CLARIFICATION TEXT ON THE LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA AND RIGHTS WITHIN THIS SCOPE

This Clarification Text on the Processing and Protection of Personal Data (“Clarification Text”) has been prepared by ALTINBAŞAK MUTFAK EŞYALARI SAN. TİC. LTD. ŞTİ. to fulfill our disclosure obligation toward you, the data subjects, as prescribed by the Law No. 6698 on the Protection of Personal Data (“KVKK”). This Clarification Text explains the procedures our company must comply with during the processing of your personal data, as well as your rights and freedoms.

1. What is the Legal Basis for Processing Personal Data and For Which Purposes Are They Processed?

In accordance with Articles 4, 5, and 6 of the KVKK No. 6698, within the scope of the instructions and applications received from you under the services we offer, and within the framework of obligations and limits arising from legal regulations; your personal and special categories of personal data—such as identity information, contact details, legal transaction and compliance data, request and complaint management information, visual and auditory data, customer data, and customer transaction data—may be subjected to operations considered as "Data Processing" under the KVKK (such as obtaining, recording, storing, updating, classifying, or sharing/transferring to third parties permitted by legislation).

This is carried out to ensure you can benefit from the provided services smoothly, to deliver the services within the scope of the contract, to provide necessary updates regarding the services you purchase during the contract period, to inform you about relevant campaigns, and to comply with data retention, reporting, and disclosure obligations.

Consequently, your personal data may be processed within the legally prescribed limits for purposes such as:

• Arranging all necessary records and documents to enable you to complete your transactions in verbal or electronic environments.

• Planning, auditing, and implementing corporate sustainability, corporate governance, strategic planning, and information security processes.

• Fulfilling our administrative and legal obligations.

• Enabling our business units to carry out the necessary work to let you benefit from the products and services offered by our Company and its Affiliates.

• Customizing and recommending products and services offered by our Company and its Affiliates according to your tastes, usage habits, and needs.

• Ensuring the legal and commercial security of our Company, our Affiliates, and individuals in a business relationship with our Company (such as administrative operations for communication conducted by our Company, ensuring the physical security and supervision of Company locations, affiliate customer evaluation/complaint management processes, reputation research processes, event management, legal compliance processes, auditing, financial affairs, etc.).

• Determining and implementing our Company’s commercial and business strategies, and ensuring the execution of our Company’s human resources policies.

2. To Whom and For What Purpose the Processed Personal Data Can Be Transferred

Your collected personal data may be shared within the framework of the principles prescribed by the legislation on the protection of personal data with:

• Our business units to carry out the necessary work to let you benefit from the products and services offered by our Company and its Affiliates.

• Our domestic and foreign direct or indirect shareholders, affiliates, main partners, and group companies.

• Program partners with whom our company has signed contracts, and third parties with whom we conduct joint brand operations.

• Persons, institutions, and public legal entities permitted by legislation and legal regulations, as well as other domestic and foreign third parties from whom services are received, where sharing is necessary to deliver the relevant services.

3. What Are the Rights of the Personal Data Subject Listed in Article 11 of the KVKK?

Pursuant to the KVKK, if your personal data has been processed, you have the right to:

• Request information as to whether your personal data has been processed.

• Learn the purpose of the processing of your personal data and whether they are used in accordance with their purpose.

• Know the third parties to whom your personal data are transferred domestically or abroad.

• Request rectification of your personal data if they are processed incompletely or inaccurately.

• Request the deletion or destruction of your personal data.

• Request notification of the rectification, deletion, or destruction operations to third parties to whom your personal data has been transferred.

• Object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems.

• Claim compensation for the damage arising from the unlawful processing of your personal data.

In the application containing your explanations regarding the right you wish to exercise as a personal data subject:

• The requested matter must be clear and understandable.

• The subject must be related to you personally, or if you are acting on behalf of someone else, you must be specially authorized in this regard and your authority must be documented.

• The application must include identity and address information, and documents verifying your identity must be attached to the application.

As personal data subjects, you can submit your requests regarding your rights to our company via a written declaration. Upon receipt, our Company will conclude the request as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by our Company.

4. For How Long Will the Data Be Retained?

Your personal data will be processed provided that they are not used for purposes other than those notified to you in this Clarification Text, and will be preserved for the legal retention periods prescribed in the relevant legislation. At the end of these periods, in accordance with Article 7 of the KVKK, the Data will be deleted, destroyed, or anonymized ex officio or upon your request.