Data Protection Disclosure (KVKK)

We frequently collect data from you in the online environment. Personal data and/or special categories of personal data received and recorded during your visit to our website are processed in compliance with the KVKK. In this context, KARAVAN, in its capacity as data controller, receives and safeguards your data within legal limits. We would also like to state that all personal data and/or special categories of personal data received during your visit to our website are also protected within the framework of our Privacy Policy, which you can review on our page.

This disclosure text has been prepared by KARAVAN in its capacity as data controller within the scope of Article 10 of the KVKK and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation.

Personal data is defined in the KVKK as "any information relating to an identified or identifiable natural person". As can be understood from the definition, any information that makes you identifiable is personal data. In addition, political opinion, sect, race, religion, association/foundation membership, health information, philosophical belief, faith, sexual preference, criminal record, criminal conviction information and biometric data are special categories of personal data.

If you become a member of the Karavan Platform through the Karavan website, the following personal data are processed:

• Your User Account Information: your name, surname, customer number, membership e-mail address and, if you add them to your user information, your phone number, gender, date of birth, height and weight information, and Turkish ID number,

• Your Customer Transaction Information: your order and invoice information, transaction history regarding your purchases, your request and complaint information, your Platform usage information, information you personally share within your comments and questions about products on the Platform, your rating and review information, information regarding conversation content via the chat channel, and your cancellation/return information,

• Your Delivery Information: the phone number and delivery address you add for the delivery of the product you ordered, and your delivery transaction information,

• Your Payment Information: information regarding payments you make and payment methods, and your saved card information,

• Your Transaction Security Information: your device information, IP address information, password and passphrase information, cookie information, platform access records, and your login method,

• Your Legal Transaction Information: information in correspondence with authorised persons, institutions and organisations, information in lawsuit and enforcement files, and your legal information request information,

• Your Audio Recording Information: your voice recording in the event you speak with the call centre,

• Your personal data processed within the scope of additional services: data processed if you benefit from additional services offered on the Platform such as shipping, financial services and insurance.

Your personal data is collected by our Company by fully or partially automated means, or by non-automated means provided that it is part of a data recording system; in electronic form through your visit to the Karavan website or, within the scope of our membership agreement, through the mobile application or websites on which our Platform is hosted; in electronic form through the relevant channel when you contact us via live help, the call centre or e-mail; and in physical form where it is transmitted to our Company by printed forms, notification or post, or served by legal authorities.

The KVKK requires that persons whose data is processed be informed before any data-processing activity is carried out. This matter, deemed the Disclosure Obligation, is set out in Article 10 of the Law, which provides that, when obtaining personal data, the data controller is obliged to inform the relevant persons about the identity of the data controller and its representative, if any; the purpose for which the personal data will be processed; to whom and for what purpose the processed personal data may be transferred; the method and legal grounds for collecting personal data; and the other rights listed in Article 11.

Article 3 of the Law defines the data controller as the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. In this context, the data controller is KARAVAN DIŞ TİCARET TEKNOLOJİ HİZMETLERİ ANONİM ŞİRKETİ, whose website you are visiting.

Data Controller: KARAVAN DIŞ TİCARET TEKNOLOJİ HİZMETLERİ ANONİM ŞİRKETİ — Address: Merkez Mah. Hasat Sk. Kamara No: 52 İç Kapı No: 1 Şişli/İstanbul — E-mail: info@karavan.net

In accordance with the explanations above, the data controller is KARAVAN DIŞ TİCARET TEKNOLOJİ HİZMETLERİ ANONİM ŞİRKETİ. In its capacity as data controller, in this Disclosure Text KARAVAN informs and enlightens you about by whom and for what purpose personal data may be processed, to whom and for what purpose it may be transferred, the method and legal grounds for collecting the data, and the rights the data subject has regarding the protection of personal data.

Your personal data is processed within the limits prescribed by the KVKK and based on the principles of the Law. Within the framework of the Law, our purposes of data processing are as follows:

• Improving the quality of the products and services offered to you,

• Promptly informing you of innovations within the Company and of the products and services offered,

• Identifying person-specific needs and purposes of use, and in this context providing tailored goods and services to our customers,

• Conducting our Company's commercial activities and providing complete performance to you,

• Informing you about our changing and developing products and services and providing disclosure where necessary,

• Enabling you to benefit in the best way from the products and services offered by our Company,

• Developing, determining and placing on a secure footing our commercial partnerships and strategies, and making correct decisions in our commercial policies and management processes,

• Placing our corporate identity on a solid footing and ensuring corporate functioning,

• Achieving the goals of our internal policies and thereby increasing customer satisfaction,

• Ensuring information security,

• Developing the goods and services offered over the internet,

• Resolving any problems experienced quickly,

• Contacting those who submit requests and complaints,

• Ensuring compliance with the provisions of the Privacy Policy on our website.

When processing your personal data, we adopt the following principles:

• Retaining it for the period prescribed in the relevant legislation or necessary for the purpose for which it is processed,

• Processing it lawfully,

• Keeping the data up to date,

• Acting in accordance with the rules of good faith,

• Not using it outside the purpose for which it is processed,

• Keeping it proportionate and limited to the purpose for which it is processed,

• Processing it in accordance with general morality and custom,

• Processing it in accordance with the provisions of all relevant legislation, primarily the provisions of the KVKK.

Your personal data may be processed by our Company in two situations: (1) explicit consent and (2) cases of compliance with the Law (cases not requiring explicit consent).

The KVKK states that in some cases explicit consent is not required for the processing of personal data. These cases, specified in Article 5, paragraph 2 of the Law, are as follows:

• It is expressly provided for in the laws,

• It is necessary for the protection of the life or bodily integrity of the person who is unable to express their consent due to actual impossibility, or whose consent is not legally valid, or of another person,

• Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract,

• It is necessary for the data controller to fulfil its legal obligation,

• It has been made public by the data subject themselves,

• Data processing is necessary for the establishment, exercise or protection of a right,

• Provided that it does not harm the fundamental rights and freedoms of the data subject, data processing is necessary for the legitimate interests of the data controller.

In the presence of these situations, we have the right to process data without your explicit consent.

We have the right to process special categories of personal data other than those concerning health and sexual life without seeking explicit consent in cases provided for in the laws. Personal data concerning health and sexual life may only be processed without seeking the explicit consent of the data subject by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, medical diagnosis, the carrying out of treatment and care services, and the planning and management of health services and their financing.

In developing and changing technological conditions, our Company collects data from different channels. The website is also one of the areas where we collect personal data by automated means.

Personal data and/or special categories of personal data collected through the website are processed based on one or more of the legal grounds in Articles 5 and 6 of the Law, or on the condition of explicit consent. We would like to state that the relevant person is provided with disclosure according to the category and type of data processed; that in such disclosure texts an explanation is provided regarding the purpose for which the data will be processed, to whom and for what purpose the processed data may be transferred, the method and legal grounds for collecting the data, and the rights of the relevant person; and that explicit consent is obtained where necessary.

Transfer: Your data is transferred to third parties where necessary, in compliance with the Law and in accordance with the conditions in our confidentiality agreements. For each data transferred, a detailed explanation is provided in the disclosure made before the data is obtained, regarding for what purpose and to whom the data may be transferred. In any case, when transferring data, our Company acts in accordance with Articles 8 and 9 of the Law and takes the necessary technical and administrative measures.

Protection: The KVKK primarily aims to protect data and prevent unauthorised transfer. In order to prevent the transfer of data to unauthorised third parties, primarily in accordance with the provisions of the Law, we take the necessary technical and administrative measures. In this context, we bring our internal policies into compliance with the KVKK and maintain all kinds of technical software and hardware aimed at protecting personal data. We endeavour to prevent both our employees and the third parties with whom we work from acting contrary to our Privacy Policy.

The rights of the data subject are set out in Article 11 of the KVKK. In the Law, the data subject is referred to as the "relevant person", and is granted the right to make certain requests regarding the processing of their data. The request rights of the relevant person are as follows:

• To learn whether their personal data is processed,

• To request information if their personal data has been processed,

• To learn the purpose of processing personal data and whether it is used in accordance with its purpose,

• To know the third parties to whom personal data is transferred domestically or abroad,

• To request the correction of personal data in the event that it has been processed incompletely or incorrectly,

• To request the deletion or destruction of personal data within the framework of the conditions provided for in Article 7 of the Law,

• To request that the correction of incompletely or incorrectly processed data, or its deletion or destruction upon request, be notified to the third parties to whom the personal data has been transferred,

• To object to the emergence of a result against the person themselves through the analysis of the processed data exclusively by automated systems,

• To request compensation for damage in the event of suffering damage due to the unlawful processing of personal data.

You may submit your requests regarding your rights arising from the KVKK explained above to our Company within the framework of the procedure specified in this Disclosure Text. Your requests will be answered as soon as possible or within thirty days at the latest. Applications must be made personally by the data subject themselves.

You may submit your requests regarding the rights stated above to our Company, which holds the title of data controller, in writing or by using a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the electronic mail address you previously notified to the data controller and which is registered in the data controller's system. To exercise your request rights regarding personal data, you may review the information on our website and use the "Information Request Form Under the Personal Data Protection Law No. 6698" available on our website.

The information that must be included in your application is as follows:

• Your name and surname,

• Your Turkish ID number,

• If you are a foreign national, your nationality, passport number or ID number, if any,

• Your wet signature at the bottom of the request form if a written application is to be made,

• The content of your request pursuant to Article 11 of the KVKK,

• Telephone and fax numbers by which we can reach you,

• Your e-mail address by which we can reach you,

• Your residence or workplace address for service of notice.

Our Company's details: Data Controller — KARAVAN DIŞ TİCARET TEKNOLOJİ HİZMETLERİ ANONİM ŞİRKETİ; Address — Merkez Mah. Hasat Sk. Kamara No: 52 İç Kapı No: 1 Şişli/İstanbul; E-mail — info@karavan.net.