Privacy Notice for Website Users

This is an English translation of the original Turkish text. In case of any discrepancy, the Turkish version shall prevail.

As Alpaya Doğal ve Kozmetik Ürünleri Sanayi ve Ticaret Anonim Şirketi (the “Company”), we care about the security of your personal data. We protect all personal data shared with us with respect for your privacy, taking all necessary administrative and technical measures. With this responsibility in mind, and in our capacity as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and related legislation, we process your personal data lawfully within the framework described below. With this privacy notice, we aim to fulfil our legal obligation to inform our website users about the personal data processed while they use our website.

1. Personal Data Processed

While you use the website, we process your name and surname, phone number, email address, IP address, website log-in and log-out information, password information used on the website, shopping history, survey and cookie records, and information obtained through campaigns.

2. Purposes of Processing

The personal data you provide while using our website is processed for the following purposes:

• Communicating with you;
• Confirming communication and carrying out information and consultation processes about our Company’s services and campaigns;
• Marketing activities;
• Communication during pre-contractual discussions;
• Carrying out information security processes;
• Improving the services offered;
• Fixing errors related to website services;
• Promoting the goods and services offered by our Company, getting to know our members and/or customers, increasing communication and improving our products, services and communication;
• Preparing and sending promotions, campaigns and announcements for members;
• Carrying out customer surveys and customer satisfaction communications;
• Audit, data analysis, statistical work, research, understanding current trends, and use in sales, marketing and advertising services;
• Carrying out marketing analysis;
• Ensuring the legal, technical and commercial security of the Company and of persons in a business relationship with the Company;
• Fulfilling the obligations undertaken under contracts concluded in accordance with the relevant legislation, fulfilling our legal obligations and exercising our rights arising from the legislation in force;
• Ensuring transaction and information security and preventing transactions that may involve fraudulent or illegal activities;
• Providing information to public officials upon request and as required by law on matters related to public security;
• Carrying out improvement processes to provide customers with a better shopping experience;
• Using as evidence in possible disputes;
• Following up and resolving your requests and complaints.

3. Legal Grounds for Processing

Personal data processed as a result of your use of our website is processed on the legal grounds set out in Article 5 of KVKK: it is expressly provided for by law; processing is necessary for the establishment, exercise or protection of a right; processing is necessary provided that it is directly related to the conclusion or performance of a contract; processing is necessary for the data controller to fulfil its legal obligations; and explicit consent.

4. Transfer of Your Personal Data

Your personal data is not transferred abroad.

In order to provide our services, your personal data may be transferred to relevant persons and/or institutions, to our business partners, and to the real and legal persons from whom we receive services or with whom we cooperate as program or service partners in order to carry out our activities. Where required by law, it is shared with judicial authorities upon request.

5. Method of Collecting Personal Data

We collect personal data when you visit our website, become a member of our website or fill in the contact form to get in touch with us.

6. Your Rights Regarding the Protection of Personal Data

Under the Law and related legislation, you have the right to:

• Learn whether your personal data is processed;
• Request information if your personal data has been processed;
• Access and request your personal health data;
• Learn the purpose of processing and whether your data is used in line with that purpose;
• Know the third parties in Turkey or abroad to whom your personal data is transferred;
• Request correction of your personal data if it is incomplete or inaccurate;
• Request deletion or destruction of your personal data;
• Request that the third parties to whom your personal data has been transferred are notified of any correction, deletion or destruction;
• Object to a result against you arising from the analysis of your data exclusively through automated systems;
• Claim compensation for damages if you suffer loss due to unlawful processing of your personal data.

7. Data Security

The Company strives to maintain appropriate physical, technical and administrative security at its workplaces and in its information systems, in order to prevent personal data from being lost, misused, accessed without authorisation, disclosed or altered. We protect our website and other systems by taking the necessary technical and organisational measures against loss, destruction, unauthorised access, and alteration or disclosure of your personal data by unauthorised persons.

Where our website links to other applications, the Company accepts no responsibility for the privacy policies or content of those applications.

8. Retention Period of Your Personal Data

The provisions of the Data Retention and Destruction Policy of Alpaya Doğal ve Kozmetik Ürünleri Sanayi ve Ticaret Anonim Şirketi apply to the storage, deletion and destruction of personal data. Your marketing and transaction security data will be stored for two years. Your other personal data will be stored for ten years.

9. Right to Apply

All requests regarding personal data will be answered by the KVKK Committee of Alpaya Doğal ve Kozmetik Ürünleri Sanayi ve Ticaret Anonim Şirketi.

For requests under the Law, you can submit information and documents identifying you online via our website www.acnevit.com, or prepare your request in line with the conditions set by the Personal Data Protection Authority and send it to the Company using the methods below:

• (i) In person with a wet signature, or through a notary, to our postal address: Akçaburgaz Mahallesi 1573 Sokak No: 1/27, Esenyurt / İstanbul, Turkey;
• (ii) By email to info@alpaya.com.tr from the email address you have previously provided and that is registered in our system (please check the email address registered in our system), or with a secure electronic or mobile signature.

Please check the current application methods and content requirements in the legislation beforehand. Applications that do not meet the content requirements set by the Personal Data Protection Authority, or that are sent by methods not accepted by the Authority, will not be accepted. The Company will conclude your request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on its nature. If fulfilling your request incurs a cost, we may only charge the fees set out in the tariff determined by the Personal Data Protection Board.