Jabotter E-Ticaret Ayakkabıcılık LTD. ŞTİ.

INFORMATION NOTICE ON THE COLLECTION, PROCESSING, AND PROTECTION OF PERSONAL DATA

1- GENERAL EXPLANATION AND DEFINITIONS

This information notice has been prepared by Jabotter E-Ticaret Ayakkabıcılık LTD. ŞTİ. as the "data controller" within the scope of Article 10 of the Law on Protection of Personal Data No. 6698 (the "Law"), in order to fulfill the "obligation to inform."

The meanings of the following terms in this information notice are in accordance with the definitions specified in the Law, Regulations, and Communiqués related to this Law, as indicated below:

Personal data: Any kind of information regarding a definite or definable real person,

Processing of personal data: Any kind of operation performed on personal data, either entirely or partially, by automatic means or non-automatic means provided that it is a part of any data recording system, such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, takeover, making retrievable, classification, or preventing its use,

Data subject: The real person whose personal data is processed,

Explicit consent: Consent based on being informed about a specific subject and expressed with free will,

Anonymization: Rendering personal data unrelated to a definite or definable real person, even if matched with other data,

Data controller: The real or legal person determining the purposes and means of processing personal data and responsible for establishing and managing the data recording system,

Data processor: The real or legal person processing personal data on behalf of the data controller, based on the authority granted by the data controller,

Data recording system: The structured system where personal data are processed according to specific criteria,

Contact person: A real person reported by the data controller during registration with the Data Controller Registry System (VERBIS), for the purpose of communication with the Institution, in connection with the obligations within the scope of the Law and secondary regulations to be issued based on this Law, with regard to legal entities based in Turkey and legal entity data controller representatives not based in Turkey,

Personal data retention and destruction policy: The policy adopted by data controllers as a basis for determining the maximum period required for the processing purposes of personal data and for the deletion, destruction, or anonymization of such data, as well as the procedure to be followed for this purpose.

2- INFORMATION ABOUT THE DATA CONTROLLER

In legal entities, the data controller is the legal personality itself. The obligations of legal entities based in Turkey as data controllers under the Law are fulfilled through the authorized organ/person or persons competent to represent and bind the legal entity. The authorized organ competent for representation in terms of applying the provisions of the Law can assign one or more individuals for the obligations to be fulfilled concerning the application of the Law. This assignment does not eliminate the responsibility of the legal personality concerning the implementation of the Law.

JABOTTER operates as a capital company with a legal personality based in Turkey. Information about JABOTTER as the data controller is specified below.

Data Controller's;

3- OBLIGATIONS OF THE DATA CONTROLLER

Within the scope of the obligation to inform, JABOTTER must provide information to the data subjects about the following:

The identity of the data controller and, if any, of its representative,

The purposes for which personal data will be processed,

To whom and for what purposes the processed personal data may be transferred,

The method and legal basis of personal data collection,

The rights of the data subjects whose personal data are processed,

JABOTTER also takes necessary security measures to ensure data security, such as:

Preventing the processing of personal data unlawfully,

Preventing unauthorized access to personal data,

Ensuring the protection of personal data,

JABOTTER takes necessary security measures to ensure data security, such as:

Preventing the processing of personal data unlawfully,

Preventing unauthorized access to personal data,

Ensuring the protection of personal data,

to fulfill its obligation to ensure data security and to prevent the processing of personal data unlawfully or in a way that is not compliant with the purposes of processing.

4- PROCESSED PERSONAL DATA

JABOTTER processes personal data as indicated below in accordance with the purposes stated. These purposes include:

Fulfillment of obligations related to public receivables such as taxes within the scope of tax laws, Turkish Commercial Code No. 6102, and other legal regulations,

Taking measures for the protection of consumer rights within the scope of the Law on Consumer Protection No. 6502,

Receiving orders for products that individuals wish to purchase from JABOTTER, selling products, delivering products to the relevant individuals, collecting payments, providing post-sales services related to sold products, measuring customer satisfaction, collecting and evaluating complaints and suggestions related to sold products or services,

Preparing distance sales contracts within the scope of electronic commerce platforms, verifying the identity of the relevant individual,

Increasing the quality of service,

Conducting campaigns, promotions, advertisements, and promotional activities related to products and services, providing information on these matters,

Ensuring in-store security, increasing efficiency,

Facilitating JABOTTER Cardholder consumers to earn special points or discounts within the scope of the JABOTTER Loyalty Program.

5- METHODS OF OBTAINING PERSONAL DATA

Personal data can be obtained directly from the relevant individuals themselves, as well as indirectly through online sales platforms, dealers, partner institutions, and organizations, and not limited to these, depending on the purpose of obtaining the data.

6- PURPOSE OF PROCESSING PERSONAL DATA

JABOTTER processes personal data for the following purposes. These purposes are as follows:

Fulfillment of obligations related to public receivables such as taxes within the scope of tax laws, Turkish Commercial Code No. 6102, and other legal regulations,

Taking measures for the protection of consumer rights within the scope of the Law on Consumer Protection No. 6502,

Receiving orders for products that individuals wish to purchase from JABOTTER, selling products, delivering products to the relevant individuals, collecting payments, providing post-sales services related to sold products, measuring customer satisfaction, collecting and evaluating complaints and suggestions related to sold products or services,

Preparing distance sales contracts within the scope of electronic commerce platforms,

verifying the identity of the relevant individual,

Improving service quality,

Conducting campaigns, promotions, advertisements, and promotional activities related to products and services, providing information on these matters,

Ensuring in-store security, increasing efficiency,

Enabling JABOTTER Cardholder consumers to earn special points or discounts within the scope of the JABOTTER Loyalty Program.

7- TRANSFER AND PROTECTION OF PERSONAL DATA

JABOTTER does not transfer personal data it has obtained to third parties/organizations without the explicit consent of the data subject for the purposes of data processing.

In accordance with tax and social security laws, other laws, and other legal regulations, and not limited to these, JABOTTER may transfer personal data to public legal entities authorized to receive personal data, JABOTTER's domestic/foreign subsidiaries, companies operated as dealers, program partners/solution partners with which collaboration is established, firms providing logistic support, consultancy, and independent audit services, whether legally required or not, as well as third parties and organizations that may be necessary for the purposes of providing better services within the scope of Article 6 of the Law, as long as the rights of the data subjects under Law No. 6698 are preserved.

8- OBTAINING THE EXPRESS CONSENT OF THE DATA SUBJECT IN THE PROCESSING OF PERSONAL DATA

Personal data to be processed by JABOTTER are processed by obtaining the "explicit consent" of the data subject in accordance with Law No. 6698. Explicit consent refers to consent that is given freely by the data subject based on being informed about a specific subject.

Pursuant to Article 5/2 of Law No. 6698, personal data can be processed without the explicit consent of the data subject, provided that one of the following conditions exists:

It is explicitly prescribed by laws,

It is necessary to protect the life or bodily integrity of the data subject or another person where the data subject is physically incapable of giving consent or whose consent is not legally valid,

It is necessary for the performance or establishment of a contract with the data subject, provided that it is directly related to the conclusion or performance of the contract,

It is necessary for compliance with a legal obligation imposed on the data controller,

It has been made public by the data subject,

It is necessary for the establishment, use, or protection of a right,

It is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

9- RETENTION PERIOD OF PERSONAL DATA

JABOTTER deletes (erases, destroys, or anonymizes) personal data once the processing purposes cease to exist or when the obligatory retention periods specified in laws and other regulations expire, in compliance with the Law.

10- RIGHTS OF THE DATA SUBJECT

Data subjects have the right to apply to the data controller in relation to themselves and:

To learn whether their personal data is processed,

If their personal data has been processed, to request information regarding this,

To learn the purposes of processing personal data and whether they are used for these purposes,

To learn the third parties to whom personal data is transferred, both domestically and abroad,

If personal data is processed incompletely or inaccurately, to request their correction,

To request the deletion or destruction of personal data in case the reasons requiring processing cease to exist, even if it has been processed in accordance with the Law,

To request the notification of the operations made pursuant to sub-paragraphs (d) and (e) to third parties to whom personal data has been transferred,

To object to the occurrence of a result against the data subject by analyzing personal data solely through automated systems,

To request compensation for the damage suffered as a result of the unlawful processing of personal data, in cases where the data subject incurs damage.

Data subjects have these rights, and you can apply to Jabotter E-Commerce Shoe Industry Ltd. Co. to exercise these rights. Your applications can be submitted to Jabotter E-Commerce Shoe Industry Ltd. Co. through the communication channels specified in the "2- INFORMATION ABOUT THE DATA CONTROLLER" section, using Turkish. Accordingly, you can convey your requests to Jabotter E-Commerce Shoe Industry Ltd. Co. through one of the following communication channels:

In writing,

Via registered electronic mail (KEP) address,

Through secure electronic signature or mobile signature,

By using the electronic mail address previously notified by the data subject and registered in Jabotter E-Commerce Shoe Industry Ltd. Co.'s system,

In applications;

Your name, surname, and signature if the application is in writing,

For Turkish citizens, the Republic of Turkey ID number, for foreigners, nationality, passport number, or ID number, if available,

Residential or workplace address for notifications,

If available, the electronic mail address, telephone, and fax numbers,

Subject of the request,

Must be included. We inform you that you can exercise your rights, including the right to request compensation for damages in case of damage suffered due to the unlawful processing of personal data, and apply to Jabotter E-Commerce Shoe Industry Ltd. Co.

11- APPLICATION TO THE DATA CONTROLLER

Data subjects, whose personal data are processed, can apply to JABOTTER in connection with their requests within the scope of their rights specified in Article 11 of Law No. 6698. Data subjects can benefit from this right, provided that they make their applications in Turkish. Data subjects can submit their requests to JABOTTER through one of the communication channels specified in the "2- INFORMATION ABOUT THE DATA CONTROLLER" section. Accordingly, data subjects can submit their requests to JABOTTER through the following communication channels:

In writing,

Via registered electronic mail (KEP) address,

Through secure electronic signature or mobile signature,

By using the electronic mail address previously notified by the data subject and registered in JABOTTER's system, created specifically for the purpose of application,

In applications;

Your name, surname and, if the application is in writing, your signature,

Republic of Turkey ID number for Turkish citizens, nationality for foreigners, passport number, or ID number if available,

Residential or workplace address for notifications,

If available, the electronic mail address, telephone, and fax numbers,

Subject of the request,

Must be included. JABOTTER will conclude the requests received from data subjects, depending on the nature of the request, within the shortest time and at the latest within thirty days, free of charge. However, in cases where the transaction requires an additional cost, a fee may be charged in the amount specified in the "Communiqué on the Principles and Procedures for Application to the Data Controller". If the charge is due to an error of the data controller, the fee will be refunded to the relevant person.

12- CHANGES AND UPDATES

This information notice has been prepared in accordance with Law No. 6698, Regulations, and Communiqués published within the scope of the aforementioned Law, as well as the personal data processing purposes and policies of JABOTTER. Changes may be made to the information notice in line with legal regulations.