Personal Data Protection Policy

BULKOON FOOTWEAR AND LEATHER PRODUCTS INDUSTRY AND TRADE LIMITED COMPANY PERSONAL DATA PROTECTION AND PROCESSING POLICY

Personal Data Protection and Processing Policy

According to the provision in Article 20 of the Constitution of the Republic of Turkey, everyone has the right to demand the protection of their personal data. This right includes being informed about personal data concerning themselves, accessing such data, requesting correction or deletion, and learning whether the data is used in accordance with its purposes.

The Personal Data Protection Law No. 6698 ("Law"), published in the Official Gazette on 07.04.2016 and effective as of that date, regulates the protection of fundamental rights and freedoms of individuals in the processing of personal data and the obligations and procedures to be followed by real and legal persons processing personal data. The purpose of this Policy prepared accordingly is to ensure compliance with the obligations related to the Law.

This document contains the declarations and explanations of BULKOON FOOTWEAR AND LEATHER PRODUCTS INDUSTRY AND TRADE LIMITED COMPANY ("Company") regarding the processing of personal data within the scope of the Law, primarily concerning customers and other third parties, excluding the Company's employees.

Our Company reserves the right to make changes to the Policy to provide up-to-date information about our practices and legal regulations regarding the protection of personal data. In case of substantial changes to the Policy, Data Subjects will be informed through various channels.

Definitions related to the concepts used within the scope of this Policy are provided below, taking into account the personal data protection legislation.

Definitions

CONCEPTS	DEFINITIONS
Explicit consent	A declaration of consent freely expressed by Data Subjects based on being informed about a specific subject.
Anonymization	The process of rendering personal data in such a way that it cannot be associated with an identified or identifiable natural person, even when matched with other data.
Relevant person / Data subject	The natural person whose personal data is processed.
Personal data	Any information relating to an identified or identifiable natural person.
Special categories of personal data	Data subject to a stricter protection regime under the Law, which if disclosed or lost, may cause the Data Subject to suffer harm or discrimination.
Processing of personal data	Any operation performed on personal data, whether or not by automated means, including obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of such data.
Data recording system	A system in which personal data is structured and processed according to certain criteria.
Data controller	The real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the Data Recording System.
Data processor	A real or legal person who processes personal data on behalf of the data controller based on authorization.

Principles Regarding Data Privacy

According to Article 3 of the Law, any operation performed on personal data, whether fully or partially automated or non-automated as part of any data recording system, including obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of such data, is considered processing of personal data. Our Company acts in accordance with the general principles explained below within the scope of personal data processing activities.

Compliance with lawfulness and fairness: Our Company conducts personal data processing activities in accordance with the Constitution, the Personal Data Protection Law, and relevant legislation, abiding by lawful and fair principles.

Accuracy and up-to-dateness: Our Company provides Data Subjects with the opportunity to update their personal data and takes necessary measures to ensure accurate transfer of data to databases.

Processing for specific, explicit, and legitimate purposes: Our Company limits personal data processing activities to specific and legitimate purposes and clearly informs Data Subjects about these purposes through disclosure texts.

Processing limited, relevant, and proportionate to the purpose: Personal data processed by our Company is limited and relevant to the purpose notified to the Data Subject at the time of collection and processed to the extent necessary for that purpose.

Retention for the period prescribed by relevant legislation or necessary for the purpose: Our Company retains personal data only for the period required by the Law, relevant legislation, or the purpose of data processing. After this period, data is deleted, destroyed, or anonymized according to Company procedures.

Conditions for Processing Personal Data

Except for the explicit consent of the personal data owner, the basis for personal data processing can be one or more of the conditions listed below. If the processed data is special category personal data, the related conditions below will apply.

(i) Explicit Consent of the Personal Data Owner

One of the conditions for processing personal data is the explicit consent of the data owner, which must be freely expressed based on being informed about a specific subject.

Personal data may be processed without explicit consent if any of the following conditions apply.

(ii) Explicit Provision in Laws

If the personal data of the data owner is explicitly provided for in the law, meaning there is a clear legal provision regarding the processing of personal data, this condition is considered fulfilled.

(iii) Impossibility of Obtaining Consent Due to Actual Impossibility

If the person is unable to express consent due to actual impossibility or if the consent is not legally valid, and processing the personal data is necessary to protect the life or physical integrity of the person or another person, the personal data may be processed.

(iv) Direct Relevance to the Establishment or Performance of a Contract

If the processing of personal data is necessary for the establishment or performance of a contract to which the data owner is a party, this condition is considered fulfilled.

(v) Fulfillment of Our Company's Legal Obligations

If processing is necessary for our Company to fulfill its legal obligations, personal data may be processed.

(vi) Public Disclosure by the Personal Data Owner

If the data owner has made their personal data public, such data may be processed limited to the purpose of public disclosure.

(vii) Necessity of Processing for Establishing or Protecting a Right

If processing is necessary for the establishment, exercise, or protection of a right, personal data may be processed.

(viii) Necessity of Processing for Our Company's Legitimate Interests

Provided that it does not harm the fundamental rights and freedoms of the personal data owner, if processing is necessary for our Company's legitimate interests, personal data may be processed.

a. Processing of Special Categories of Personal Data

Special categories of personal data may be processed by our Company without explicit consent under the conditions specified in this Policy and with all necessary administrative and technical measures, including methods determined by the Board. Outside these conditions, explicit consent of the data owner will be obtained for processing special category personal data:

(i) Explicitly provided for in laws,

(ii) Necessary to protect the life or physical integrity of the person or another person when the data owner is unable to express consent due to actual impossibility or the consent is not legally valid,

(iii) Related to personal data made public by the data owner and in accordance with the will of public disclosure,

(iv) Necessary for the establishment, exercise, or protection of a right,

(v) Necessary for persons under confidentiality obligations or authorized institutions for public health protection, preventive medicine, medical diagnosis, treatment and care services, and planning, management, and financing of health services,

(vi) Necessary for fulfilling legal obligations in employment, occupational health and safety, social security, social services, and social assistance,

(vii) For foundations, associations, and other non-profit organizations established for political, philosophical, religious, or trade union purposes, provided they comply with their legislation and purposes, limited to their activity areas, not disclosed to third parties, and related to current or former members or persons regularly in contact with these organizations,

Notification to the Personal Data Owner

Our Company informs personal data owners in accordance with Article 10 of the Law and secondary legislation about who the data controller is, the purposes of processing, with whom and for what purposes the data is shared, the methods of collection, the legal basis, and the rights of data owners regarding the processing of their personal data.

Personal Data Collected

The personal data collected by our Company varies depending on the nature of the relationship with our Company and legal obligations.

The collected personal data may include:

Identity Information: Name, Surname, and Turkish ID Number,
Contact Information: Phone number, Address, and other contact details,
Location: Location information of the place where the person is located, etc.,
Legal Transaction Information: Information in correspondence with judicial authorities, case file information, etc.,
Customer Transaction Information: Call center records, invoices, order information, request and complaint management information (information and records collected regarding requests and complaints related to products and services associated with the person and reports evaluated by relevant departments),
Transaction Security: IP address information, website access logs, password and login information, etc.,
Risk Management: Information processed for managing commercial, technical, and administrative risks, etc.,
Finance: Balance sheet information, financial performance data, credit and risk information, asset information, etc.,
Marketing: Shopping history, surveys, cookie records, information obtained from campaign activities, etc.

The listed types of personal data do not cover all data processed, and similar types of personal data may also be processed by our Company.

Purposes of Personal Data Processing

Your personal data obtained may be processed by our Company in compliance with the personal data processing conditions specified in Articles 5 and 6 of the Law and for the following purposes:

Main Purposes	Sub-Purposes
Designing, coordinating, developing, executing company-specific commercial activities, planning and executing business development activities	Establishing and performing contracts, managing customer relations, planning and executing post-contractual services Tracking, planning, and executing external service/consultancy procurement activities Planning, tracking, and executing finance and accounting activities Conducting control, data management, analysis, social activities, process improvement, and related reporting Planning and executing crisis and emergency management activities Planning and executing physical/electronic security measures for the Company
Customization of products and services, profiling, promotion, and marketing activities	Analyzing customer usage habits and trends to enhance brand perception and planning brand management activities Planning and executing advertising, sales, and marketing operations targeting customers Planning, managing, and executing organization, meetings, invitations, and events Conducting satisfaction, loyalty, profiling, and analysis studies related to products and services Planning and executing market research activities related to products and services
Management of requests, complaints, and post-sales processes	Planning and executing request and complaint management activities including receiving, evaluating, and concluding requests and complaints Conducting operations, research, analysis, and reporting related to entering into or renewing contracts with customers Performing and tracking post-sales services and contractual obligations
Planning, execution, and management of corporate relations	Managing, developing, planning, and executing partner relations Planning and/or executing business continuity activities Executing strategic planning activities
Ensuring legal, technical, and commercial-business security of the Company and related persons, and fulfilling legal obligations	Planning and/or executing occupational health and/or safety processes Planning and executing organizational structuring, monitoring, and activities to ensure Company operations comply with policies, directives, articles of association, and relevant legislation Providing information to authorized institutions and fulfilling audit-related activities and obligations due to legal requirements Ensuring physical and/or electronic security of the Company, its campuses, and related parties Keeping records of participants in organizations and events Maintaining records and planning and executing listing activities related to parties with whom the Company has business relations

Retention of Personal Data

Our Company determines the retention periods of personal data by considering applicable legislation and the purposes of data processing. Legal obligations and statute of limitations related to personal data processing activities are always taken into account. Once the purpose of personal data processing ceases to exist, data is deleted, destroyed, or anonymized unless there is another legal reason or basis allowing retention. Detailed information on this subject can be found in the PERSONAL DATA RETENTION AND DESTRUCTION POLICY available at https://bulkoon.com/veri-imha-politikasi.

Transfer of Personal Data

Your personal data may be shared within the scope of the above purposes and in accordance with the personal data transfer conditions specified in Articles 8 and 9 of Law No. 6698, as outlined in the table below. In cases where your personal data is shared, our Company takes necessary measures to ensure that the receiving party processes and transfers the data in compliance with this Policy and applicable legislation.

Your personal data may also be transferred in cases of partial or complete change of ownership of our Company through share sales, mergers, divisions, or changes in legal entity type. In such cases, necessary steps will be taken to ensure that the receiving party complies with the processing and transfer rules set forth in this Policy.

International transfer of your personal data will only be carried out under the following conditions:

When the conditions stipulated in Article 9 of the Law are met, namely;
- One of the exceptions explained above under Articles 5 and 6 of the Law applies without explicit consent, and there is an adequacy decision regarding the country to which the transfer will be made; or
- There is no adequacy decision for the country of transfer, but the exceptions under Articles 5 and 6 of the Law are met, the individuals have the opportunity to exercise their rights and effective legal remedies, and a standard contractual clause has been signed with the receiving party;
- If neither of the above conditions is met, the transfer may be made temporarily with your explicit consent.

DATA TRANSFER PARTIES	DEFINITION-SCOPE	PURPOSE
Business Partner	Parties cooperating with our Company during commercial, legal, and administrative activities.	Personal data is transferred limitedly to fulfill the purposes of establishing the business partnership.
Legally Authorized Public Institution	Public institutions and organizations authorized by current legislation to request information and documents.	Personal data is shared limitedly to respond to requests directed by authorized public institutions.
Legally Authorized Private Persons	Private legal persons authorized by current legislation to request information and documents.	Personal data is shared limitedly to respond to requests directed by authorized private persons.

Data Security

Our Company takes reasonable technical and administrative measures to prevent unauthorized access risks, accidental data loss, intentional deletion, or damage to ensure the security of your personal data. Detailed information on this subject can be found in the PERSONAL DATA RETENTION AND DESTRUCTION POLICY.

Rights of Data Subjects

According to Article 11 of the Law, Data Subjects have the following rights against the Data Controller:

To learn whether personal data concerning them is processed and to request information if processed.
To learn the purpose of personal data processing and whether it is used in accordance with its purpose.
To know the third parties to whom personal data is transferred domestically or abroad.
To request correction of incomplete or inaccurate personal data.
To request deletion or destruction of personal data within the framework of legal conditions, and to request notification of these actions to third parties to whom the data has been transferred.
To object to the emergence of a result against themselves by analyzing processed data exclusively through automated systems.
To demand compensation for damages arising from unlawful processing of personal data.

Article 28, paragraph 2 of the Law lists cases where data subjects do not have the right to make requests, including:

Processing personal data for prevention of crime or criminal investigation,
Processing personal data made public by the data subject,
Processing personal data by authorized public institutions and professional organizations with public institution status for auditing, regulation, disciplinary investigation, or prosecution,
Processing personal data necessary for protecting the State's economic and financial interests regarding budget, tax, and financial matters,

In these cases, except for the right to demand compensation for damages, the rights listed above cannot be exercised.

Exercising Rights by Data Subjects

You have rights to exercise these rights effectively. To do so, you may submit your request including necessary identity information, other requested details, and explanations regarding the right you wish to exercise under Article 11 of the Law by filling out the form at https://bulkoon.com/veri-sahibi-basvuru-formu. You can deliver the signed copy of the form personally with identity documents to AKÇABURGAZ MAH. 3027. SK. NO: 1 F ESENYURT/ISTANBUL, send it by registered mail, through a notary, or other methods specified in the Law, or send the form with a secure electronic signature to ___________@___.kep.tr. Your request will be concluded as soon as possible and no later than 30 (thirty) days. If the process requires additional costs, a fee determined by the Personal Data Protection Board will be charged.

Our Company may request information from the Relevant Person to verify their status as a Data Subject and may ask questions to clarify the application.

Privacy (KVKK)

Legal