Clarification Text on the Protection of Personal Data

Dear Customers and Visitors,

As CNT Luks Tuketim Mallari Ic Ve Dis Ticaret Limited Sirketi (“Company”), we would like to inform you in accordance with Article 10 of the Law No. 6698 on Personal Data Protection (“KVKK” or “Law”) and the Regulatory Guidelines on Procedures and Principles for Fulfilling the Obligation of Clarification, regarding the personal data we process through our website www.authenticseconds.com and/or our “Authentic Seconds” store.

The processing of personal data aims to protect fundamental rights and freedoms, especially privacy. “Personal data” means any information that identifies or can identify an individual. Below are the personal data processed by our Company, their processing purposes, potential recipients, collection methods, legal grounds and your rights regarding such personal data.

A. DATA CONTROLLER

Within the scope of Law No. 6698 on Personal Data Protection (“KVKK” or “Law”), your personal data is collected and processed by the Company as the data controller, explained below.

B. PROCESSED PERSONAL DATA CATEGORIES

First and foremost, personal data can be processed in accordance with Law No. 6698 on Personal Data Protection, in line with the “Explicit Consent” of the relevant person.

The following are the data types considered personal data and processed by the Company:

• Identity Information: Name, Surname, Date of Birth, Gender, Turkish Republic Identity Number, Photograph
• Contact Information: Mobile Phone Number, Addresses Added to Your Membership Account, Email Address
• Customer Transaction Information: Order, Delivery Transaction Information, Shopping Transaction History, Request and Complaint Information, Communication Preferences, Preferred Product Information, Membership Point Information
• Transaction Security Information: IP Address, Username and Password Information, Cookie Information, Internet Access Log Information
• Legal Proceeding Information: Information in Correspondence with Authorized Persons, Institutions and Organizations, Information in Lawsuit and Execution Files, Information in Notices, Information in Responses to Legal Information Requests
• Financial and Bank Information: Payment and Invoice Information
• Marketing Information: Shopping History Information, Campaign Utilization Information, Profiling and Segmentation Information, Cookie Records
• Request Management Information
• Complaint Management Information

In accordance with Articles 3 and 7 of the Personal Data Protection Law, data that has been anonymized in an irreversible manner will not be considered personal data, and processing activities for such data will be carried out without being bound by the provisions of this Policy.

We would also like to remind you that in cases covered by Article 5/2 of the Personal Data Protection Law, consent is not required. These situations are as follows:

1. Explicitly provided for in laws,
2. Being necessary to protect the life or physical integrity of the person who cannot express consent due to actual impossibility, or of another person,
3. Being necessary for the processing of personal data directly related to the establishment or performance of a contract,
4. Being necessary to fulfill the legal obligation of the data controller,
5. Being made public by the data subject,
6. Being necessary for the establishment, use, or protection of a right,
7. Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

C. PURPOSES OF PERSONAL DATA PROCESSING

Personal data collected directly or indirectly within the Company and varying depending on the service, commercial activities, and legal requirements will be processed according to the Company’s personal data inventory and within the scope of the Privacy and Security Policy. All personal data obtained directly or indirectly from the relevant persons are processed for the purposes stated below.

1. Verifying the identity of shoppers from www.authenticseconds.com and/or Authentic Seconds stores; making necessary notifications to fulfill contractual obligations, especially distance selling contracts and contracts under the Consumer Protection Law,
2. Providing information to public officials upon request and as required by legislation, particularly in matters of public safety and in response to requests from Civil and Criminal Courts,
3. Using for all of the Company’s marketing activities, including informing about special and general campaigns (such as promotions, introductions, discounts, etc.),
4. Recognizing customers shopping from the store and/or website, conducting marketing and advertising processes, performing marketing and analysis studies, managing advertising/campaign/promotion processes,
5. Using in various marketing and advertising activities and conducting marketing activities, surveys, and market analyses through electronic and/or physical means via contracted organizations,
6. Managing customer relations processes, evaluating and resolving product and service-related requests, complaints, and suggestions, providing product information, sharing data with business partners within the scope of marketing activities,
7. Auditing and managing financial and accounting processes,
8. Auditing and managing the Company’s business activities,
9. Conducting invoicing processes,
10. Conducting logistics, cargo activities, and tracking delivery processes,
11. Providing post-sales support services,
12. Conducting communication activities,
13. Managing information security processes,
14. Conducting storage and archiving activities,
15. Ensuring activities are conducted in compliance with legislation and fulfilling legal obligations,
16. Transferring to third parties and companies from whom services are received to fulfill legal obligations,
17. Storing data to fulfill contractual obligations (such as product delivery),
18. Storing contact information to remind you of your rights against the Company.

Our “Authentic Seconds” store is monitored by security cameras to ensure the safety of our customers, job candidates, and employees. We inform you that visitors’ images may be recorded by security cameras and may be shared with public officials upon request from administrative and judicial authorities for public safety purposes.

We would also like to state that personal data of all business partners benefiting from the Personal Data Protection Law within our commercial activities and their employees may be processed for the continuation and after the commercial relationship and fulfillment of contractual obligations.

We process all these personal data in accordance with the fundamental principles prescribed by the KVKK, within the personal data processing conditions and purposes specified in Articles 4, 5, and 6 of the KVKK, and in compliance with all legal legislation, including but not limited to the Turkish Code of Obligations No. 6098, Consumer Protection Law No. 6502, Labor Law No. 4857, and the Law on the Regulation of Electronic Commerce No. 6563.

The Company may process personal data provided by the Data Subject for purposes including creating a membership registration and account and keeping records related to this, enabling the Data Subject to benefit from services provided through www.authenticseconds.com, detecting system errors, tracking performance, improving the functioning of the www.authenticseconds.com website, providing maintenance and support services and backup services, and for the purposes of the relevant business units carrying out the necessary work to benefit the relevant persons from the products and services offered by the Company and carrying out the relevant business processes, as well as customizing these products and services according to the likes, usage habits, and needs of the relevant persons and planning and executing the necessary activities for their recommendation and promotion, carrying out the necessary work by the relevant business units for the realization of commercial activities carried out by the Company and carrying out the business processes connected to this, ensuring the legal, technical and commercial-business security of the Company and the persons with whom it has a business relationship, and planning and executing the Company’s commercial and/or business strategies.

D. METHOD OF PROCESSING PERSONAL DATA

Your Personal Data is collected both through fully or partially automated means and through non-automated methods that are part of the data recording system; directly by you or by persons authorized to act on your behalf; through applications made via contracted websites, store and Company personnel, institutions to which we provide/receive support services, and real and/or legal persons with whom transactions are made under any legislation or contract, and through verbal, written, or electronic media with direct automated systems (Our website, telephone communication, our social media accounts) in accordance with Article 5 and 6 of the Law, which states;

1. Explicitly provided for by laws,
2. It is necessary for our Company to fulfill its legal obligation,
3. It is directly related to the establishment or performance of a contract and processing is necessary,
4. It is necessary for processing for the legitimate interest of our Company, provided that it does not harm your fundamental rights and freedoms,
5. It has been made public by you,
6. Processing is necessary for the establishment, exercise, or protection of a right,
7. Your explicit consent exists.

E. TO WHOM AND FOR WHAT PURPOSES THE PROCESSED PERSONAL DATA MAY BE TRANSFERRED

Our Company takes care to process your personal data in accordance with the principles of “need to know” and “need to use”, by providing the necessary data processing and taking the necessary technical and administrative security measures. Since the continuous flow of data with different partners is essential for carrying out or supervising business activities, ensuring business continuity, operating digital infrastructures, and ensuring information security, we have to transfer the personal data we process to third parties for specific purposes. In addition, it is very important that your personal data is accurate and up-to-date so that we can fulfill our contractual and legal obligations fully and properly. For this, we have to work with various business partners and service providers.

Your collected personal data, limited to and valid for the realization of the processing purposes mentioned above;

• To the Company’s business partners, shareholders, affiliates,
• To cargo companies for the purpose of carrying out cargo, logistics activities, and monitoring delivery processes,
• To our service providers for the purpose of carrying out procurement processes,
• To business partners and service providers that provide call center services for the provision of goods and services sales and after-sales support services,
• To business partners and service providers that provide services in the field of quality control, complaint management, and risk analysis,
• To our relevant business partners, consultants, and service providers, banks, financial advisors for the management of financial and accounting processes, detection and evaluation of risks, prevention of fraud,
• To our business partners and service providers that provide, operate, or serve our IT infrastructure,
• To our business partners that provide services in the field of risk management and financial reporting processes,
• With your explicit consent, to the relevant service provider and business partner for the purpose of website usage preferences and browsing history, profiling and segmentation, communicating with the user in accordance with their preferences, and managing marketing, advertising, and analysis processes,
• To our group companies, affiliates, lawyers, auditors, computer forensics experts, cyber security consultants, tax consultants, and other third parties and business partners from whom we receive consultancy and services within the scope of fulfilling legal obligations and the performance of the contract,
• Upon request, to regulatory and supervisory institutions, prosecutors, courts and enforcement offices, and other authorized authorities and public institutions and organizations,
• To persons or organizations permitted by the Tax Procedure Law, Social Security Institution legislation, Court of Accounts, Law on Prevention of Laundering Proceeds of Crime, Law on Prevention of Money Laundering, Turkish Commercial Code, Code of Obligations, Consumer Protection Law, Law on the Regulation of Electronic Commerce, and other legislation provisions.
• It may be shared with our affiliates, suppliers, business partners, contracted banks, and third parties from whom we purchase products or services, located in Turkey and/or abroad.

F. LEGAL BASES FOR PROCESSING PERSONAL DATA

Your personal data mentioned above are processed by the Company based on the following legal bases.

• Your identity, contact, customer transaction, transaction security, marketing, legal transaction information is processed if explicitly stipulated in the legislation that our Company is subject to, primarily the Law on the Regulation of Electronic Commerce No. 6563, the Turkish Commercial Code No. 6102.
• Your identity, contact, customer transaction, transaction security, visual and auditory recording information is processed based on the legal basis that the processing of your personal data is necessary for the establishment or performance of a contract, provided that it is directly related.
• Your identity, contact, customer transaction, transaction security, legal transaction, visual and auditory recording information is processed based on the legal basis that it is necessary for our Company to fulfill its legal obligation.
• Your identity, contact, customer transaction, transaction security, legal transaction, visual and auditory recording information is processed based on the legal basis that data processing is necessary for the establishment, exercise, or protection of a right.

If your explicit consent exists; your personal data in the categories of identity, contact, customer transaction, and marketing are processed for the purpose of using them in marketing and advertising activities, presenting products suitable for your preferences, providing you with a better shopping experience and increasing your satisfaction, informing you about developments, opportunities, and innovations at the Company, sending commercial electronic messages.

G. SECURITY AND RETENTION PERIOD OF PROCESSED PERSONAL DATA

Personal data will be stored in accordance with the law and will be retained for the maximum period specified in the relevant legislation or necessary for the purpose for which they are processed within the scope of the legislation, and in any case for the legal statute of limitations.

H. RIGHTS OF THE DATA SUBJECT

As personal data owners, if you submit your requests regarding your rights through the methods set out below, the Company will finalize the request as soon as possible and within thirty days at the latest, depending on the nature of the request.

In accordance with the provisions of Article 11 of the Law, you have the following rights regarding your personal data:

1. To learn whether personal data is processed,
2. To request information if personal data has been processed,
3. To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
4. To know the third parties to whom personal data is transferred at domestic or abroad,
5. To request the rectification of incomplete or inaccurate data, if any, and to request the deletion or destruction of personal data; to request that operations carried out in this context be notified to third parties to whom personal data has been transferred,
6. To object to the occurrence of an unfavorable result by analyzing the processed data exclusively through automated systems,
7. To request compensation for damages in case of loss due to unlawful processing of personal data.

I. CONTACT INFORMATION FOR YOUR RIGHTS AND REQUESTS

You can submit your request to exercise the rights mentioned above in Turkish and in writing or via registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the electronic mail address previously notified to the Company and registered in our system, in accordance with Article 13, paragraph 1 of Law No. 6698 and the Communiqué on the Procedures and Principles of Application to the Data Controller dated 10.03.2018 and numbered 30356.

In applications, information will only be provided about the applicant, and it will not be possible to obtain information about other family members and third parties. The Company reserves the right to verify your identity before responding.

In your application;

• Your name, surname, and if the application is written, your signature,
• Your Turkish Republic ID number if you are a citizen of the Republic of Turkey, your nationality, passport number, or if any, identity number if you are a foreigner,
• Your residential address or workplace address for notification,
• If any, your electronic mail address, telephone, and fax number for notification,
• Your request subject,

must be included, and any information and documents related to the subject should be attached to the application if available. You can submit your application to our Company with the Application Form containing this information or with a petition via one of the methods below.

Depending on the nature of your request, information and documents that will allow identity verification must be provided completely and accurately. In case the requested information and documents are not provided properly, there may be disruptions in the full and qualified conduct of the research to be carried out by the Company in response to your request. In this case, the Company declares that it reserves its legal rights. For this reason, we state that your application must be sent completely and containing the required information and documents according to the nature of your request.

J. ABOUT THE POLICY

The Company reserves the right to update Policy at any time within the framework of changes that may be made in the current legislation or Company practices. Update Date: