PERSONAL DATA PROTECTION

PROTECTION OF PERSONAL DATA

As Klosh fashion limited company, we attach great importance to ensuring the security of your personal information that you have transmitted to us, whether while using our website or mobile application, or through other means. Therefore, it is important for us that you read this text, which details what personal data we use and for what reasons, to show that you clearly understand the obligations of Mustalanka, who is responsible for their administrative and technical security as the "Data Controller". This is because the "Personal Data Protection Law" numbered 6698 came into force on 07.04.2016. As the data controller, we would like to inform you about the mentioned legislation and some definitions specified in this legislation:

Personal data: Any information relating to an identified or identifiable natural person,

Processing of personal data: Any operation performed upon personal data, wholly or partly by automatic means or non-automatic means as part of a data recording system, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of data,

Data processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller,

Data recording system: The recording system in which personal data is processed by being structured according to certain criteria,

Data controller: Refers to the natural or legal person who determines the purposes and means of processing personal data, and who is responsible for the establishment and management of the data recording system.

1. Purpose of the Personal Data Protection and Consent Text and Our Company's Position as Data Controller:

Our shopping site, in terms of customers' personal data, holds the title of "data controller" within the scope of the Personal Data Protection Law ("Law") numbered 6698. This Personal Data Protection and Consent Text aims to inform customers about the personal data processing activities carried out by our shopping site in accordance with the said Law and to obtain their explicit consent for the situations specified in Article 3 below. As Mustalanka, we obtain your personal data covered by the illumination text by your creating a membership on our mustalanka.com website or our mustalanka mobile application. If we need to explain what kind of personal data is obtained and why we need to obtain it:

Your first and last name are requested as identity data, and your mobile phone number and e-mail address are requested as communication data. The legal reason for this is the necessity of processing the personal data of the parties to the contract, which is directly related to the establishment and performance of the contract.

Your website or mobile application login/logout information, password information, and IP address information are requested as transaction security data. The legal reason for this is that the transaction is stipulated in the laws.

As legal transaction data, a record confirming that you have read and accepted the illumination text and membership agreements is requested. The legal reason for this is the fulfillment of our legal obligation regarding the consents you provide.

As customer transaction data, your call center records, information on counter receipts, your comments made on the website or mobile application, and your order and request information are recorded. The legal reason for this is the necessity of processing to fulfill legally valid interests and requests.

We would like to state that if you do not want your first and last name to appear on our website or mobile application, you can choose the anonymous commenting option, and if you prefer not to be anonymous, your comments will be published according to the name and surname information defined in your account. We kindly ask you not to share your personal or sensitive data outside the scope of KVKK in the comments you make. In such a case, it will be considered that you have given explicit consent, and your comments may be deleted if necessary.

2. Purpose of Processing Customers' Personal Data:

Customers' personal data is processed within the framework of the personal data processing conditions and purposes specified below and in Articles 5 and 6 of the Law. Namely, identity, communication, and legal transaction data are processed for the purpose of establishing the membership agreement and creating the membership profile, based on the legal reason of the establishment and performance of the contract. Identity and communication data are processed for the purpose of keeping communication information up-to-date and providing informative communications regarding transactions carried out by the customer with their membership, based on the legal reason of the establishment and performance of the contract. Transaction security and communication data are processed for the purpose of ensuring communication address verifications and carrying out password renewal procedures.

Customers' personal data;

Performing necessary studies by business units and carrying out related business processes to enable relevant individuals to benefit from the products and services offered by our shopping site,

Performing necessary studies by relevant business units and carrying out related business processes to realize commercial activities carried out by our shopping site,

Planning and execution of our shopping site's commercial and/or business strategies,

· Ensuring the legal, technical, and commercial-business security of our shopping site and relevant individuals who have a business relationship with our shopping site, and planning and executing necessary activities for recommending and promoting our products and services to relevant individuals by customizing them according to their preferences, usage habits, and needs,

· Establishment of potential rights and receivables of relevant individuals,

· Providing information to authorized institutions arising from legislation,

· Creating and tracking visitor records,

· Ensuring the fulfillment of obligations within the scope of the Law on Protection of Consumers, the Law on Regulation of Retail Trade, and other legal regulations, through our company and our branches, call center, affiliated companies on behalf of our company, or through our websites and social media pages, and without being limited to these channels,

· Providing better service to customers, offering various advantages, providing information about sales, marketing, promotions, campaigns and conditions, conducting surveys, customer satisfaction research, accelerating your purchases, taking and delivering your orders,

· Creating campaigns for customers, cross-selling, determining target audiences,

· Tracking customer movements to carry out activities that increase user experience and improve the operation of our shopping site's website and mobile application and personalize it according to customer needs, conducting direct and indirect marketing, personalized marketing and remarketing activities, personalized segmentation, targeting, analysis and internal reporting activities, market research,

· Planning and execution of customer satisfaction activities and planning and execution of customer relationship management processes, including the planning and execution of sales and marketing processes for our shopping site's products and/or services, and planning and execution of processes for establishing and/or increasing loyalty to the products and/or services offered by our shopping site, may be processed and shared with the parties specified in this Personal Data Protection Text, in line with the Customer's consent.

Our Shopping Site has the right to associate the behavior of users visiting the site, even if they are not members, with a cookie in the browser, and to define remarketing lists based on metrics such as the number of pages viewed, visit duration, and number of completed goals, for the purpose of online behavioral advertising and marketing. Subsequently, targeted advertising content can be shown to this user on the site or on other sites in the Display Network, according to the users' interests. When Google ADS advertisements are directed to Our Shopping Site, Google may place cookies on users' browsers or read cookies located in them, or use web beacons to collect information. The customer has given explicit consent for all these matters.

3. Personal Data to be Processed with Customers' Explicit Consent and Processing Purposes:

Personal data is processed in accordance with the Personal Data Processing Conditions specified in Articles 5 and 6 of Law No. 6698. For the following situations where the personal data processing conditions specified in Articles 5/2 and 6/3 of Law No. 6698 cannot be met, the explicit consent of customers is required for our Shopping Site to process personal data.

4. Transfer of Customers' Personal Data:

Personal data may be transferred to real and legal persons, provided that it complies with Articles 8 and 9 of Law No. 6698. These transfers are made within the framework of specific purposes and with the customer's knowledge. Therefore, customers' personal data may be processed for purposes including, but not limited to, ensuring that relevant individuals benefit from the products and services offered by our shopping site by carrying out necessary work by business units and executing related business processes, realizing commercial activities carried out by our shopping site by carrying out necessary work by relevant business units and executing related business processes, planning and executing our shopping site's commercial and/or business strategies, ensuring the legal, technical, and commercial-business security of our shopping site and relevant individuals who have a business relationship with our shopping site, and planning and executing necessary activities for recommending and promoting our products and services to relevant individuals by customizing them according to their preferences, usage habits, and needs, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law. It may be shared with Company officials, our affiliates, our lawyers, our financial advisors, our business partners, our suppliers, our shareholders, legally authorized public institutions and organizations, and private institutions. The user's Name and Contact Information may be shared with payment institutions for identity verification purposes in accordance with the framework agreement of the payment institution that the user will approve at the payment stage, and in accordance with the Regulation on Measures Regarding the Prevention of Laundering Proceeds of Crime and Financing of Terrorism, published in the Official Gazette dated January 9, 2008, and numbered 26751. Our Shopping Site may transfer personal data to third parties within the country, as well as abroad, provided that the conditions stipulated in Law No. 6698 are met, within the scope of the purposes stated above.

5. Method of Collecting Personal Data and Legal Reason:

Personal data is collected from customers electronically. Personal data collected for the legal reasons mentioned above can be processed and transferred for the purposes specified in Articles 5 and 6 of the Law and in this Personal Data Protection Text. In this regard, the personal data processed, with the data category specified, and the legal reasons for obtaining this data, are explained in detail in Article 1 of the Illumination Text.

6. Personal Data Retention Periods:

Our Shopping Site stores personal data for the period specified in relevant laws and regulations, if so stipulated.

If no period for how long personal data should be stored is stipulated in the legislation, Personal Data is processed for the period required by Our Shopping Site's practices and business life customs, in connection with the activity carried out while Our Shopping Site processes that data, and then deleted, destroyed, or anonymized.

If the purpose of processing personal data has ended; and the storage periods determined by the relevant legislation and Our Shopping Site have also ended; personal data may only be stored for the purpose of constituting evidence in possible legal disputes or for the assertion of a related right connected to personal data or for the establishment of a defense. In determining these periods, the statute of limitations for asserting the aforementioned right and, despite the expiry of the statute of limitations, examples from requests previously directed to Our Shopping Site on the same issues are taken as a basis for determining the storage periods. In this case, stored personal data is not accessed for any other purpose and is only accessed when it needs to be used in the relevant legal dispute. After the aforementioned period expires, personal data is also deleted, destroyed, or anonymized.

7. Rights of Customers as Personal Data Owners:

In accordance with Article 11 of the Law, data subjects have many rights, including but not limited to; (i) learning whether personal data related to them is being processed, (ii) requesting information if personal data has been processed, (iii) learning the purpose of personal data processing and whether it is used in accordance with its purpose, (iv) knowing the third parties to whom personal data is transferred domestically or abroad, (v) requesting correction of personal data if it is incomplete or incorrectly processed and requesting notification of the transaction made in this context to third parties to whom personal data has been transferred, (vi) requesting deletion or destruction of personal data when the reasons requiring its processing have disappeared, even though it has been processed in accordance with the Law and other relevant legal provisions, and requesting notification of the transaction made in this context to third parties to whom personal data has been transferred, (vii) objecting to the emergence of a result against the person himself/herself through the analysis of processed data exclusively by automatic systems, and (viii) requesting compensation for damages if personal data is processed unlawfully.

Requests regarding the exercise of these rights can be submitted by personal data owners to Our Shopping Site in writing (via a notice or registered letter) or by using a registered electronic mail (KEP) address, electronic signature, mobile signature, or the electronic mail address registered in the system, through the methods specified within the scope of Law No. 6698. Changes may occur regarding the matters specified in this form in line with legal and technological developments. Requests will be concluded as soon as possible and within thirty days at the latest, free of charge. If an additional cost is required for the fulfillment of the transaction subject to the requests, a fee may be requested from you according to the tariff determined by the Personal Data Protection Board.