PRIVACY AND COOKIE POLICY

FEVUP BRANDS E-COMMERCE AND INFORMATION TECHNOLOGIES JOINT STOCK COMPANY (“FEVUP”)

UNDER LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA

PRIVACY AND COOKIE POLICY

1. INTRODUCTION

FEVUP Brands E-Commerce and Information Technologies Joint Stock Company (“FEVUP”), acting as the Data Controller pursuant to Law No. 6698 on the Protection of Personal Data (“KVKK” or the “Law”), provides this Privacy and Cookie Policy to inform Data Subjects about the processing of personal data and their rights in relation to such processing.

2. DEFINITION OF PERSONAL DATA

Personal data means any information relating to an identified or identifiable natural person (Article 3 of the KVKK).

In other words, personal data includes any information concerning an individual’s personal, professional or other characteristics that makes it possible to distinguish that individual from others and identify their particular characteristics.

3. PROCESSING OF PERSONAL DATA

3.1.

Processing of personal data means any operation performed on personal data, whether wholly or partly by automated means or by non-automated means provided that such processing forms part of a data recording system, including the collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, acquisition, making available, classification or restriction of use of such data.

3.2.

Pursuant to Article 4 of the KVKK, personal data processing activities carried out by FEVUP are conducted in accordance with the following principles:

• Lawfulness and fairness;

• Accuracy and, where necessary, being kept up to date;

• Processing for specified, explicit and legitimate purposes;

• Being relevant, limited and proportionate to the purposes for which the data is processed; and

• Retention for the period stipulated under applicable legislation or for the period necessary for the purposes for which the data is processed.

4. DATA CONTROLLER

The Data Controller is the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

In this context, FEVUP, operating at Beştepe Mah. Nergiz Sok. No:7A-14 Kat:8 Via Tower, Yenimahalle/Ankara, Türkiye, acts as the Data Controller.

5. DATA SUBJECT

The term Data Subject refers to the natural person whose personal data is processed.

Data Subjects have a number of rights guaranteed by law for the protection of their fundamental rights and freedoms in personal data processing activities. Under the KVKK, only natural persons may qualify as Data Subjects; legal entities do not have Data Subject status.

6. PERSONAL DATA PROCESSED IN RELATION TO THE DATA SUBJECT

FEVUP processes the following personal data through its website:

• Transaction Security Data: IP Address, Log Records, Website Login/Logout Records

• Marketing Data: Cookie Records

Pursuant to Articles 3 and 7 of the KVKK, data that has been irreversibly anonymized shall not be considered personal data under the provisions of the KVKK. Processing activities relating to such anonymized data may therefore be carried out without being subject to the provisions of this Policy.

7. METHODS AND LEGAL GROUNDS FOR THE COLLECTION OF PERSONAL DATA

Personal data processed within the scope of this Policy is collected electronically by FEVUP through website log records and cookies for the purpose of carrying out its activities.

Personal data collected within the scope of this Policy is processed in accordance with the KVKK and other applicable legislation on the basis of:

• FEVUP’s legitimate interests, where applicable;

• Processing being expressly provided for by law; or

• The explicit consent provided by the Data Subject to FEVUP.

8. PURPOSES OF PROCESSING PERSONAL DATA

Within the scope of this Policy, personal data is processed for the following purposes:

• Fulfilling obligations under Law No. 5651;

• Carrying out information security processes;

• Providing information to authorized persons, institutions and organizations;

• Ensuring that activities are conducted in compliance with applicable legislation; and

• Conducting marketing analysis activities.

9. TRANSFER OF PERSONAL DATA

Provided that all necessary security measures are implemented, FEVUP may transfer personal data within Türkiye in accordance with Article 8 of the Law and for the purposes specified in this Policy.

Personal data may be transferred for the purposes of fulfilling legal obligations, carrying out business processes with support from external service providers, analyzing website visitor data, evaluating user behavior, preparing internal reports, and cooperating in advertising, campaign and promotional activities to the following recipient groups:

• Suppliers

• Authorized Public Institutions and Organizations

10. RETENTION AND DELETION OF PERSONAL DATA

10.1.

Where a retention period is prescribed by applicable legislation for personal data processed by FEVUP in accordance with Articles 4 and 7 of the Law, FEVUP determines and complies with such retention period.

Where no specific retention period is prescribed by applicable legislation, personal data is processed and retained only for as long as necessary for the purposes for which it was processed.

Where there is no longer a valid reason for retaining personal data, such data is deleted, destroyed or anonymized.

10.2.

FEVUP does not retain personal data on the basis that it may potentially be used again in the future or for any other purpose where there is no valid legal or operational basis for its continued retention.

11. MEASURES TAKEN TO PROTECT PERSONAL DATA

FEVUP implements various administrative and technical measures to ensure that personal data is processed, accessed and retained in accordance with the law.

Policies relating to the protection of personal data are established, training is provided regarding the necessary technological infrastructure, and both technical and administrative studies and planning activities are carried out.

Such measures include, but are not limited to, the following:

• Network and application security measures are implemented.

• Security measures are implemented within the scope of the procurement, development and maintenance of information technology systems.

• Disciplinary regulations containing data security provisions are in place for employees.

• Periodic training and awareness activities regarding data security are provided to employees.

• Authorization matrices have been established for employees.

• Access logs are regularly maintained.

• Corporate policies regarding access, information security, use, retention and destruction have been prepared and implemented.

• Data masking measures are applied where necessary.

• Confidentiality undertakings are executed.

• Access authorizations of employees who change roles or leave the company are revoked.

• Up-to-date antivirus systems are used.

• Firewalls are used.

• Executed agreements contain data security provisions.

• Additional security measures are implemented for personal data transferred in paper form, and relevant documents are sent using appropriate confidentiality classifications.

• Personal data security policies and procedures have been established.

• Personal data security incidents and issues are promptly reported.

• Personal data security is continuously monitored.

• Necessary security measures are implemented for access to and from physical environments containing personal data.

• Physical environments containing personal data are protected against external risks such as fire and flooding.

• Environments containing personal data are secured.

• The amount of personal data processed is minimized to the extent possible.

• Personal data is backed up, and the security of backup data is also ensured.

• User account management and authorization control systems are implemented and monitored.

• Periodic and/or random internal audits are conducted or commissioned.

• Log records are maintained in a manner that prevents user interference.

• Protocols and procedures concerning the security of special categories of personal data have been established and implemented.

• Intrusion detection and prevention systems are used.

• Penetration testing is performed.

• Cybersecurity measures are implemented and continuously monitored.

• Encryption measures are implemented.

• Service providers processing personal data are periodically audited with respect to data security.

• Awareness of data security requirements is promoted among service providers processing personal data.

12. RIGHTS OF THE DATA SUBJECT AND PROCEDURES FOR APPLICATIONS TO THE DATA CONTROLLER

Data Subjects whose personal data is processed by FEVUP may exercise the following rights set forth under Article 11 of the Law on the Protection of Personal Data:

a) To learn whether their personal data is being processed;

b) To request information if their personal data has been processed;

c) To learn the purpose of processing their personal data and whether such data is being used in accordance with its intended purpose;

ç) To know the third parties to whom their personal data has been transferred, whether within Türkiye or abroad;

d) To request the rectification of personal data if it has been processed incompletely or inaccurately;

e) To request the deletion or destruction of personal data within the framework of the conditions stipulated under Article 7 of the Law;

f) To request that the actions taken pursuant to paragraphs (d) and (e) above be communicated to third parties to whom the personal data has been transferred;

g) To object to any outcome that is detrimental to the Data Subject as a result of the analysis of processed personal data exclusively through automated systems; and

ğ) To claim compensation for damages arising from the unlawful processing of personal data.

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, Data Subjects may submit requests concerning the rights set forth under Article 11 of the Law:

• in writing to Beştepe Mah. Nergiz Sok. No:7A-14 Kat:8 Via Tower, Yenimahalle/Ankara, Türkiye; or

• via registered electronic mail (KEP), secure electronic signature, mobile signature, or an email address previously provided by the Data Subject to FEVUP and registered in FEVUP’s systems, by sending the request to hello@fevupbrands.com.

Information regarding the application process may also be obtained by calling +90 539 610 89 74.

The Data Subject’s application must include:

a) First name, last name and, if the application is submitted in writing, signature;

b) For citizens of the Republic of Türkiye, Turkish Republic Identification Number (T.C. Kimlik No.); for foreign nationals, nationality, passport number or, where applicable, identification number;

c) Residential or business address for notification purposes;

ç) Where applicable, email address, telephone number and fax number for notification purposes; and

d) The subject matter of the request.

Following receipt of the Data Subject’s application, FEVUP shall conclude the application free of charge within the statutory period of 30 days.

Where fulfilling the Data Subject’s request requires additional costs, FEVUP may charge the Data Subject for the cost of the relevant storage medium where the response is provided via a CD, flash drive or similar medium.

FEVUP may request additional information and documentation from the applicant in order to verify whether the applicant is the relevant Data Subject. FEVUP may also ask the applicant additional questions in order to clarify matters contained in the application.

FEVUP reserves the right to amend this Privacy and Cookie Policy in the event of amendments to the Law or the introduction of new procedures, methods or regulations by the Personal Data Protection Board.

13. COOKIES

13.1. What Is a Cookie?

A cookie is a small piece of data that a website asks your browser to store on your computer or mobile device. Cookies help personalize and improve your online experience.

For more detailed information about cookies, you may visit All About Cookies.

13.2. Why Do We Use Cookies?

FEVUP uses cookies on its website for the following purposes:

1. To provide and facilitate the online user experience on our website and improve its functionality and performance;

2. To provide a better online experience;

3. To improve the website and make it more effective, and to obtain analyses based on anonymized user experience for corporate promotional purposes;

4. To provide advertisements tailored to your interests and analyze how you use our website; and

5. To implement legal and commercial security measures.

13.3. What Types of Cookies Do We Use?

1. Session Cookies:
Cookies that remain valid during the use of the website and expire when the web browser is closed.

2. Persistent Cookies:
Cookies stored in the browser that remain valid until they are deleted by the Data Subject or until their specified expiration date.

3. Strictly Necessary Cookies:
Cookies that are essential for the proper operation of the website and enable users to benefit from the services and navigation features offered through the website.

4. Functional and Analytics Cookies:
Cookies used for purposes such as remembering preferences including language and region, improving the use of the website, and optimizing the website to respond to the Data Subject’s preferences. These cookies contain information about how the website is used.

5. Targeting/Advertising Cookies:
Cookies used to provide content and advertisements that are more relevant to the Data Subject and their interests.

13.4. How Can Data Subjects Manage Cookies?

Many web browsers are configured to accept cookies automatically. However, browsers may be configured to block cookies from all or specific websites, provide notifications when cookies are created, block third-party cookies, or treat all cookies as session cookies.

For detailed information about browser cookie settings and how to change them, please refer to the relevant browser support pages:

• Google Chrome: Google Chrome Help – Manage Cookies

• Internet Explorer: Microsoft Support – Delete and Manage Cookies

• Mozilla Firefox: Mozilla Support – Delete Cookies and Website Data

• Yandex: Yandex Browser – Cookie Settings

• Safari: Apple Support – Cookie Settings

Data Subjects may customize and manage their cookie preferences. The following methods may be used for this purpose:

1. Where permitted by the browser used to access the website, cookie preferences may be customized through the browser settings.

2. Data Subjects who do not wish Google Analytics to collect their personal data may use the Google Analytics Opt-out Browser Add-on.

3. Data Subjects may customize cookie usage by adjusting their Google Ads Personalization settings.

In light of the above, users of the FEVUP website are deemed to consent to the use of cookies at the level determined by their individual cookie preferences while using the website.

14. CONTACT US

For any questions or comments regarding the interpretation or implementation of this Policy, applications to the Data Controller, or any other requests, you may contact FEVUP:

• in writing by post, courier or hand delivery to Beştepe Mah. Nergiz Sok. No:7A-14 Kat:8 Via Tower, Yenimahalle/Ankara, Türkiye; or

• by email at hello@fevupbrands.com.