General Information on Personal Data Law
The Law on the Protection of Personal Data No. 6698 (hereinafter referred to as KVKK) was enacted on March 24, 2016 and published in the Official Gazette No. 29677 on April 7, 2016. Some provisions of the KVKK came into force on the publication date, while others became effective on October 7, 2016.

Information as Data Controller
As the Data Controller under KVKK No. 6698, your personal data may be recorded, stored, updated, classified, disclosed/transferred to third parties where legally permitted, and processed in accordance with the purposes explained on this page.

How Your Personal Data May Be Processed
Under KVKK No. 6698, personal data you share with our company may be processed fully or partially, automatically or manually as part of any data recording system. Processing may include recording, storing, modifying, restructuring, or any other operations performed on the data. All operations performed on personal data under KVKK are considered “processing of personal data.”

Purposes and Legal Basis for Processing Your Personal Data
The personal data you share may be processed for the following purposes and legal grounds:

• To provide services to our customers in accordance with contractual and technological requirements and to improve the products and services we offer;

• To identify the data owner, including recording identity, address, and other necessary information, in compliance with Law No. 6563 on Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce (Official Gazette No. 29457, 26.08.2015), Distance Contracts Regulation (Official Gazette No. 29188, 27.11.2014), and other relevant legislation;

• To manage payment systems, electronic contracts, or paper-based documentation required in banking and electronic payment fields, and to fulfill legal obligations related to information storage, reporting, and notification;

• To provide information to public authorities, prosecutors, courts, and other relevant officials when requested, in matters related to public security or legal disputes.

Third Parties to Whom Your Personal Data May Be Transferred
For the purposes stated above, your personal data may be transferred to:

• Service providers supporting our e-commerce infrastructure, including IdeaSoft Yazılım San. ve Tic. A.Ş.;

• Suppliers, cargo/shipping companies, and other relevant service providers;

• Program partner organizations and other third parties cooperating with us, domestically or internationally, acting as Data Processors;

• Other relevant third parties involved in the provision of services.

Collection Methods of Personal Data
Your personal data may be collected:

• Via forms on our website and mobile applications, including name, surname, national ID number, address, phone number, work/personal email addresses, as well as preferences, transaction IP logs, cookie data, browsing duration, and location data;

• Through verbal, written, or electronic communication by our sales and marketing staff, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call centers;

• From individuals sharing personal data for purposes such as establishing business relationships, submitting applications, providing proposals, either physically or virtually, in person or remotely, verbally, in writing, or electronically;

• Indirectly via websites, blogs, contests, surveys, games, campaigns, newsletters, publicly available databases, and social media platforms.

Personal Data Obtained Before KVKK Enforcement
Personal data lawfully collected before April 7, 2016, including membership, electronic communication consent, product/service purchases, and other means, continues to be processed and retained according to the conditions outlined in this document.

Transfer of Personal Data Abroad
Personal data collected in Turkey or processed/stored abroad may be transferred to service intermediaries located outside Turkey, provided that they comply with KVKK and the purposes of the contract. Transfers may only be made to countries accredited by the Personal Data Protection Board and having adequate data protection.

Storage and Protection of Personal Data
Your personal data will be stored confidentially in our company’s databases and systems, in accordance with Article 12 of KVKK. Data will not be shared with third parties except where legally required or stated in this document. Our company is responsible for:

• Preventing unlawful processing of personal data;

• Blocking unauthorized access;

• Implementing software and physical security measures;

• Reporting any unauthorized access or unlawful data processing to the Personal Data Protection Board immediately in writing.

Updating and Accuracy of Personal Data
According to Article 4 of KVKK, our company is obliged to keep your personal data accurate and up to date. Customers must provide correct and current data or update their information via the website or mobile application to ensure compliance with legal obligations.

Rights of Personal Data Owners under KVKK No. 6698
As of October 7, 2016, under Article 11 of KVKK, the personal data owner has the right to:

• Learn whether personal data is being processed;

• Request information if personal data has been processed;

• Learn the purpose of processing and whether data is used appropriately;

• Know third parties, domestic or foreign, to whom data has been transferred;

• Request correction of incomplete or inaccurate data;

• Request deletion or destruction of personal data under conditions defined in Article 7 of KVKK;

• Request notification of third parties in case of correction, deletion, or destruction;

• Object to automated data processing that may result in adverse outcomes for themselves;

• Request compensation if damage is caused by unlawful data processing.

Data Controller Contact Information
Company Name: Hakiki Ürün E-Ticaret A.Ş.
Registered with Istanbul Chamber of Commerce: 1057476
MERSIS Number: 455117792000001
Address: Sırapınar Mah. Beykoz Cad. No:182 Çekmeköy/Istanbul
Email: info@hakiki.tr
Phone: 02166294455

The Data Controller Representative appointed by our company will be announced in the Data Controllers Registry and on the company website once legal infrastructure is established.