PROTECTION OF PERSONAL DATA AND PRIVACY POLICY (INFORMATION NOTICE)

As Eart Galeri, we exercise maximum sensitivity regarding the security and privacy of your personal data. With this awareness, pursuant to the Law No. 6698 on the Protection of Personal Data ("KVKK") and relevant secondary legislation, in our capacity as Data Controller, we explain below how we process and transfer the personal data of our valued visitors and customers, as well as your rights.

1. Your Processed Personal Data and Collection Methods

The categories of personal data collected by us through your use of our website, your purchases, and our communication channels are as follows:

• Identity Information: Name, surname, Turkish ID number (during invoicing processes).
• Contact Information: E-mail address, phone number, delivery and billing address.
• Customer Transaction Information: Order history, request and complaint information, shopping cart details.
• Transaction Security Information: IP address details, website log-in and log-out records, user-agent details, and cookie records.
• Financial Information: Payment and invoicing information (Your credit card information is directly processed by the licensed payment institution/banking infrastructure and is not stored by us).

These data are collected wholly or partially through automated means via our website, electronic forms, cookies, and e-mail channels.

2. Purposes and Legal Grounds for Processing Your Personal Data

Your personal data are processed based on the following legal grounds specified in Articles 5 and 6 of the KVKK:

a. Establishment and Performance of the Distance Sales Contract (KVKK Art. 5/2-c):

For the purposes of receiving your orders, delivering products to you, providing post-sales support services, and conducting membership transactions.

b. Legal Obligations of the Data Controller (KVKK Art. 5/2-ç):

For the purposes of issuing invoices, fulfilling obligations under tax legislation and the Turkish Commercial Code, retaining traffic data in accordance with Law No. 5651, and fulfilling requests from authorized public institutions/organizations.

c. Legitimate Interests of the Data Controller (KVKK Art. 5/2-f):

Provided that it does not harm your fundamental rights and freedoms; for the purposes of ensuring website security, improving our service quality, and conducting performance and analytical studies.

d. Presence of Your Explicit Consent (KVKK Art. 5/1):

For the purposes of conducting customized promotional, marketing, and advertising activities for you and sending commercial electronic communications.

3. To Whom and for What Purposes the Processed Personal Data May Be Transferred

Your personal data may be transferred to the following parties in accordance with Articles 8 and 9 of the KVKK, taking the necessary administrative and technical measures:

• Cargo and Logistics Companies: For the purpose of delivering the products you purchased.
• Payment and Banking Institutions: For the purpose of securely processing payment transactions.
• Service Providers and Business Partners: To our suppliers providing information technology infrastructure, server/hosting services, and software support.
• Authorized Public Institutions and Organizations: To relevant authorities in line with legal notification obligations and duly requests from judicial/administrative authorities.

4. Retention and Destruction Process of Personal Data

Your personal data are retained for the storage periods stipulated by relevant legislation (10 years pursuant to the Tax Procedural Law, 2 years pursuant to Law No. 5651, etc.) or for the duration required by the processing purpose. Following the expiration of the period, your data will be deleted, destroyed, or anonymized during the first destruction period in accordance with the KVKK and the Regulation on the Deletion, Destruction or Anonymization of Personal Data.

5. Your Rights as a Data Subject (KVKK Art. 11)

Pursuant to Article 11 of the KVKK, as a data subject, you have the following rights:

1. To learn whether your personal data are processed,
2. To request information if your personal data have been processed,
3. To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
4. To know the third parties to whom your personal data are transferred domestically or abroad,
5. To request correction of your personal data if they are incomplete or incorrectly processed,
6. To request the deletion or destruction of your personal data within the framework of Article 7 of the KVKK,
7. To request notification of correction, deletion, or destruction operations to third parties to whom the personal data have been transferred,
8. To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,
9. To demand compensation for damages in case you suffer damage due to unlawful processing of personal data.

6. Application Procedures and Principles

To exercise your rights stated above, pursuant to the "Communiqué on the Procedures and Principles of Application to the Data Controller";

• In writing, with a wet-signed petition sent to our company address,
• By sending an e-mail to info@eartgaleri.com via your e-mail address previously notified to our company and registered in our system,
• Via Registered Electronic Mail (KEP) address sent to [KEP Address].

In your application, it is mandatory to include name, surname, Turkish ID number (nationality and passport number for foreigners), residential/work address for notification, e-mail address, and the subject of request. Your request will be processed free of charge as soon as possible and within 30 (thirty) days at the latest.