Information Disclosure Text For Customers Within The Scope Of LPPD

ARCO MAĞAZACILIK SİSTEMLERİ A.Ş.

INFORMATION DISCLOSURE TEXT FOR CUSTOMERS WITHIN THE SCOPE OF LPPD

In line with the importance we attach, as the Data Controller, to the security of your personal data, any personal data of you, processed in our company, are processed, stored and transferred in accordance with the Law on the Protection of Personal Data No. 6698 (LPPD).

The purpose of the "Communiqué on the Procedures and Principles to be Followed in the Fulfillment of the Information Disclosure Obligation", which was published in the Official Gazette no. 30356 dated 10.03.2018, was defined in its article one, as "To determine the procedures and principles to be followed within the scope of the information disclosure obligation to be fulfilled by data controllers or those authorized by them in accordance with article 10 of the Law on Protection of Personal Data no. 6698”.

This information disclosure text was prepared to inform

Real Person Arcoglobal Customers, whose personal data are collected, stored and processed by our company as the data controller, in accordance with Article 10 titled "Information Disclosure Obligation of the Data Controller” of the Law on the Protection of Personal Data and the Communiqué on the Procedures and Principles to be Followed in the Fulfillment of the Information Disclosure Obligation.

PURPOSES FOR WHICH YOUR PERSONAL DATA ARE PROCESSED

Your personal data are processed, within the scope of article 4 titled “General Principles” of the Law on the Protection of Personal Data, in accordance with the principles of being lawful and in compliance with the principle of honesty, being accurate and, when necessary, up-to-date, being processed for specific, clear and legitimate purposes, being relevant, limited and proportionate to the purpose for which they are processed, and being stored for the period that is set forth in the applicable legislation or is necessary for the purpose for which they are processed.

In this context, data processing does not exceed the purpose of processing and legal requirements.

Information on the purposes of processing of your personal data processed, and which of the data processing conditions specified in articles 5 and 6 of the Law was relied upon in the processing of personal data within the scope of the information disclosure obligation, are given below.

Your identity information; (Name, surname, Turkish ID number)

In order to fulfill the legal obligations as required or prescribed by legal regulations; for the legal grounds specified in Article 5/2-a of LPPD: where it is prescribed by laws.

In order to carry out the procedures and transactions related to the contracts that were signed, to manage the relations with the customers, to carry out the purchasing / sales of goods and services and financial processes, and to provide information about the services; for the legal grounds specified in Article 5/2-c of LPPD: where processing of personal data belonging to parties to a contract is necessary, provided that it is directly related to conclusion or performance of the contract.

In order to track requests and complaints, to manage the storage and archiving activities, to plan logistics activities, and to manage the customer satisfaction practices;

for the legal grounds specified in Article 5/2-f of LPPD: where it is mandatory to process data for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not infringed.

• Within the framework of the provisions of article 229 et seq. of the Tax Procedure Law, in order to issue invoices and delivery notes and to create accounting records.

Your contact information: (Delivery address, business address, phone number, mobile phone number, e-mail address, IP address)

In order to carry out the procedures and transactions related to the contracts that were signed, to manage the communication with the customers and to carry out the purchasing / sales of goods and services and financial processes; for the legal grounds specified in Article 5/2-c of LPPD: where processing of personal data belonging to parties to a contract is necessary, provided that it is directly related to conclusion or performance of the contract,

In order to carry out logistics activities, to perform after-sales support services and to inform the customer about the transactions; for the legal grounds specified in Article 5/2-f of LPPD: ‘where it is mandatory to process data for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not infringed’.

For the fulfillment of the financial obligations within the framework of the provisions of article 229 et seq. of the Tax Procedure Law, in order to issue invoices and delivery notes, to deliver to you the documents issued, and to archive these documents.

Your mobile phone number and e-mail address;

In accordance with the Law on the Regulation of Electronic Commerce No. 6563 and relevant legislation, in order to receive approvals and codes for delivery of goods, and to send promotions, advertising, product offers, campaigns, satisfaction assessment studies and our company’s announcements within the scope of our services, by using your means of communication (SMS, e-mail, phone), provided that your express consent is obtained.

Your customer and membership contracts,

In order to fulfill the requirements of the contracts concluded with the customer, to carry out the purchasing / sales of goods and services and financial processes, and to provide the legal infrastructure of buying and selling transactions,

In order to establish the legal basis, within the scope of the regulations on the Protection of the Consumer, and to conclude distance sales contracts,

for the legal grounds specified in Article 5/2-c: where processing of personal data belonging to parties to a contract is necessary, provided that it is directly related to conclusion or performance of the contract

Information on your legal proceedings;

In order to carry out and track legal proceedings, to fulfill our legal obligations towards authorized and competent public institutions and organizations and courts, and to use the same as evidence in disputes that may arise; for the legal grounds specified in Article 5/2-a of LPPD: where it is prescribed by laws, and in Article 5/2-ç of LPPD: where processing of data is mandatory for the data controller to fulfill its legal obligations,

In order to fulfill the legal obligations required to be fulfilled within the framework of the Code of Obligations, the legislation on the protection of the consumer and financial legislation,

Your financial information; (tax number, tax office, bank account number, bank IBAN number, invoice and e-invoice date, service document number, service fee, invoice registration number, payment date, payment method), and your identity and contact information;

In order to open accounting records and current cards, to carry out finance and accounting affairs, to Make payments and collections, to carry out financial operation processes, and to providing the information requested by legally authorized institutions, for the legal grounds specified in Article 5/2-a of LPPD: where it is prescribed by laws, and in Article 5/2-ç: where processing of data is mandatory for the data controller to fulfill its legal obligations

Within the framework of the provisions of article 229 et seq. of the Tax Procedure Law, in order to issue and record invoices and delivery notes, and to fulfill financial obligations

(Your Republic of Turkey identity information, card holder name and surname, card number, card security number, card expiration date, and information on the products purchased and their prices), and your contact, e-mail, phone and address information;

In order to receive the technical infrastructure service that serves to make the payment transaction through payment channels, the card storage service, the server and security infrastructure service and the service of storage of transmitted SMS and e-mail messages and order transaction information, from foreign service providers, provided that your express consent is obtained.

.

TRANSFER OF YOUR PERSONAL DATA TO THIRD PARTIES, AND THE PURPOSE THEREOF

Our Company acts in compliance with the provisions of Article 5 the Law, the regulations in Article 6 regarding the processing of Private Personal Data and in Articles 8 and 9 regarding the transfer of personal data, and the decisions published by the Personal Data Protection Board.

Private personal data are not processed or transferred without the express consent of the data subject.

The persons and institutions to which your personal data are transferred, for what purposes and for what legal grounds, are given below.

Your identity information

Your name, surname and Turkish ID number;

To authorized and competent public institutions and organizations in order to fulfill the obligations arising from the legislation within the scope of the Law and other legislation, and to supervisory and regulatory institutions in order to provide information in accordance with the legislation, for the legal grounds specified in Article 5/2-a of LPPD: where it is prescribed by laws.

Your name, surname, ID number, mobile phone number and e-mail address, and your tax office, tax number and invoice and payment information in the financial data category;

To third parties from whom we receive consultancy, including tax and financial advisors, and to authorized and competent public institutions and organizations, in order to audit and control transactions, and to supervisory and regulatory institutions and data processors in order to provide information in accordance with the legislation; for the legal grounds specified in Article 5/2-a of LPPD: where it is prescribed by laws, and in Article 5/2-e: where it is mandatory to process data to establish, exercise or protect a right,

Your name, surname, phone number and e-mail address and order information;

To contracted suppliers of goods and services, to our business partners, and to third parties from whom we receive distribution, maintenance, after-sales support and logistics services, in order to carry out the processes of goods / services and operation processes, for the legal grounds specified in Article 5/2-f of LPPD: where it is mandatory to process data for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not infringed.

Information on your legal proceedings;

To any judicial authority, to your authorized representatives and attorneys, and to other authorized public institutions, in order to ensure the performance/tracking of legal proceedings, to carry out legal activities, and to create evidence for legal disputes that may arise; for the legal grounds specified in Article 5/2-a of LPPD: where it is prescribed by laws, and in Article 5/2-ç of LPPD: where processing of data is mandatory for the data controller to fulfill its legal obligations,

Your financial information; (tax number, tax office, bank account number, bank IBAN number, order information, payment date, payment method, invoice and e-invoice date, service document number, service fee, invoice registration number) as well as your name, surname, card holder name and surname ID no. and mobile phone number and e-mail address information in the category of identity and contact information;

To banks and financial institutions in order to carry out finance, accounting and payment transactions, for the legal grounds specified in Article 5/2-e of LPPD: where it is mandatory to process data to establish, exercise or protect a right.

In order to set out the rights and obligations of the parties in case of a possible refunding and on legal matters,

Your name, surname, ID number and mobile phone number and e-mail address and tax number, tax office, card number, card security number, card expiration date, information on the products purchased and their prices, and your invoice and payment information;

To authorized public institutions, and to third parties from whom we receive consultancy, including tax and financial advisors, in order to audit and control transactions; for the legal grounds specified in Article 5/2-a of LPPD: where it is prescribed by laws, and in Article 5/2-e of LPPD: where it is mandatory to process data to establish, exercise or protect a right

Your name, surname, phone number and e-mail address and order information;

To suppliers of goods and services, to our business partners, and to third parties from whom we purchase goods and services, in order to carry out the processes of goods / services and operation processes; for the legal grounds specified in Article. 5.2-f: where it is mandatory to process data for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not infringed.

.

Your financial information, (your Republic of Turkey identity information, card holder name and surname, card number, card security number, card expiration date, and information on the products purchased and their prices), and your contact, e-mail, phone and address information;

will be transferred to foreign service providers, in order to receive the technical infrastructure service that serves to make the payment transaction through payment channels, to perform the card storage service, to receive the server and security infrastructure service, and to store transmitted SMS and e-mail messages and order transaction information, provided that your express consent is obtained.

Your phone number and e-mail address are disclosed to message management system integration companies.

METHOD OF AND LEGAL GROUNDS FOR COLLECTION OF YOUR PERSONAL DATA

Your personal data are collected, through your information obtained automatically through our Website and Mobile application or our social media accounts, digital platforms, forms and mobile communication, e-mail, short message (SMS) and cookie applications, and through your information obtained physically through your petitions and applications, legal notices, printed forms and your correspondences, and they are stored taking into account the legal periods and the periods required by the transactions.

The “legal grounds” specified in sub-paragraph (ç) of paragraph one of article 10 of the Law, refers to which of the data processing conditions specified in articles 5 and 6 of the Law was relied upon in the processing of personal data within the scope of the information disclosure obligation.

Information on which of the data processing conditions specified in Articles 5 and 6 of the Law titled “processing conditions for private personal data” was relied upon in the processing of your personal data, is included in the section titled 'Purposes for Which Your Personal Data are Processed' of the Information Disclosure Text.

In our company, data are not collected without a valid purpose and a valid legal grounds or express consent.

YOUR RIGHTS

In accordance with Article 10 of LPPD, ARCO MAĞAZACILIK SİSTEMLERİ A.Ş. informs the personal data subject of his/her rights and guides the data subject on how to exercise these rights.

Rights of data subjects are set out in Article 11 of LPPD.

Pursuant to Article 11 of LPPD, you are entitled, by applying to our Company:

a) To learn whether or not your personal data are processed,

b) To request information on the procedure, if your personal data have been processed,

c) To learn the purpose of processing of your personal data and whether or not they are used in line with their intended purpose,

ç) To obtain information about third parties to whom your personal data have been transferred domestically or abroad,

d) To request the correction of your personal data that may have been processed incompletely or inaccurately,

e) To request the deletion or destruction of your personal data within the scope of the conditions set forth in Article 7,

f) To request that the third parties to whom your personal data have been transferred are informed of the operations carried out pursuant to sub-paragraphs (d) and (e),

g) To object to the emergence of an outcome which is to the detriment of the data subject as a result of the analysis of the data processed, exclusively through automated systems,

ğ) To request compensation for damages in case you incur damages due to the unlawfully processing of your personal data.

In case you wish to exercise your right to apply under Article 13 of LPPD;

You may submit your application by hand to Ikitelli OSB Mah. Hurriyet Bulvari No:54 Basaksehir Istanbul / Turkey in writing and wet signed, or send it through a notary public, or send it to [email protected] (Registered E-Mail Address) with a secure electronic signature, or through your e-mail address that has been previously notified by you to our company and registered in our company's system,

Applications must specify;

Name and surname of the Data Subject, and his/her signature if the application is written,

Turkish ID number for Turkish citizens, and nationality, passport number, or identity number, if any, for foreigners,

Residential or business address for notification,

Electronic mail address, phone and fax number for notification, if any, and

Subject of request, and the information and documents concerning the subject must be enclosed with the application.

The applications will be accepted following the identity verification by ARCO MAĞAZACILIK SİSTEMLERİ A.Ş., and replied in writing or electronically within due legal periods.

Your requests covered by your application will be concluded free of charge, within thirty (30) days depending on the nature of the request.

INFORMATION ON THE DATA CONTROLLER

Trade Name of the Company : ARCO MAĞAZACILIK SİSTEMLERİ A.Ş.

Phone : 0212 485 08 60

Address : İkitelli OSB Mahallesi, Hürriyet Bulvarı, No:54 Başakşehir/İSTANBUL

E-mail : [email protected]

Registered E-mail Address : [email protected]