Personal Data Protection Notice

CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA

Data Controller This Clarification Text has been prepared by Ecem Hırdavat in the capacity of data controller, within the scope of the Law on the Protection of Personal Data No. 6698, regarding the processing of your personal data. Data Controller Information Title: Ecem Hırdavat Address: Istanbul, Turkey Phone: [Company Phone Number] E-mail: info@ecemhirdavat.com MERSIS / Tax No: [Tax Number / MERSIS No] Website: www.ecemhirdavat.com

Purpose of the Clarification Text This text has been prepared to inform individuals who visit our website, become members, place orders, shop, use contact forms, or communicate with us about the purposes for which their personal data is processed, to whom and for what purposes it can be transferred, the methods of collection, legal grounds, and the rights of the relevant persons.

Processed Personal Data When you use our website, create a membership, place an order, or contact us, your following personal data may be processed: Identity Information Name, surname, Turkish ID number, tax identification number, company title. Contact Information Telephone number, e-mail address, delivery address, billing address. Customer Transaction Information Order information, cart information, product preferences, billing information, return and exchange requests, shopping history. Financial Information Payment information, bank information, payment method, refund payment information. Transaction Security Information IP address, device information, browser information, login-logout records, log records. Marketing Information Campaign preferences, commercial communication permissions, cookie records, site usage habits. Request and Complaint Information Contact forms, support requests, customer service correspondence, complaints and suggestions.

Purposes of Processing Personal Data Your personal data may be processed for the following purposes: Creating and managing membership accounts Receiving, preparing, and delivering orders Executing product or service sales processes Performing payment transactions Executing invoice, accounting, and finance processes Managing cargo and delivery processes Executing return, cancellation, and exchange processes Meeting customer service and support requests Responding to communication requests Increasing product and service quality Ensuring website security Developing user experience Executing campaign, announcement, and notification processes Managing commercial electronic communication permissions Fulfilling obligations arising from legislation Meeting requests of authorized public institutions and organizations Following up and finalizing legal disputes

Methods of Collecting Personal Data Your personal data can be collected through automated or non-automated methods via the following channels: Website membership forms Order and payment pages Contact forms Live support, WhatsApp, telephone, or e-mail interviews Cookies and similar technologies Cargo, accounting, and accounting processes Social media accounts Physical or electronic forms

Legal Grounds for Processing Personal Data Your personal data is processed based on the legal grounds specified in Articles 5 and 6 of the Personal Data Protection Law No. 6698. In this context, your personal data may be processed based on the following legal grounds: Being expressly provided for in the laws, Being directly related to the establishment or performance of a contract, Being mandatory for the data controller to fulfill its legal obligation, Being mandatory for the establishment, exercise, or protection of a right, Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person, Having your explicit consent. In cases requiring explicit consent, your personal data is processed only if your explicit consent is obtained.

Transfer of Personal Data Your personal data may be shared with the following persons, institutions, and organizations within the scope of realizing the above-mentioned purposes and fulfilling legal obligations: Cargo and logistics companies Payment institutions and banks Accounting and financial consultancy service providers E-invoice and e-archive service providers Hosting, software, technical infrastructure, and security service providers SMS, e-mail, notification, and communication service providers Legal advisors and lawyers Business partners and suppliers Authorized public institutions and organizations Your personal data is not sold or rented to third parties for marketing purposes without your explicit consent.

International Data Transfer The servers of some service providers used within the scope of website infrastructure, hosting, e-mail, analysis, advertising, cookies, payment, or technical services may be located abroad. Therefore, your personal data may be transferred abroad only in accordance with the relevant legislation, by taking necessary security measures and in the presence of legal conditions. If the transfer abroad is to take place in a situation requiring explicit consent, the transfer is made only if your explicit consent is obtained.

Cookies Cookies may be used on our website to improve user experience, ensure site security, measure performance, remember your preferences, and conduct marketing activities. Data such as IP address, device information, browser information, visited pages, processing time, and site usage habits can be processed through cookies. Detailed information regarding cookie usage can be accessed via the Cookie Policy on our website.

Electronic Commercial Messages Electronic commercial messages containing campaigns, discounts, announcements, promotions, and marketing content are sent only in accordance with the relevant legislation and by obtaining your approval when necessary. If you do not want to receive commercial electronic messages, you can use the unsubscribe link in the messages sent or contact us via info@ecemhirdavat.com.

Storage Period of Personal Data Your personal data is retained for the period required by the processing purposes and as long as the legal retention periods stipulated in the relevant legislation. When the retention period expires or the purpose of processing disappears, your personal data is deleted, destroyed, or anonymized.

Security of Personal Data Necessary technical and administrative measures are taken to prevent unauthorized access, loss, misuse, modification, disclosure, or destruction of your personal data. In this context, measures such as SSL certificate, secure server infrastructure, access authorizations, log records, backup, security software, and regular technical controls can be applied.

Rights of the Relevant Person Within the scope of KVKK, you have the following rights regarding your personal data: Learning whether your personal data is processed or not Requesting information if your personal data has been processed Learning the purpose of processing your personal data and whether they are used in accordance with its purpose Knowing the third parties to whom your personal data is transferred at home or abroad Requesting the correction of your personal data if it is incomplete or incorrectly processed Requesting the deletion or destruction of your personal data Requesting notification of correction, deletion, or destruction operations to third parties to whom personal data has been transferred Objecting to the emergence of a result against you by analyzing the processed data exclusively through automated systems Requesting compensation for damages in case you suffer damage due to unlawful processing of personal data

Application Method To exercise your rights within the scope of KVKK, you can submit your requests to us via the following communication channels: E-mail: info@ecemhirdavat.com Address: Istanbul, Turkey Phone: [Company Phone Number] Website: www.ecemhirdavat.com Your applications are finalized as soon as possible and within legal periods at the latest, depending on the nature of the request.

Update This KVKK Clarification Text may be modified in line with legislative changes, changes in business processes, or updates in website practices. The updated text becomes valid as of the date it is published on the website.

Contact You can contact us for any questions, opinions, and requests regarding the KVKK Clarification Text: Title: Ecem Hırdavat Address: Istanbul, Turkey Phone: [Company Phone Number] E-mail: info@ecemhirdavat.com Website: www.ecemhirdavat.com Last Update Date: September 2026