KVKK Privacy Notice

PRIVACY NOTICE UNDER THE LAW ON THE PROTECTION OF PERSONAL DATA

1. Data Controller

Under Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data may be processed by THERAPIUM NATURALIS AROMATERAPİ YAĞLARI KOZMETİK PAZARLAMA VE TİCARET ANONİM ŞİRKETİ (the “Company”), acting as data controller, within the scope described below.

Address: Barbaros Mh. Mor Sümbül Sk. Ataşehir Nidakule Güney No: 7/3 Kat:16 Ataşehir/İstanbul

2. Personal Data Processed

The following personal data may be processed by our Company:

• Identity information (name, surname)
• Contact information (telephone number, e-mail address, postal address)
• Customer transaction information
• Order and delivery information
• Payment transaction information
• Request and complaint information
• Website usage and transaction security information
• Information obtained through cookies

3. Purposes of Processing Personal Data

Your personal data is processed for the purposes of:

• Receiving, preparing and delivering orders,
• Carrying out membership procedures,
• Providing after-sales support services,
• Evaluating customer requests and complaints,
• Carrying out finance and accounting processes,
• Fulfilling legal obligations,
• Carrying out information security processes,
• Improving the quality of products and services,
• Carrying out campaign, promotional and marketing activities (with your explicit consent where required under the applicable legislation),
• Carrying out e-commerce activities

as set out above.

4. Method and Legal Basis for Collecting Personal Data

Your personal data is collected:

• Through website membership and order forms,
• Contact forms,
• E-mail,
• Telephone calls,
• Social media channels,
• Cookies and similar technologies,
• Forms completed in physical or electronic form

by automated or non-automated means.

Your personal data is processed on the following legal grounds set out in Articles 5 and 6 of the KVKK:

• It is expressly provided for by law,
• It is directly related to the establishment or performance of a contract,
• It is necessary for the data controller to fulfil its legal obligations,
• It is necessary for the establishment, exercise or protection of a right,
• It is necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject,

and, where required, on the basis of explicit consent.

5. Transfer of Personal Data

Your personal data may be transferred to:

• Courier and logistics companies,
• Payment institutions and banks,
• Accountants and financial advisors,
• Legally authorized public institutions and organizations,
• Information technology, hosting, e-mail and infrastructure service providers,

in accordance with the applicable legislation and subject to the necessary security measures.

Where some of the information technology infrastructure used is located abroad, your personal data may be transferred abroad under Article 9 of the KVKK, subject to the necessary security measures and in accordance with the applicable legislation.

6. Retention Period of Personal Data

Your personal data is retained for as long as required by the purposes of processing and for the retention periods stipulated in the applicable legislation. Upon expiry of this period, personal data is deleted, destroyed or anonymized.

7. Rights of the Data Subject

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is being processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether the data is used in accordance with that purpose,
• Know the third parties to whom your data has been transferred, domestically or abroad,
• Request the rectification of your personal data if it is incomplete or inaccurate,
• Request the deletion or destruction of your personal data under the KVKK,
• Request that the rectification, deletion or destruction be notified to the third parties to whom the data has been transferred,
• Object to any result arising against you from the analysis of your data exclusively by automated systems,
• Claim compensation for damage suffered as a result of unlawful processing of your personal data

as set out above.

8. Application Procedure

You may submit your requests under the KVKK to our Company:

• In writing to our company address,
• Through a notary public,
• Via our Registered Electronic Mail (KEP) address,
• Using a secure electronic signature or mobile signature,
• By the other methods specified in the KVKK legislation

as set out above.

Your applications will be concluded free of charge within thirty (30) days at the latest, in accordance with Article 13 of the KVKK. However, if the procedure entails an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.