INFORMATION TEXT

This Disclosure Text has been prepared in accordance with the Law on the Protection of Personal Data No. 6698 (“ Law ”), in the capacity of data controller, with the aim of informing data owners regarding the procedures and principles of processing personal data and special personal data obtained from data owners by Ahsen Damla Topaloğlu (“ MAISON DT ”) operating at Çiğdemli Mah. Bilsa Konakları C Blok D:11 Ataşehir/ İstanbul.

DEFINITIONS

1) About the Data Controller

Your personal data and the data that falls within the scope of special personal data that you have shared with us during your membership application may be processed by MAISON DT within the scope and purposes specified below within the scope of the Law. MAISON DT is considered as the data controller within the scope of the Law.

2) General Principles in the Processing of Personal Data

Within the framework of Article 3/I(e) of the KVKK, any operation that can be performed on personal data, such as obtaining, recording, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, in whole or in part, by automatic means or non-automatic means provided that it is part of any data recording system, falls within the scope of "data processing".

MAISON DT processes personal data in accordance with the following principles:

• To be in compliance with the law and the rules of honesty,
• Being accurate and up-to-date when necessary,
• Processing for specified, clear and legitimate purposes,
• Being connected, limited and proportionate to the purpose for which they are processed,
• Preservation for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed.

In this context, your personal and/or special personal data obtained within the scope of KVKK and other legislation in written, verbal or electronic media by branches, affiliated companies belonging to MAISON DT as the Data Controller or through all kinds of channels including but not limited to websites; may be obtained, recorded, stored, preserved, changed, legally and for legal reasons or in the ways stipulated in KVKK. It may be shared and processed by MAISON DT with other persons and/or as deemed appropriate in line with legitimate interests.

3) Data Processed by MAISON DT

MAISON DT may process general and specific personal data with the explicit consent of the data subject or without explicit consent in the cases stipulated in Articles 5 and 6 of the KVKK.

Personal data and special personal data that can be processed in accordance with the legislation and the principles set out in the Information Text and MAISON DT's legitimate interests are listed below:

Personal Data:

Name, Surname, Date of Birth, Place of Birth, TR Identity Number, Identity Card (in case of employment),

Address Information,

Telecommunication records,

Records of e-mail and information systems services usage,

Login records,

Special Personal Data:

- Nationality - Marital Status - Health data (Including HES Code) - Biometric data - Criminal record information and ongoing case information

4) Purposes of Processing Personal Data

Within the scope of Articles 5 and 6 of the Personal Data Protection Law, we collect and process data in order to achieve our company purposes specified below, limited to the relevant purposes. These are;

• Carrying out activities in accordance with legislation
• Carrying out finance and accounting activities
• Execution of Loyalty Processes to Company / Products / Services
• Ensuring Physical Space Security
• Monitoring and Execution of Legal Affairs
• Conducting Communication Activities
• Conducting/Supervising Business Activities
• Obtaining and Evaluating Suggestions for Improving Business Processes
• Carrying out activities to ensure business continuity
• Carrying out logistics activities
• Carrying out the purchasing processes of goods / services
• Carrying out After-Sales Support Services for Goods/Services
• Execution of Goods / Services Sales Processes
• Execution of Goods / Services Production and Operation Processes
• Execution of Customer Relationship Management Processes
• Carrying out activities aimed at customer satisfaction
• Organization and Event Management
• Conducting Marketing Analysis Studies
• Carrying out advertising / campaign / promotion processes
• Carrying out social responsibility and civil society activities
• Execution of Contract Processes
• Tracking of Requests / Complaints
• Carrying out marketing processes for products/services
• Ensuring the Security of Data Controller Operations
• Providing Information to Authorized Persons, Institutions and Organizations
• Carrying out management activities
• Creating and Tracking Visitor Records

5) Transfer of Your Personal Data by MAISON DT Within the Scope of Its Purposes

Your personal data and data falling within the scope of special personal data, your data falling within the scope of personal data, limited to the realization of the above-mentioned purposes, may be transferred to MAISON DT, its shareholders, business partners, banks, consulates (if necessary) in accordance with the conditions specified in Articles 8 and 9 of the Law and your data may be processed by these institutions to which the transfer is made. Your personal data may be processed in the periods required by the personal data processing activity;

• To banks, in order to carry out the payment transaction,
• Institutions with which the Company has commercial, administrative or contractual relations,
• In order to fulfill our obligations arising from the legislation to legally authorized public institutions and organizations,
• Companies that provide information technologies and archive services,
• In order to fulfill the requirements of the information technologies used by our company, to the companies abroad in which our company is affiliated, to the companies providing servers abroad and these server support, and to the companies providing cloud computing services in cases where cloud computing is used,
• In order to ensure the functionality of the common database established by the Company for other suppliers,
• Professional consultants, accountants and auditors from whom the Company receives services,

It can be shared.

6) Method of Collecting Personal Data

Personal data is collected, used, recorded, stored and processed by MAISON DT by providing verbal, written and/or electronic information to personal data owners in a clear and understandable manner and, if necessary, by obtaining their explicit consent, by verbal, written and/or electronic means, in accordance with the law and the rules of honesty, in connection with and limited to the legitimate purposes clearly stated above, within the framework of the principle of proportionality.

We assure you that your personal data will not be processed by MAISON DT for purposes other than those specified in this information text, and will not be transferred to or stored by third parties located in the country or abroad.

7) Storage Period of Personal Data

Personal data must only be stored for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed. Accordingly, the Data Controller will comply with the periods stipulated in the legislation for the storage of the relevant data and will only store the data for the period necessary for the purpose for which they are processed. If there is no valid reason for further storage of a data, that data will be deleted or anonymized.

8) Security of Your Data Collected and Processed by MAISON DT

In order to prevent your personal data from being exposed to unauthorized access, lost or damaged in the environments where they are processed and stored, the Personal Data Security Guide requirements published by the KVKK Board are constantly processed and developed within the scope of continuous improvement.

9) Rights of the Personal Data Owner Listed in Article 11 of the Law

In accordance with Article 11 of the Personal Data Protection Law, everyone can apply to the data controller and obtain information regarding themselves;

a) Learning whether personal data is being processed,

b) Requesting information regarding the processing of personal data,

c) To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

d) To know the third parties to whom personal data is transferred, either domestically or abroad,

d) Request correction of personal data in case it is processed incompletely or incorrectly,

e) Request the deletion or destruction of personal data within the framework of the conditions set forth in Article 7,

f) To request that the operations carried out in accordance with clauses (d) and (e) be notified to third parties to whom personal data has been transferred,

g) To object to the emergence of a result to the detriment of the person himself/herself, by means of analysis of the processed data exclusively through automatic systems,

g) In case of any damage caused by the unlawful processing of personal data, the person has the right to demand compensation for the damage.

Application Methods Within the Framework of the Rights of the Interested Person

In accordance with the first paragraph of Article 13 of the Personal Data Protection Law, you can make your request to exercise your rights specified above, using the following methods and information, based on the “Communiqué on the Procedures and Principles of Application to the Data Controller”, dated March 10, 2018 and numbered 30356.

Necessary information in the application content;

1. Name and Surname of the applicant.

2. If the applicant is a citizen of the Republic of Turkey, his/her Turkish Identity Number; if not, his/her Passport number with his/her Nationality or his/her Identity Number, if any.

3. The applicant's place of residence or workplace address for notification.

4. The applicant's notification e-mail address, telephone or fax.

5. The applicant's subject of the request.

6. Information and documents regarding the applicant's request.

Application Methods;

1. The applicant can personally deliver the application to the above-mentioned MAISON DT address in a sealed envelope with a note on the envelope saying “Information Request Pursuant to the Personal Data Protection Law” and a written report.

2. The applicant may send notification to the above-mentioned MAISON DT address via a notary. The note "Information Request Pursuant to the Personal Data Protection Law" must be added to the notification envelope.

3. With the “Secure Electronic Signature” defined in the Electronic Signature Law No. 5070, the applicant can apply to MAISON DT’s “ info@maisondt.com ” address with the note “Information Request Required by the Personal Data Protection Law” in the subject line.

10) Deletion, Destruction or Anonymization of Personal Data

MAISON DT uses the methods of deletion, destruction and anonymization in accordance with the KVKK when destroying personal data:

• As a deletion method, deletion from the database is performed with a command.
• As a destruction method, data on paper is physically destroyed.
• As an anonymization method, masking is applied and the name, TR ID Number, etc. information that allows the identification of the personal data owner is removed, thus transforming the data into a data set that is impossible to recognize the personal data owner.

MAISON DT may, if necessary, engage an expert to destroy personal data on its behalf. In this case, personal data will be destroyed by the expert in this matter in a way that is irreversible, inaccessible, and secure.