. No data outside this list is passed to the bridge.

4. Purposes of processing

• Keeping the site operational and displaying it to you
• Measuring how often pages are viewed and understanding how the site is used
• Measuring the results of advertising activity, preventing the same event from being counted twice, and evaluating advertising performance
• Handling your contact requests and answering your questions and product enquiries
• Managing the relationship established at your request
• Fulfilling obligations arising from legislation and providing information to authorised public institutions and organisations where requested

5. Legal grounds

Your personal data is processed on the grounds set out in Article 5 of the Law.

• For hosting the site and displaying it to you, the legitimate interest of the data controller under Article 5/2-f.
• For information you send through the contact channels: where your request concerns a purchase, direct relation to the establishment or performance of a contract under Article 5/2-c; in all other cases, legitimate interest under Article 5/2-f.
• Where legislation requires records to be kept or information to be provided, compliance with a legal obligation under Article 5/2-ç.
• In the event of a dispute, the establishment, exercise or protection of a right under Article 5/2-e.

The position regarding measurement and advertising cookies, and the processing carried out through them, is as follows.

• These cookies are not strictly necessary for the site to function. For them, the Law requires processing based on explicit consent.
• The cookie banner on the site offers four categories: Essential cookies, Functional cookies, Performance cookies, and Marketing / third party cookies. Essential cookies are mandatory and cannot be switched off. The other three categories are off by default; the visitor switches them on and off individually and saves that choice.
• The Meta Pixel tag depends on the ad_storage and ad_user_data permissions. As long as these permissions are not granted, the tag does not load, no request is sent to Meta, and the _fbp cookie is not created.
• This processing therefore rests on the explicit consent the visitor gives through the choice made on the cookie banner. Unless consent is given, no measurement or advertising cookies are created.
• If you do not want these cookies, you can delete or block them from your browser settings. For details, see the Aromex Cookie Policy. You may also submit a request through the application channels set out in section 12.

6. Cookies and consent state

• The tags on the Google side are configured so that the consent state is treated as denied by default. The permissions that start out as denied are: ad_storage, analytics_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage.
• These permissions can be switched on and off category by category from the banner's advanced panel. When the choice is saved, the relevant permissions are updated.
• When consent is given to the Performance cookies category, the analytics_storage permission moves to the granted state. When consent is given to the Marketing / third party cookies category, the ad_storage, ad_user_data, ad_personalization and personalization_storage permissions also move to the granted state.
• The Meta Pixel tag depends on the ad_storage and ad_user_data permissions. As long as these permissions are not granted, the tag does not load, no request is sent to Meta, and the _fbp cookie is not created.
• In the measurement carried out on 4 September 2026, it was observed that when consent was given only to the Performance cookies category, the Google Analytics cookies were created, no request whatsoever was sent to Meta, and the _fbp cookie was not created.
• All cookies, and what you can do on the browser side, are described in detail in the Aromex Cookie Policy.

7. Parties to whom personal data is transferred and the purpose of transfer

• Google. Within the scope of the Google Tag Manager and Google Analytics 4 services, for tag management and for measuring and reporting site usage.
• Meta. Within the scope of the Meta Pixel and the Meta Conversions API: event name, event ID, page address, the _fbp and, where present, _fbc cookie values, IP address and browser identification string, for the purpose of measuring advertising results. If you choose to use the WhatsApp link, your correspondence takes place over Meta's messaging service.
• Vercel. As the infrastructure provider on which the server-side bridge runs, for the purpose of transmitting event data to Meta.
• Natro JetSite and its infrastructure provider Webnode. For the purpose of hosting the site and displaying it to you.
• Authorised public institutions and organisations. Where required by legislation and limited to the scope requested.

Your personal data is not transferred to third parties other than those listed above, is not sold, and is not assigned for the marketing activity of any other business.

8. Processing abroad

• The providers listed above are international service providers. It is possible that your data is processed abroad within the scope of these services.
• As our business has no verified information about the countries in which these providers' servers are located, no country or region is named here.
• The conditions set out in Article 9 of the Law apply to transfers abroad. Any transfer is limited to the purposes listed in this notice and to the scope necessary for the relevant service to function.

9. Retention period

• Your personal data is retained for as long as the purpose of processing requires, and for as long as the statutory limitation periods and retention obligations laid down in the relevant legislation require.
• When the purpose ceases to exist and the legal ground requiring retention comes to an end, the data is deleted, destroyed or anonymised.
• For cookies, the period is limited to the lifetime set by the tool that created the cookie. You can delete cookies from your browser at any time.
• Retention periods within the systems of providers such as Google and Meta are subject to their own policies.

10. Your rights under Article 11 of the Law

• To learn whether your personal data is being processed
• To request information about it if it has been processed
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom your data is transferred
• To request correction if the data has been processed incompletely or inaccurately
• To request deletion or destruction within the conditions laid down in Article 7 of the Law
• To request that correction, deletion and destruction operations be notified to the third parties to whom your data has been transferred
• To object to an outcome to your detriment arising from the analysis of processed data exclusively by automated systems
• To claim compensation for damage suffered as a result of unlawful processing

11. Explicit consent and withdrawal of consent

• Informing you and obtaining explicit consent are two separate matters. This notice exists to inform you; on its own it does not constitute consent.
• Where processing is based on explicit consent, you may withdraw your consent at any time. Withdrawal takes effect prospectively and does not affect processing carried out up to the date of withdrawal.
• You can submit a request to withdraw consent through the application channels set out in section 12.
• You can manage your cookie preferences category by category from the advanced settings screen of the cookie banner, and withdraw the consent you have given from there. You can also delete or block cookies from your browser settings.

12. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your requests as follows.

• A written application bearing a wet signature, delivered in person, through a notary or by post to the address Bahçeşehir 1. Kısım Mah. Cenk Koray Cad. Akasya 02.04 Sitesi C2 Blok No: 11 İç Kapı No: 12 Başakşehir / İstanbul.
• A message signed with a secure electronic signature or mobile signature, sent to info@myaromex.com.
• A message sent from the e-mail address you have previously notified to our business and which is registered in our system, sent to info@myaromex.com.

Your application must include the following.

• Name, surname and, if the application is in writing, your signature
• For citizens of the Republic of Türkiye, the national identity number; for foreign nationals, nationality, passport number or identity number, if any
• Residential or business address for the purposes of notification
• E-mail address, telephone and fax number for notification, if any
• The subject of your request, together with related information and documents

Where we cannot confirm that the application was made by you, we may ask for additional information to verify your identity. That information is used solely for identity verification.

Your application is concluded as soon as possible depending on its nature, and in any case within thirty days of it reaching us. Applications are free of charge as a rule. Where the process incurs an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected, if you find the response insufficient, or if no response is given within the time limit, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the date of application.

13. Data security and breach notification

• Under Article 12 of the Law, it is our obligation to take the necessary technical and administrative measures to prevent the unlawful processing of personal data and unlawful access to it.
• Where it is established that personal data has been unlawfully obtained by others, notification is made to the data subject and to the Personal Data Protection Board under Article 12 of the Law.

14. Related documents

• Aromex Privacy Policy. Describes the tools running on the site and the data flow in detail.
• Aromex Cookie Policy. Describes the cookies, the consent state and what you can do on the browser side.

These three documents complement one another and are published at myaromex.com.

15. Updates to this notice

• This notice is updated if there is a change in the tools used on the site or in the processing activities.
• The current version is always published at myaromex.com. The version in force is the version published on the site.

Last updated: 4 September 2026