The principles followed by Lutuf Mensucat A.Ş. ("Company") when collecting and using personal data obtained through the website ("Website") depending on the desire of the users ("User(s)") are regulated in this Privacy Policy.

Personal Data That Can Be Collected

The Company will be able to collect the identity information of the User, communication information such as e-mail address, phone number, other information that may be necessary for the performance of the services subject to the Website and considered personal data in accordance with the Personal Data Protection Law and all relevant legislation, depending on the desire of the Users on the Website. The User expressly consents to the processing of the data that he/she can share with the Company in line with his/her own desire within the scope and for the purposes specified in this Privacy Policy.

In accordance with Articles 3 and 7 of the Personal Data Protection Law, data that is irreversibly anonymized will not be considered personal data in accordance with the provisions of the said law and the processing activities regarding these data will be carried out without being bound by the provisions of this Privacy Policy.

Use of ”Cookie”

Data such as the sections visited, the areas clicked during the Users' navigation on the Website are automatically collected by the Company. These data obtained by using the technology called "Cookie" are statistical information. The purpose of this technology is to make the content of the sections visited by the Users more easily accessible for the User from their first visit to the site. Most of the browsers are designed to accept these "cookies", which are technical communication files in the first place, but Users can always change the browser settings to ensure that the technical communication file does not come or a warning is given when the technical communication file is sent.

The Company has the right to associate the behaviors of the Users on the Website with a "cookie" in the browser and define remarketing lists based on metrics such as the number of pages viewed, the visit duration, and the target completion number for the purpose of on-line behavioral advertising and marketing. Subsequently, targeted advertising content according to interests can be shown to the User on the Website or on other sites in the display advertising network.

Purpose of Using Data

The Company may process the collected personal data for the purpose of allowing the User to benefit from the Website, performing membership registration if membership to the Website is in question, improving the services it offers, developing the service, introducing and informing about new services, making necessary notifications to the User in this context, establishing contact with the User, and fulfilling the obligations arising from the nature of the services it offers.

Said personal data can be processed within the scope of Company reporting and business development activities, can also be used for the purpose of making various statistical evaluations without disclosing the identity of the User, creating a database, and performing market research. In case the User also gives approval, said information can be processed, stored, transmitted to third parties by the Company and the persons it is in cooperation with for the purpose of direct marketing, and the User can be contacted for the purpose of introducing various applications, products, and services and making notifications regarding maintenance and support activities through said information.

The Company may also process personal data and share it with third parties without obtaining the further consent of the User in case of the presence of exceptions in the relevant legislation and/or in accordance with Articles 5 and 8 of the Personal Data Protection Law. The main ones of these situations are specified below:

• It is explicitly provided for in the laws,
• It is mandatory for the protection of the life or physical integrity of the person himself/herself or another person who is unable to disclose his/her consent due to actual impossibility or whose consent is not given legal validity,
• It is necessary to process personal data, provided that it is directly related to the establishment or performance of any contract between the User and the Company,
• It is mandatory for the fulfillment of legal obligations,
• It has been made public by the User himself/herself,
• Data processing is mandatory for the establishment, exercise, or protection of a right,
• Data processing is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the User.

Sharing of Data

The Company may transfer the personal data belonging to the Users and the new data obtained by using these personal data to the third parties whose services it benefits from for the purpose of performance of the services offered to the User within the scope of the Website, limited to the purpose of procurement of said services. In this context, the Company may share User data with third parties such as outsourced service providers, hosting service providers ("hosting" services), law firms, research companies, call centers for the purpose of development of the User experience (including improvement and personalization), ensuring the security of the User, detecting fraudulent or unauthorized uses, operational evaluation research, elimination of errors regarding the Website or Company services, and to perform any of the purposes included in this Privacy Policy or other privacy texts offered to the User.

The User accepts that the aforementioned third parties can store the User's personal data on their servers located anywhere in the world, provided that it is limited to the purposes specified above, and that he/she consents to this matter in advance.

User's Right to Access Data and Correction Requests

The User has the right to, by applying to the Company, regarding himself/herself:

• Learn whether personal data is processed,
• Request information if personal data has been processed,
• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction of personal data if it is incomplete or incorrectly processed,
• Request the deletion or destruction of personal data within the framework of the conditions provided for in the relevant legislation,
• Request notification of the correction, deletion, and destruction processes made in accordance with the relevant legislation to third parties to whom personal data is transferred,
• Object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• Request compensation for the damage in case of loss due to unlawful processing of personal data.

The User will be able to transmit his/her aforementioned requests to the address data.controller@company.com in writing. The Company may perform its reasoned positive/negative response in writing or from digital media, in accordance with the requests included above. It is essential that no fee is charged for the necessary processes regarding the requests. However, in case the processes require a cost, it is possible to request a fee over the tariff determined by the Personal Data Protection Board in accordance with Article 13 of the Personal Data Protection Law.

The User undertakes that his/her information subject to this Privacy Policy provided by him/her to the Company is complete, accurate, and up-to-date, and that he/she will immediately update them in case of any change in this information. The Company will not have any responsibility in case the User has not provided up-to-date information.

The User accepts and declares that he/she may not be able to fully benefit from the services promised to him/her by the Company in case he/she makes a request that will result in the inability of any of his/her personal data to be used by the Company, and that any responsibility arising in this scope will belong to him/her.

Retention Period of Personal Data

The Company will retain the personal data provided by the User for the duration of the provision of services for the purpose of fulfillment of the obligations arising from the nature of the services offered.

In addition to this, the Company may retain personal data during the statute of limitations determined in accordance with the relevant legislation, provided that it is limited to the purpose of realization of the necessary defenses within the scope of the dispute, in case of any dispute that may arise between the User and the Company.

Measures, Commitments, and Responsibility Regarding Data Security

The Company, under the conditions determined in the relevant legislation or expressed in this Privacy Policy, undertakes to:

• prevent personal data from being processed unlawfully,
• prevent personal data from being accessed unlawfully, and
• take the necessary technical and administrative measures and have the necessary audits performed for the purpose of ensuring the appropriate level of security in order to ensure the preservation of personal data.

In case links are provided to other applications on the Site, the Company does not bear any responsibility within its body for the privacy policies and contents of the applications.

The Company does not accept responsibility for the damages that may occur as a result of using personal data within the framework of the above conditions.

Changes in the Privacy Policy

Those who benefit from the services offered on the Website are considered to have read and accepted all these terms. The Company reserves the right to change the provisions of the Privacy Policy without prior notice. The current Privacy Policy becomes effective on the date it is presented to the User by any method.