As OZAN DEMİRBAŞ, we highly value the privacy and security of the personal data and information of our customers, employees, job candidates, and all business partners. Therefore, in accordance with Law No. 6698 on the Protection of Personal Data, we would like to inform you about the reasons for processing your personal data, its legal basis, the method of collection, and your rights under the relevant law. Additionally, we aim to fulfill our obligation to provide clarification as the Data Controller, OZAN DEMİRBAŞ ("OZAN DEMİRBAŞ").

1. To whom is this notice addressed as OZAN DEMİRBAŞ?
First of all, we would like to state that your personal data may be processed by OZAN DEMİRBAŞ in accordance with the provisions of Law No. 6698 on the Protection of Personal Data, based on your explicit consent. Additionally, we would like to remind you that in cases covered by Article 5/2 of the Law on the Protection of Personal Data, obtaining consent from individuals is not required.

In accordance with Article 10 of Law No. 6698, this notice is addressed to all users who connect to/use the e-commerce channels of ozandemirbas.com; those who connect to the guest network (Wi-Fi) in OZAN DEMİRBAŞ offices, warehouses, and stores; all users of OZAN DEMİRBAŞ mobile applications; all customers in the OZAN DEMİRBAŞ database (CRM System); customers who shop at OZAN DEMİRBAŞ stores or through ozandemirbas.com e-commerce channels, as well as all users who connect to/use these channels; those who use any of the communication options available on ozandemirbas.com; individuals who visit OZAN DEMİRBAŞ stores for any purpose; customers who contact OZAN DEMİRBAŞ through its social media accounts (including but not limited to commenting, making requests, etc.); participants in competitions organized by OZAN DEMİRBAŞ; customers who fill out surveys or forms to take advantage of the opportunities offered by OZAN DEMİRBAŞ; holders of all customer loyalty cards issued/to be issued by OZAN DEMİRBAŞ, including but not limited to OZAN DEMİRBAŞ Customer Loyalty Cards, and individuals who fill out surveys or forms for the use of these cards; job applicants who submit resumes via career portals, İŞKUR, email, Facebook, Instagram, and/or other social media platforms, through a reference, or by physically filling out an application form; employees currently working at OZAN DEMİRBAŞ; former employees who previously worked at OZAN DEMİRBAŞ but whose employment contracts have ended for any reason; all business partners within the scope of our commercial activities and their employees; and, without limitation to the above, all natural persons who have shared/will share their personal data with OZAN DEMİRBAŞ face-to-face, remotely, verbally, in writing, or electronically, have directly provided/will provide their personal data, or have enabled/will enable OZAN DEMİRBAŞ to obtain their personal data.

The information of our customers who register and/or update their records through all OZAN DEMİRBAŞ billing systems and other platforms (OZAN DEMİRBAŞ e-commerce channels, ozandemirbas.com customer information update screen) is stored within our accounting infrastructure, ERP enterprise resource planning application, and reporting systems in a manner accessible only to authorized personnel.

These records can be accessed through various corporate applications when necessary, allowing data to be queried based on different criteria. The points and discounts offered to our customers during payment are also provided by accessing this data.

No customer data and/or data related to the legal entities we collaborate with are shared with any third-party company. For all third-party companies that may access this data in any way, security and confidentiality agreements are established to ensure that the data is protected in accordance with the relevant legal regulations.

2. What does the processing of your personal data mean?
The processing of personal data refers to any operation performed on such data, whether fully or partially automated or carried out by non-automated means as part of a data recording system. This includes obtaining, collecting, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data.

3. For what purposes and on what legal grounds do we process your personal data?
All types of personal data collected directly or indirectly within OZAN DEMİRBAŞ and varying depending on the services provided, commercial activities, and legal requirements will be processed in accordance with the purpose of collection. All personal data obtained directly or indirectly from the aforementioned individuals will be processed as follows:

a) To verify the identity information of those shopping on ozandemirbas.com and/or OZAN DEMİRBAŞ e-commerce channels; to provide necessary notifications to fulfill all contractual obligations, including but not limited to distance sales contracts and contracts required under the Consumer Protection Law; to fulfill commitments;
b) To provide information to all public officials upon request and in accordance with the legislation, particularly in matters related to public security and in response to requests from Civil and Criminal Courts;
c) To use in all marketing activities of OZAN DEMİRBAŞ, primarily to inform about special and general campaigns (such as promotions, advertisements, discounts, and other advantages) organized by OZAN DEMİRBAŞ;
d) To recognize customers who shop from stores, the website, and/or mobile applications and conduct marketing activities accordingly;
e) To use in various marketing and advertising activities and, in this context, to conduct marketing activities, surveys, and market analyses electronically and/or physically through contracted institutions;
f) To evaluate and report customer complaints and suggestions regarding our services, and to share data with our business partners within the scope of marketing activities;
g) To fulfill legal obligations and exercise our rights arising from the applicable legislation;
h) To transfer data to third-party individuals and companies (contracted business partners) from whom we receive services to fulfill legal obligations;
i) To store in data records for the fulfillment of contractual obligations (such as product delivery);
j) To store contact information in data records to remind customers of their rights against OZAN DEMİRBAŞ;
k) To recruit employees, manage, and improve the recruitment processes in line with OZAN DEMİRBAŞ's human resources policies and needs;
l) To evaluate job applications, finalize them, and contact job applicants;
m) To evaluate the performance of our employees to implement our human resources policy and assess, improve, and enhance this policy and our services.

OZAN DEMİRBAŞ stores, headquarters, and warehouses are monitored by security cameras to ensure the safety of our customers, job applicants, and employees. Therefore, we would like to inform you that individuals visiting our stores, headquarters, and warehouses may occasionally have their images recorded by security cameras. Additionally, in compliance with legal regulations and for the purpose of ensuring public security, these recordings may be shared with public officials upon request, particularly from administrative and judicial authorities.

We would like to inform you, our job applicants who have sent their resumes to OZAN DEMİRBAŞ for the purpose of applying for a job through the methods mentioned above, that the resumes and the information collected at the time of application may be used for evaluation purposes for the positions they have applied for or for potential future positions. Additionally, this information may be stored in the HR records of OZAN DEMİRBAŞ. We also want to clarify that the personnel files of our current employees and former employees who have worked at OZAN DEMİRBAŞ are kept in accordance with our legal obligations and are stored within OZAN DEMİRBAŞ as part of this process.

We would also like to state that personal data of all our business partners and their employees, who benefit from the protection of the Personal Data Protection Law within the scope of our commercial activities, may be processed by OZAN DEMİRBAŞ for the purpose of fulfilling contractual obligations during and after the continuation of the commercial relationship, as part of OZAN DEMİRBAŞ’s customer portfolio. All of the personal data, as detailed above, will be processed in compliance with the basic principles set forth by the KVKK (Personal Data Protection Law), as well as in accordance with the personal data processing conditions and purposes outlined in Articles 4, 5, and 6 of the KVKK. This processing is carried out in accordance with all relevant legal regulations, including the Turkish Code of Obligations No. 6098, the Law on the Protection of Consumers No. 6502, the Labor Law No. 4857, the Law on Regulation of Electronic Commerce No. 29166, and the regulations established under these laws, all for the aforementioned purposes.

4. Who may we transfer your personal data to for the purposes mentioned?
First and foremost, we would like to state that your personal data will not be shared with third parties without obtaining your explicit consent.
However, we would like to inform you that we are obligated to share your personal data in certain situations due to legal requirements. For example, we may share your personal data upon request from judicial authorities or public institutions, as required by law. Additionally, for the purpose of fulfilling our legal obligations, we may transfer your personal data to contracted business partners solely for this purpose. Furthermore, in order to fulfill our contractual obligations with you, your personal data may be shared with third parties we have agreements with. Before making such transfers, we take technical and legal measures to prevent any rights violations for both you and us. However, we would like to clarify that we are not responsible for any violations that may occur under the responsibility of the third party with whom we share the data.

Furthermore, your personal data may be transferred to our business partners, suppliers, service providers, Group Companies, company executives, shareholders, legally authorized public institutions, and private individuals for the purposes of ensuring the legal and commercial security of those involved with OZAN DEMİRBAŞ, conducting audits, administrative operations, evaluation processes of business partners/customers/suppliers (authorized persons or employees), and the implementation of OZAN DEMİRBAŞ’s human resources policies. This transfer will be carried out in accordance with the personal data processing conditions and purposes outlined in Articles 8 and 9 of the KVK Law (Personal Data Protection Law).

In order to provide you with better service and within the scope of various marketing activities related to product groups of interest, your personal data may be shared with agencies, advertising companies, survey companies, other third parties, and relevant business partners.

We would also like to inform you that, upon request from third-party company representatives, your information may be shared for reference purposes in relation to former employees who have previously worked at OZAN DEMİRBAŞ.

In accordance with the KVKK and the 1st and 3rd Articles mentioned above, your personal data collected may be transferred in compliance with the basic principles set forth by the KVKK, and within the personal data processing conditions and purposes outlined in Articles 8 and 9 of the KVKK, as well as for the purposes stated above.

Additionally, personal data may be transferred abroad by OZAN DEMİRBAŞ for the purposes mentioned above.

• If the data subject's explicit consent is obtained, or...
• In cases where the data subject's explicit consent is not obtained, but one or more of the other conditions mentioned above are met;
• If adequate protection is provided in the country to which the data is transferred, and...
• In the event that adequate protection is not available in the country to which the data is transferred, the relevant data controller in the foreign country, along with OZAN DEMİRBAŞ, may transfer the data, provided that they commit to ensuring adequate protection in writing and obtain approval from the Personal Data Protection Board.

5. How do we collect your personal data?
Personal data is collected for the purposes mentioned above, not limited to the following methods: through fully or partially automated means, or non-automated methods as part of a data recording system. This data can be obtained and collected verbally, in writing, or electronically through OZAN DEMİRBAŞ's offices, stores, workplaces, website, mobile applications, social media channels, cameras, and other similar means. Below are examples for illustrative purposes:

• Call Center: The information of all individuals who contact us by calling our customer line at OZAN DEMİRBAŞ (+90 212 282 92 09) may be processed for the purposes mentioned above, subject to the limitation of those purposes.
• OZAN DEMİRBAŞ E-Commerce Channels: Through our website, all customers can contact OZAN DEMİRBAŞ or apply for membership if they wish. Additionally, ozandemirbas.com is a site that uses cookies. Cookies are small text files that are saved to your hard drive when you download a file or visit a website. In other words, they are files created by websites you've previously visited to store browsing information, such as your website preferences or profile information. Therefore, cookies are used to provide you with better service, share campaign information related to product groups you're interested in, and offer product promotions.
• ik@ozandemirbas.com or by directly applying to the OZAN DEMİRBAŞ Headquarters: proje@ozandemirbas.com is our written communication channel that allows customers to contact OZAN DEMİRBAŞ via email. All information of individuals who contact us through this channel will be stored for the purpose of communication. The information of all individuals who contact OZAN DEMİRBAŞ either physically (Headquarters) or remotely (phone: +90 212 282 92 09) will also be stored for the purpose of maintaining communication.
• All OZAN DEMİRBAŞ stores, central offices, and warehouses: The images of all visitors and employees recorded by security cameras will be stored. Additionally, the personal information of individuals visiting our stores, central offices, and warehouses may be processed for the purposes mentioned above, subject to the limitation of those purposes.
• Job Applications: Personal data related to job applications is collected through career portals, email, İŞKUR, references, or by physically filling out an application form.

6. What are your rights under Article 11 of the Personal Data Protection Law?
You can exercise your rights by applying to OZAN DEMİRBAŞ through the communication channels provided below and on the ozandemirbas.com website:

You have the right to learn whether your personal data is being processed, the purpose of processing, and whether it is being used in accordance with that purpose. You can also learn about the third parties to whom your data has been transferred, both domestically and abroad, and request information about the processed data. If any incorrect or incomplete processing is identified, you may request correction and, in this context, request that the third parties to whom your personal data has been transferred be informed of the correction. Additionally, upon your request and without the need to provide any justification, your personal data can be deleted, destroyed, or anonymized. However, we would like to remind you that personal data that we are required by law to retain due to legal obligations cannot be deleted, destroyed, or anonymized. Furthermore, even if your personal data has been processed in accordance with the KVKK and relevant laws, you have the right to request its deletion or destruction, and for the related actions to be communicated to the third parties to whom your data has been transferred, if the reasons for processing no longer exist. You also have the right to object to the processing of your data in such a way that a result is produced solely through automated systems, leading to an unfavorable outcome for you. If you believe that your personal data has been processed unlawfully and that you have suffered damage as a result, we would like to inform you that you also have the right to take legal action against OZAN DEMİRBAŞ.

In accordance with Article 13, Paragraph 1 of the Personal Data Protection Law, you can submit your request to exercise the rights mentioned above in writing or through other methods specified by the Personal Data Protection Board. In this context, the channels and procedures through which you can submit your written request in accordance with Article 11 of the Personal Data Protection Law are explained below. Your applications will be processed by OZAN DEMİRBAŞ within the legal timeframe set by the KVKK, and you will be informed regarding the outcome of your application.

Article 28, Paragraph 2 of the Law lists situations where data subjects do not have the right to request. In this context;

• The processing of personal data being necessary for the prevention of a crime or for a criminal investigation,
• The processing of personal data that has been made public by the data subject themselves,
• The processing of personal data being necessary for the execution of supervision or regulatory duties by authorized public institutions and organizations or professional organizations with the status of public institutions, based on the authority granted by law, or for disciplinary investigations or prosecutions.
• The rights outlined above cannot be exercised in cases where the processing of personal data is necessary for the protection of the State’s economic and financial interests, particularly regarding budget, tax, and financial matters.

According to Article 28, Paragraph 1 of the Law, the following situations will fall outside the scope of the Law, and therefore, data subjects' requests will not be processed regarding these data:

• The processing of personal data by individuals, within the scope of activities related to themselves or family members living in the same household, provided that the data is not shared with third parties and the data security obligations are complied with.
• The processing of personal data for purposes such as research, planning, and statistics by anonymizing the data for official statistics.
• The processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy, or personal rights, nor constitute a crime.
• The processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order, or economic security.
• The processing of personal data by judicial authorities or enforcement agencies in relation to investigations, prosecutions, trials, or enforcement procedures.

7. How long will your personal data be processed?
OZAN DEMİRBAŞ determines the retention periods for personal data by considering the applicable legislation and the purposes for which the data is processed. In accordance with the KVKK, personal data processed for the purposes specified in this Clarification Text will be deleted, destroyed, or anonymized when the purpose for processing ceases to exist, as per Article 7, Paragraph 1 of the KVKK, and/or when the retention periods mandated by the legislation expire.

8. How can you exercise your rights as a data subject?
To exercise your rights mentioned above under Article 11 of the KVKK, you can complete the Application Form provided via the link and submit it to OZAN DEMİRBAŞ by either delivering the signed form in person to the address: Esentepe Mah. Büyükdere Cad. Levent Loft No: 201/1 - Floor: 7 Apartment: 113 Levent / İstanbul, along with the necessary identity verification details, or by sending it via notary, registered mail, or by emailing the form signed with a Secure Electronic Signature to project@ozandemirbas.com through the Registered Electronic Mail system. In case a third party is applying on behalf of the data subject, a notarized power of attorney must be provided, authorizing the third party to act on behalf of the data subject.

OZAN DEMİRBAŞ will respond to the request as soon as possible, and no later than thirty (30) days, free of charge, depending on the nature of the request. However, if the process requires additional costs, a fee will be charged in accordance with the tariff set by the Personal Data Protection Authority.