E-COMMERCE DISCLOSURE TEXT WITHIN THE SCOPE OF THE LAW ON THE PROTECTION OF PERSONAL DATA

As İCA Dış Ticaret ve Tekstil San. Paz. A.Ş. ("İCA”); in line with the importance we attach to the security of your personal data as data controller, all kinds of personal data obtained through our website and stored within our organization are processed, stored, and transferred in accordance with the **Law on the Protection of Personal Data No. 6698** ("**KVKK**”). This disclosure text has been prepared pursuant to Article 10 titled "Obligation of the Data Controller to Inform" of the KVKK, regarding your personal data collected, stored, and processed by İCA as the data controller.

We have prepared this disclosure text to inform our online visitors, customers, supplier employees, and supplier officials about the legislation regarding the processing, storage, and transfer of your personal data within the framework of our company's activities arising from the Law on the Protection of Personal Data No. 6698 ("KVKK") and related legislation and legal regulations.

PURPOSES OF PROCESSING YOUR PERSONAL DATA

Your personal information will be processed by İCA in accordance with the principles stipulated in Article 4.2 of the KVKK: (i) Processing in compliance with law and honesty rules, (ii) Being accurate and, where necessary, up-to-date, (iii) Processing for specific, explicit, and legitimate purposes, (iv) Being relevant, limited, and proportionate to the purpose for which they are processed, (v) Retention for the period stipulated in the relevant legislation or required for the purpose for which they are processed. The personal information belonging to the relevant data subject groups will be processed for the purposes stated below and based on at least one of the legal reasons stated in Articles 5 and 6 of the Law.

Our Online Visitors:

The transaction security information (your IP address information) and (if you notify us) address and identity information (name surname), contact information (email address, telephone number) of our natural person online visitors who use our website; will be processed for the purposes of providing information about products, services, promotions, and campaigns, conducting activities in compliance with the legislation, executing information security processes, tracking requests/complaints, carrying out communication activities, providing information to legally authorized persons, institutions, and organizations, ensuring your access to our website within the scope of e-commerce via the internet, and communicating with you.

Our Customers:

Identity information, name surname, tax ID, address, TR ID number, contact information, phone number, email address, customer transaction information (e.g., order information), marketing information (e.g., shopping history information), date of membership, applications made, IP, Device ID, financial data, bank account information, credit card information of our natural person customers or the officials and/or customers of our legal person customers who use our website.

May be processed for the purposes of managing activities in compliance with the legislation, executing finance and accounting works, carrying out/auditing business activities, executing logistics activities, executing after-sales support services for goods/services, executing sales processes for goods/services, conducting marketing analysis studies, executing contract processes, providing information to legally authorized persons, institutions, and organizations, resolving legal disputes, carrying out storage and archiving activities, executing risk management processes, executing advertising/campaign/promotion processes, executing processes related to loyalty to company/product/services, conducting communication activities, announcing new or existing products, services, and campaigns, executing sales and marketing activities, conducting market research, paying, collecting product, service, and service fees, selecting the collection method, fulfilling legal obligations pursuant to the Law on the Regulation of Electronic Commerce No. 6563 and other related legislation, transmitting advertisements of products and services to the relevant person; providing information about products, services, promotions, and campaigns, and responding to requests from authorized public institutions.

Supplier Officials and Supplier Employees in service and goods supply transactions made through the e-commerce site:

Personal information regarding the identity and communication of suppliers and supplier employees; executing goods/service procurement processes, executing finance and accounting works, executing contract processes, following up and executing legal affairs, providing and changing services offered through the website, executing supply chain management processes, executing logistics activities, paying product, service, and service fees, fulfilling legal obligations pursuant to legal regulations, resolving legal disputes.

May be processed for the purposes of fulfilling the disclosure obligation arising from the Law on the Regulation of Electronic Commerce No. 6563 and other relevant legislation.

Processed personal data is also processed for the purpose of evaluating, responding to, all applications, questions, requests, suggestions, and complaints conveyed in written, verbal, or electronic form.

Your personal data categorized above based on data subjects and specified processing purposes are processed based on the legal grounds of: explicit stipulation in laws KVKK Art.5/2-a, necessity for the processing of personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of a contract KVKK Art.5/2c, necessity of data processing for the establishment, exercise, or protection of a right KVKK Art.5/2-e, and necessity of data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject KVKK Art.5/2-f.

TRANSFER OF YOUR PERSONAL DATA TO 3RD PARTIES AND PURPOSE

İCA acts in accordance with the regulations stipulated in Article 6 regarding the Processing of Special Categories of Personal Data and in Articles 8 and 9 regarding the transfer of personal data in the Law, and the principles published by the Personal Data Protection Authority.

Personal data cannot be processed without the explicit consent of the data subject. However, in the exceptional cases listed in Articles 5 and 6 of the KVKK Law, it can be processed without seeking explicit consent.

The regulations explaining the exception to explicit consent in Article 5 of the Law are given below.

a) Explicitly stipulated in the laws.

b) Being necessary for the protection of life or physical integrity of the person who is unable to disclose their consent due to actual impossibility or whose consent is not legally valid, or of another person.

c) Being necessary for the processing of personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of the contract.

ç) Being mandatory for the data controller to fulfill its legal obligation.

d) Being publicized by the data subject themselves.

e) Data processing being mandatory for the establishment, exercise, or protection of a right.

f) Data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Your personal data cannot be transferred without the explicit consent of the data subject. However, provided that one of the conditions specified in the second paragraph of Article 5 and the third paragraph of Article 6, which we stated in the legal reason section, exists, it may be transferred without seeking the explicit consent of the data subject, provided that sufficient measures are taken. Article 6 of the Law explains the exceptions to obtaining explicit consent in the processing of special categories of personal data. Our Company's Website and E-Commerce Portal do not request special categories of personal data from the relevant data subjects.

İCA acts in accordance with the regulations regarding the transfer of personal data stipulated in Article 5 and Articles 8 (transfer) and 9 (transfer abroad) regarding the processing and transfer of special categories of personal data in Article 6 of the Law, and other legislation and principles published by the Personal Data Protection Authority.

Your personal data may be transferred to:

Public institutions to which we are legally obliged to provide information, provided that it is stipulated in the laws, to courts and relevant public institutions if there are legal requests such as a court decision or request for evidence for the fulfillment of the legal obligation, to our lawyers, to other private law persons who have the right to request legal information, to contracted supplier companies, service companies providing information system support, domestic and foreign cloud companies, advertising and marketing agencies that İCA works with, group companies, affiliates, shareholders, and contracted consultants, limited to the necessary personal data for the execution of goods/service sales processes and the execution of after-sales support services for goods/services.

METHOD OF COLLECTING YOUR PERSONAL DATA AND LEGAL REASON

Your personal data, explained above and whose processing purposes are specified, are collected by automatic or non-automatic means through digital order forms, contracts, visitor forms, processing of digital forms filled for membership and customer purposes via information systems and electronic devices (e.g., telecommunication infrastructure, computer and call center phones, our website's online services, and other additional information declared by the data subject).

Your personal data is processed based on the legal reasons of KVKK Art. 5/2-c: "Being necessary for the processing of personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of a contract", KVKK Art. 5/2-ç: "Being mandatory for the data controller to fulfill its legal obligation", and KVKK Art. 5/2-e: "Data processing being mandatory for the establishment, exercise, or protection of a right" of the Law on the Protection of Personal Data.

YOUR RIGHTS

Pursuant to Article 11 of the KVKK, by applying to our company, you have the right to learn whether your personal data is processed, to request information if your personal data has been processed, to learn the purpose of processing your personal data and whether they are used appropriately for their purpose, to know the third parties to whom your personal data is transferred domestically or abroad, to request the correction of your personal data if it is incomplete or incorrectly processed, to request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK, provided that our company's legal obligations are reserved, to request notification of the transactions made pursuant to paragraphs (d) and (e) listed above to third parties to whom your personal data has been transferred, to object to the emergence of a result against you by analyzing your personal data exclusively with automated systems, and to demand compensation for damage if you suffer damage due to the unlawful processing of your personal data.

You can personally submit your applications within the scope of Article 11 of the Law by bringing your written application with a wet signature to our company address, send it via a notary public, fill out the "Application Form Pursuant to the Law on the Protection of Personal Data" at the web address ... or transmit it via Registered Electronic Mail (KEP) address ........., secure electronic signature, mobile signature, or the email address notified to our company by the data subject and registered in our company's system. Your applications made in accordance with the Law will be answered by our company within 30 days.

DATA CONTROLLER INFORMATION