SHOPINEXT ELECTRONIC COMMERCE AND INFORMATION SERVICES JOINT STOCK COMPANY
INFORMATION NOTICE ON THE PROCESSING AND PROTECTION OF PERSONAL DATA

As SHOPINEXT ELECTRONIC COMMERCE AND INFORMATION SERVICES JOINT STOCK COMPANY ("SHOPINEXT" or "Company"), we attach the utmost importance to the security of your personal data. With this awareness, we place great importance on processing and preserving the personal data of individuals interacting with the Company's website, mobile applications, etc., in accordance with the Personal Data Protection Law No. 6698 ("Law"), secondary regulations (regulations, notices, circulars) enacted or to be enacted pursuant to the Law, and binding decisions taken or to be taken by the Personal Data Protection Board. With full awareness of this responsibility, as the "Data Controller" defined by the Law, we process your personal data within the framework of the limits imposed by the legislation and for the purposes specified below in the context of account creation.

1. Information Regarding the Data Controller

According to the Law, SHOPINEXT ELECTRONIC COMMERCE AND INFORMATION SERVICES JOINT STOCK COMPANY, located at İdealtepe Mah. Dik Sok. No:13/2 Maltepe/Istanbul, is the data controller.

2. Purposes of Processing Personal Data

The personal data of product or service buyers, online visitors, member sellers, seller candidates, employees, employee candidates, suppliers, supplier employees, and their authorized representatives are processed by SHOPINEXT generally for the following purposes:

• Managing Information Security Processes,
• Managing Employee Candidate Application Processes,
• Fulfilling Employment Contracts and Legal Obligations for Employees,
• Managing Fringe Benefits and Processes for Employees,
• Processing Online Visitor Data,
• Managing Audit/Ethics Activities,
• Managing Access Authorities,
• Ensuring Compliance with Laws and Regulations,
• Managing Finance and Accounting Processes,
• Managing Customer Loyalty to the Company/Product/Service,
• Managing Legal Affairs,
• Managing Internal Audits/Investigations,
• Managing Communication Activities,
• Planning Human Resources Processes,
• Ensuring Business Continuity,
• Ensuring Data Accuracy and Updating,
• Managing Logistics Activities,
• Managing Purchase Processes for Goods/Services,
• Managing Post-Sales Support Services for Goods/Services,
• Managing Sales Processes for Goods/Services,
• Managing Customer Relations,
• Conducting Activities for Customer Satisfaction,
• Improving Customer Experiences,
• Conducting Marketing Analysis Studies,
• Managing Advertising/Campaign/Promotion Processes,
• Managing Storage and Archiving Activities,
• Conducting Social Responsibility and Civil Society Activities,
• Managing Contract Processes,
• Managing Requests/Complaints,
• Managing Supply Chain Processes,
• Managing Marketing Processes for Products/Services,
• Managing Product Delivery Processes,
• Executing Membership Processes,
• Ensuring Security of Data Controller Operations,
• Providing Information to Authorized Persons, Institutions, and Organizations,
• Managing Management Activities.

3. Transfer of Personal Data

Your personal data may be transferred to third parties in compliance with the conditions stipulated in Articles 8 and 9 of the Law for the purposes mentioned above. In this context, the data of the product or service buyers and the information of the person to whom the purchased product is delivered for invoice issuance may be shared with the seller and the shipping company. Your personal data, such as mobile phone numbers or email addresses, may be shared with the commercial electronic communication service provider, and preferences and likes for promotional and advertising purposes, cookies for communication with local/international partners, and market research data may be shared with companies that will conduct market research.

4. Method and Legal Basis of Collecting Personal Data

Your personal data is collected by the Company's authorized personnel via automatic or non-automatic methods, verbally, in writing, or electronically. Personal data under categories such as identity, contact information, location, personnel, legal processes, Member Customer transactions, Guest Customer transactions, transaction security, finance, and marketing are processed based on the legal grounds in Article 5, paragraph 2 of the Law.

5. Rights of Data Subjects under the Law

At any time, you can contact SHOPINEXT and request to:

• Learn whether your personal data is processed,
• Request information regarding the processing,
• Learn the purpose of processing and whether it is used in line with this purpose,
• Know third parties to whom personal data has been transferred within the country or abroad,
• Request correction if your personal data is incomplete or incorrect,
• Request deletion or destruction of personal data within the framework of Article 7 of the Law,
• Request notification to third parties to whom personal data has been transferred,
• Object to any unfavorable outcomes through automated processing,
• Demand compensation for damages arising from unlawful processing of personal data.

To exercise your rights, you can fill out a request form obtained from the office and send it to SHOPINEXT via notary or registered mail, or you can submit the request electronically via a secure email address. SHOPINEXT will respond to requests in writing, without charge for up to ten pages; for each page over ten, a fee based on the tariff set by the Personal Data Protection Board will be charged. If the response is provided on a CD or flash drive, the cost cannot exceed the storage medium.