JABOTTER E-COMMERCE SHOE MANUFACTURING LTD.

INFORMATION TEXT REGARDING THE ACQUISITION, PROCESSING AND PROTECTION OF PERSONAL DATA

1- GENERAL DESCRIPTION AND DEFINITIONS

This information text has been prepared by Jabotter E-Commerce Shoe Manufacturing LTD. Co. , in its capacity as "data controller," to fulfill its "obligation to inform" under Article 10 of the Law No. 6698 on the Protection of Personal Data (the Law) .

The meanings of the following terms used in the information text are as defined in Law No. 6698, the Regulations and Circulars issued in relation to this Law, and are as follows:

• Personal data: Any information relating to an identified or identifiable natural person.

• Processing of personal data: Any operation performed on personal data, such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, acquiring, making available, classifying or preventing the use of data, whether wholly or partly automated or non-automated, provided that it is part of a data recording system.

• Data subject: The natural person whose personal data is being processed.

• Explicit consent: Consent given freely and based on informed knowledge regarding a specific matter.

• Anonymization: The process of rendering personal data in such a way that it cannot be linked to an identified or identifiable natural person, even when combined with other data.

• Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

• Data processor: A natural or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller.

• Data recording system: A recording system in which personal data is processed by structuring it according to specific criteria.

• Contact person: The natural person notified by the data controller during registration with the Registry for communication with the Authority regarding the obligations of legal entities established in Türkiye and the representatives of legal entities not established in Türkiye acting as data controllers, within the scope of the Law and secondary regulations to be issued based on this Law.

• Personal data retention and destruction policy: The policy that data controllers use as a basis for determining the maximum period for which personal data is necessary for the purpose for which it is processed, as well as for the processes of deletion, destruction, and anonymization.

2- INFORMATION REGARDING THE DATA CONTROLLER

In the case of legal entities, the data controller is the legal entity itself. For legal entities established in Türkiye, the data controller obligations under the Law are fulfilled through the organ/person(s) authorized to represent and bind the legal entity. The organ authorized to represent the legal entity may appoint one or more persons to fulfill the obligations related to the implementation of the Law. This appointment does not relieve the legal entity of its responsibility under the provisions of the Law.

JABOTTER operates as a capital company with legal personality, established in Türkiye. Information about JABOTTER as the data controller is provided below.

The Data Controller;

3- OBLIGATIONS OF THE DATA CONTROLLER

JABOTTER, within the scope of its obligation to inform relevant parties, shall provide the following to those relevant parties:

• The identity of the data controller and, if applicable, their representative,

• The purpose for which personal data will be processed,

• To whom and for what purpose the processed personal data may be transferred,

• Method and legal basis for collecting personal data,

• What are the rights of individuals whose personal data is processed?

JABOTTER is obligated to provide information on this matter. Furthermore, regarding data security, JABOTTER also has the following responsibilities:

• To prevent the unlawful processing of personal data.

• To prevent unlawful access to personal data,

• To ensure the protection of personal data.

JABOTTER takes the necessary security measures for this purpose. Within its own institution or organization, JABOTTER conducts the necessary audits to ensure the application of the provisions of Law No. 6698, and does not disclose the personal data it obtains to others in violation of the provisions of Law No. 6698, nor does it use it for purposes other than the processing purpose.

 

4- PERSONAL DATA TO BE PROCESSED

The personal data to be processed by JABOTTER is listed below, and new information may be added and/or changes may be made to this information as required and/or necessary by law.

Personal data subject to data processing includes:

• Identity information such as Name, Surname, Turkish Republic Identity Number, Date of Birth, Gender, etc.

• Contact information such as address, telephone, fax, email, etc.

• Tax Office and Tax Number information,

• Information about employees including wages, social security, bank account numbers, and family members.

• Information about occupation and educational status

5- METHODS OF OBTAINING PERSONAL DATA

Personal data may be obtained directly from the data subject themselves, or indirectly, depending on the purpose of obtaining the data, through online sales platforms, dealers, partner institutions and organizations, and without limitation thereto.

6- PURPOSE OF PROCESSING PERSONAL DATA

JABOTTER processes personal data for the following purposes:

• Fulfillment of obligations regarding taxes and other public receivables within the scope of tax laws, the Turkish Commercial Code No. 6102, and other legal regulations.

• Taking measures to protect consumer rights within the scope of the Law No. 6502 on Consumer Protection,

• The responsibilities of JABOTTER include receiving orders from interested parties for products they wish to purchase, selling the products, delivering the products to the relevant parties, collecting payments, providing after-sales services for the sold products, measuring customer satisfaction, and collecting and evaluating any complaints and suggestions regarding the sold products or services.

• The preparation of distance selling contracts and verification of the identity of the relevant person are required for purchases made through e-commerce platforms.

• Improving service quality,

• Conducting campaigns, promotions, advertising and publicity activities related to products and services, and providing information on these matters.

• Ensuring in-store safety and increasing efficiency.

• The JABOTTER Card allows cardholders to earn special points or discounts on purchases made within the scope of the JABOTTER Loyalty Program.

7- TRANSFER AND PROTECTION OF PERSONAL DATA

JABOTTER does not transfer personal data obtained for data processing purposes to third parties/institutions without the explicit consent of the data subject.

JABOTTER may transfer personal data to individuals, institutions, and/or organizations required/permitted by tax and social security laws and other laws and regulations, including but not limited to public legal entities authorized to receive personal data such as the Revenue Administration, the Turkish Employment Agency (İŞ-KUR), the Social Security Institution, the Financial Crimes Investigation Board, the Interbank Card Center, and the Credit Registry Bureau; to JABOTTER's domestic/foreign subsidiaries; to companies operating as dealers; to program partner/solution partner institutions and organizations with whom it collaborates; to PTT branches; to companies providing logistics support, consultancy, and independent audit services; and, even if not legally required, to third parties and institutions to achieve its objectives of providing better service under Article 6, provided that the rights of the data subject under Law No. 6698 are reserved.

8- OBTAINING THE EXPLICIT CONSENT OF THE DATA SUBJECT FOR THE PROCESSING OF PERSONAL DATA

Personal data to be processed by JABOTTER will be processed with the "explicit consent" of the data subject within the scope of Law No. 6698. Explicit consent refers to the consent that the data subject freely expresses regarding a specific matter, based on informed knowledge.

According to Article 5/2 of Law No. 6698, personal data may be processed without the explicit consent of the data subject if any of the following conditions exist.

• If it is explicitly provided for in the laws.

• Consent must be given in cases where the person is unable to express their consent due to factual impossibility or where their consent is not legally valid, and it must be necessary for the protection of their own life or the life or physical integrity of another person.

• The processing of personal data belonging to the parties to a contract is necessary provided that it is directly related to the establishment or performance of the contract.

• It is necessary for the data controller to fulfill its legal obligations.

• It must have been made public by the person concerned themselves.

• Data processing is necessary for the establishment, exercise, or protection of a right.

• Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

9- DURATION OF PERSONAL DATA RETENTION

JABOTTER destroys (deletes, destroys, or anonymizes) personal data when the purpose of processing the personal data ceases to exist or when the mandatory retention periods determined under the laws and other regulations expire.

10- RIGHTS OF THE DATA SUBJECT

Data subjects may contact the data controller to request information about themselves;

• To find out whether your personal data is being processed,

• The right to request information regarding the processing of personal data.

• To learn the purpose of processing personal data and whether it is being used appropriately for that purpose.

• Knowing the third parties to whom personal data is transferred, whether domestically or internationally.

• Requesting the correction of personal data if it has been processed incompletely or inaccurately.

• Requesting the deletion or destruction of personal data within the framework of the conditions stipulated by law,

• Requesting notification of changes to personal data to third parties to whom personal data has been transferred,

• The right to object to an outcome that is detrimental to oneself, resulting from the analysis of processed data exclusively through automated systems.

• The right to claim compensation for damages incurred as a result of the unlawful processing of personal data.

They have rights.

 11- APPLICATION TO THE DATA CONTROLLER

Individuals whose personal data is processed may apply to JABOTTER regarding their requests within the scope of the rights specified in Article 11 of Law No. 6698. These individuals may exercise this right by submitting their applications in Turkish. Individuals may submit their requests to JABOTTER through one of the following communication channels. Accordingly, individuals may submit their requests as follows:

• In writing,

• Via registered electronic mail (KEP) address,

• Through a secure electronic signature or mobile signature,

• By using the email address previously provided to JABOTTER by the person whose personal data is being processed and which is registered in JABOTTER's system,

• Data can be transmitted to JABOTTER via software or an application developed for the purpose of the application.

In the applications;

• Name, surname and signature if the application is in writing,

• For Turkish citizens, the Turkish Republic identity number; for foreigners, their nationality, passport number, or identity number if available.

• The residential or business address used for notification purposes,

• If available, the email address, telephone and fax number for notification purposes,

• The subject of the request,

It is mandatory to have this information. We inform you that you have the right to claim compensation for damages incurred due to the unlawful processing of your personal data, that you can apply to Jabotter E-Commerce Shoe Manufacturing LTD. Co. to exercise your rights, and that your applications will be processed as soon as possible (within 30 days at the latest) and free of charge.

For applications to be made by the relevant individuals, the communication channels specified in section "2-INFORMATION REGARDING THE DATA CONTROLLER" of this information document may be used.

JABOTTER processes the requests included in the application free of charge as soon as possible, and no later than thirty days, depending on the nature of the request. However, if the process requires additional costs, a fee may be charged in the amount specified in Article 7 of the "Notification on the Procedures and Principles for Applications to the Data Controller" . If the application is due to an error on the part of the data controller, the fee charged will be refunded to the applicant.

12- CHANGES AND UPDATES

This information text has been prepared in accordance with Law No. 6698 and the Regulations and Communiqués published under this Law, as well as JABOTTER's purposes and policies for processing personal data. Necessary changes may be made to this information text in line with any changes in the relevant legal legislation and/or JABOTTER's purposes and policies for processing personal data.