PERSONAL DATA
PROTECTION.

Privacy Notice

Personal Data Protection Law

DEFINITIONS:

Data Controller: Hatipoğlu Ayakkabı Deri San. ve Tic. Ltd. Şti. (Hatipoğlu)

Data Subject: A person who shares personal data with Hatipoğlu for various purposes and whose personal data are processed in this context. Data subjects primarily include employees, suppliers, purchasers of goods and services, and visitors who have shared their personal data directly or indirectly, verbally, in writing or electronically, or have enabled Hatipoğlu to obtain it.

KVKK: Refers to Personal Data Protection Law No. 6698, published in Official Gazette No. 29677 dated 7 April 2016.

First, we wish to state that Hatipoğlu, acting as data controller, recognizes that the personal data of individuals using our services must be processed and held securely by us in accordance with the Constitution and Personal Data Protection Law No. 6698 ("KVKK"). We would like to inform you of your rights and our obligations in this regard under Articles 10, 11 and 12 of the KVKK.

As Hatipoğlu, we attach great importance to keeping all processed personal data in a secure physical or electronic environment. For this reason, we take the necessary security measures to ensure that the personal data held by us is not lost, used unlawfully or passed into the hands of unauthorized persons.

In this context, this information notice has been prepared in accordance with Articles 10, 11 and 12 of the KVKK to inform you that, as the Data Controller, we process your personal data as explained below and within the limits set by all applicable legislation, and to fulfill our obligation to inform you.

DEFINITION OF PERSONAL DATA:

The Personal Data collected and processed within the scope of Hatipoğlu's activities includes the names, surnames, ID photographs, Turkish national identity numbers, details on Turkish identity cards / identity documents, addresses, telephone numbers and similar information of our employees, suppliers, purchasers of goods and services, visitors, subcontractors and our suppliers' workers, together with all personal information that Hatipoğlu is required to collect under applicable legislation.

LEGAL REASON FOR PROCESSING YOUR PERSONAL DATA:

Your personal data may be processed and transferred domestically and internationally with natural and legal persons, in accordance with the basic principles of KVKK and within the conditions and purposes for processing personal data set out in Articles 5 and 6 of KVKK.

TO WHOM AND FOR WHAT PURPOSE PROCESSED PERSONAL DATA CAN BE TRANSFERRED:

For the purposes stated above, your personal data may be transferred, within the legal framework and subject to the type of data and limited to the relevant purpose, to Hatipoğlu's affiliates and their subsidiaries; its employees, company officers, legal, financial and tax advisers, and auditors; consultants with whom Hatipoğlu cooperates or from whom it receives services that complement or extend its activities; suppliers, parties assisting in the performance of obligations, banks and financial institutions; authorized public institutions and organizations such as judicial and administrative authorities; persons permitted by law; or institutions and organizations to which you have consented to the transfer.

Your personal data involved in these transfers is processed to provide, carry out, perform, substantiate and improve Hatipoğlu's services and related transactions; to enable the relevant departments to undertake the work needed for you to benefit from Hatipoğlu's services; to promote Hatipoğlu and its activities; to enable the relevant individuals to benefit from the products and services offered by Hatipoğlu; to meet legal obligations; to continue R&D, scientific research, publication and consultancy activities; to carry out administrative procedures, listing, reporting, verification, analysis and evaluations; and to produce statistical and scientific information. In line with the purpose of determining and implementing Hatipoğlu's commercial and business strategies so that its services and the contracts we have concluded can be fulfilled, carried out, performed, substantiated and improved, your personal data is processed for Hatipoğlu's financial operations, communications, market research and social responsibility activities; purchasing operations (requests, quotations, evaluation, orders, budgeting and contracts); internal system and application management operations; and the management of legal operations.

RIGHTS OF DATA SUBJECTS:

Your personal data may be collected verbally, in writing or electronically through channels such as our website, email or written applications. Data is stored in our databases and in the cloud, subject to statutory retention periods. Under Article 11 of KVKK, you may exercise the following rights concerning your personal data by emailing Hatipoğlu at info@hatipoglu.com.tr:

a. to learn whether your personal data are being processed

b. request information if processed

c. Learning the purpose of processing and whether it is used in accordance with its purpose

ç. to know the third parties to whom your personal data have been transferred within the country or abroad

d. Request correction if processed incompletely or incorrectly

e. to request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK

f. to request that the third parties to whom your personal data have been transferred be notified of the actions taken under items (d) and (e) above

g. to object to a result that is detrimental to you arising from the analysis of your personal data exclusively through automated systems

ğ. you have the right to request compensation if you suffer damage as a result of unlawful processing of your personal data.

Third parties cannot exercise the right to information under Article 11 of the KVKK on behalf of data subjects. For a request concerning the personal data of someone other than the applicant, the original of a special power of attorney issued by the data subject in the applicant's name, bearing a wet-ink signature and notarized, must also be submitted.

Situations in which Hatipoğlu May Process Your Personal Data Without Explicit Consent in accordance with KVKK:

Under Article 5 of KVKK, Hatipoğlu may process your lawfully obtained personal data without seeking your explicit consent in the following circumstances:

• In cases where it is clearly provided for by law,

• Processing your personal data is necessary to protect your life or physical integrity, or that of another person, where you, as the data subject, are unable to express your consent due to actual impossibility or your consent is not legally valid,

• Processing the personal data of the parties to a contract is necessary, provided that it is directly related to the formation or performance of a contract you have concluded with Hatipoğlu and its related companies or organizations,

• Processing is necessary for Hatipoğlu to comply with a legal obligation,

• Your personal data has been made public by you,

• Data processing is necessary for the establishment, exercise or protection of a right, and

• Data processing is necessary for Hatipoğlu's legitimate interests, provided that it does not prejudice your fundamental rights and freedoms.

Obligations of those who have access to data processed or stored by Hatipoğlu in accordance with KVKK:

Under the provisions of KVKK and the Turkish Penal Code (TCK), persons whose duties give them access to Personal Data obtained, processed or held by Hatipoğlu acknowledge and undertake in advance that they will not use this data for purposes other than the institution's needs, alter it under any circumstances or share it with third parties. They will keep the data and the means of accessing it confidential even after their duties end, and accept personal liability for any breach of confidentiality.