[Company Name / Brand] Personal Data Policy

General Information about the Personal Data Law

Law No. 6698 on the Protection of Personal Data (hereinafter referred to as KVKK) was adopted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. Part of the KVKK came into effect on the publication date, and the remaining part on October 7, 2016.

Information as a Data Controller

Pursuant to Law No. 6698 KVKK and as the Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties when permitted by legislation, classified, and processed in the manners listed in the KVKK within the framework explained on this page.

How Your Personal Data May Be Processed

According to Law No. 6698 KVKK, the personal data you share with our Company may be processed by us, wholly or partly, automatically or by non-automatic means as part of any data recording system, including obtaining, recording, storing, altering, rearranging—in short, subject to any processing performed on the data. Any operation performed on data under KVKK is considered "processing of personal data."

Purposes and Legal Reasons for Processing Your Personal Data

The personal data you share will be processed in compliance with Law No. 6698 KVKK and related secondary regulations for purposes including:

• To perform the requirements of the services we provide to our customers in accordance with the contract and technological necessities and to improve the products and services offered;
  
  
• To record identification, address, and other necessary information to identify the data subject under the Law No. 6563 on the Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, and related regulations published in the Official Gazette dated 26.08.2015 No. 29457, the Regulation on Electronic Commerce Service Providers and Intermediary Service Providers, the Regulation on Distance Contracts published in the Official Gazette dated 27.11.2014 No. 29188, and other relevant legislation;
  
  
• To organize all records and documents that will serve as a basis for transactions in the banking and electronic payment sectors, electronic contracts, or paper-based; to comply with legal obligations and reporting, information duties prescribed by authorities;
  
  
• To provide information to prosecutors, courts, and relevant public officials if requested and as required by law in matters concerning public security and legal disputes;

Information About Third Parties to Whom Your Personal Data May Be Transferred: For the purposes outlined above, the persons/entities to whom your personal data shared with our Company may be transferred include, primarily, IdeaSoft Yazılım San. ve Tic. A.Ş., which provides our e-commerce infrastructure, suppliers, cargo companies, and other persons and entities related to the services offered, partner companies with whom we cooperate as Data Processors, domestic/foreign institutions, and other third parties.

How Your Personal Data Are Collected

Your personal data are collected in the following ways:

• Through forms on our Company's website and mobile applications containing information such as name, surname, Turkish ID number, address, phone number, business or personal email addresses; preferences on pages accessed with username and password, IP logs of performed transactions, cookie data collected by browser including browsing duration and details, and location data;

• Verbally, in writing, or electronically via sales and marketing department staff, our branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call centers;

• From individuals sharing their personal data for the purposes of establishing a commercial relationship with our Company, job applications, submitting offers, via business cards, resumes (CVs), proposals, and other means, whether in physical or virtual environments, face-to-face or remote, verbally or in writing, or electronically;

• Additionally, indirectly obtained data from different channels such as websites, blogs, contests, surveys, games, campaigns, micro websites used for similar purposes, social media, e-newsletter reading or clicking activities, public databases, and publicly shared profiles and data on social media platforms can be processed and collected.

Your Personal Data Obtained Before the KVKK Became Effective

Your personal data lawfully obtained before the effective date of KVKK on April 7, 2016, through memberships, electronic communication permissions, product/service purchases, and other means are also processed and preserved according to the terms and conditions set out in this document.

Transfer of Your Personal Data Abroad

Your personal data collected by any of the methods listed above, processed in Turkey or processed and stored abroad, may be transferred to service intermediaries located abroad (in countries accredited by the Personal Data Protection Board and having sufficient protection for personal data) provided they remain under the scope of KVKK and for contractual purposes.

Storage and Protection of Personal Data

Your personal data shall be kept confidential in databases and systems held by our Company in accordance with Article 12 of KVKK; aside from legal obligations and the arrangements stated in this document, they shall not be shared with third parties. Our Company is obliged to take software measures such as access management and physical security measures to prevent unlawful processing of personal data, prevent unauthorized access, according to Article 12 of KVKK. If it is learned that personal data has been unlawfully obtained by others, the situation will be immediately reported in writing to the Personal Data Protection Board in accordance with legislation.

Keeping Personal Data Accurate and Up-to-Date

Our Company is responsible for keeping your personal data accurate and up-to-date according to Article 4 of KVKK. In this context, our Customers are required to share correct and current data or update it via the website/mobile application to enable our Company to fulfill its obligations under applicable legislation.

Rights of the Personal Data Owner under Law No. 6698 KVKK

Article 11 of Law No. 6698 KVKK became effective on October 7, 2016, and pursuant to this article, the rights of the Personal Data Owner after this date are as follows: The Personal Data Owner can apply to our Company (data controller) to:

1. Learn whether personal data is processed,
2. Request information if personal data has been processed,
3. Learn the purpose of processing personal data and whether it is used in accordance with its purpose,
4. Know the third parties to whom personal data is transferred domestically or abroad,
5. Request correction of incomplete or inaccurate personal data,
6. Request deletion or destruction of personal data under the conditions prescribed in Article 7 of KVKK,
7. Request that the operations of correction, deletion, or destruction be notified to the third parties to whom personal data has been transferred,
8. Object to results that arise against the person by exclusively analyzing processed data through automatic systems,
9. Request compensation for damages in case of losses due to unlawful processing of personal data,