OTACI BİTKİSEL ÜRÜNLER SANAYİ VE TİCARET A.Ş.

CLARIFICATION TEXT FOR THE PROCESSING OF PERSONAL DATA

IDENTITY OF THE DATA CONTROLLER

In accordance with the Law on the Protection of Personal Data No. 6698 (“KVK Law”), your personal data may be processed within the scope described below by Otacı Bitkisel Ürünler Sanayi ve Ticaret A.Ş. (“Company”), which has the title of “Data Controller”.

PURPOSE AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

Your personal data in the categories of identity, communication, customer procedures, finance, transactional security, visual and audio recording information are processed in accordance with the KVK Law and secondary regulations within the framework of the following purposes and legal reasons:

Based on the legal reason “explicitly stipulated in the laws” regulated in article 5/2 (a) of the KVK Law, your personal data shall be processed for the purposes of fulfilling the obligations arising from the legislation to which our Company is subject, primarily the Turkish Commercial Code and the Tax Procedure Law, and establishing its rights, and issuing legal declarations and notifications.

Based on the legal reason of “establishment, use or protection of a right” regulated in article 5/2 (e) of the KVK Law, your personal data shall be processed for the purposes of providing proof in possible disputes, obtaining legal advice and technical support.

Based on the legal reason for the “establishment or performance of the contract” regulated in article 5/2 (c) of the KVK Law, your personal data shall be processed for the purposes of performing payment and collection transactions in accordance with the distance sales contract you are a party to, performance of the contract, fulfillment and continuation of the obligations, executing the goods/service sales processes, and carrying out financial and accounting activities.

Based on the legal reason of the “fulfillment of the legal obligation by the data controller” regulated in article 5/2 (ç) of the KVK Law, your personal data may be processed for the purposes of issuing legal declarations and notifications, complying with the retention periods stipulated in the legislation to which the Company is subject, fulfilling other obligations stipulated in the relevant legislation, fulfilling the requests of courts and public institutions and organizations requesting information, and other legal obligations.

Based on the legal reason of “legitimate interest of the data controller” regulated in article 5/2 (f) of the KVK Law, your personal data may be processed for the purposes of ensuring customer satisfaction and conducting quality standards processes, performing internal operational activities, carrying out internal audit investigation activities, ensuring commercial security, data backup and storage in order to securely store your personal data.

METHOD OF COLLECTING YOUR PERSONAL DATA

Your personal data are collected by our Company in electronic form via the forms available on the website.

TRANSFER OF YOUR PERSONAL DATA

Your collected personal data can be transferred within the framework of the personal data processing conditions regulated in the 8th and 9th articles of the KVK Law.

Based on the legal reason for the “establishment and performance of the contract” regulated in article 5/2 (c) of the KVK Law, your personal data may be transferred to the relevant bank for the necessary payment and collection transactions, to the company from which the service is received for the relevant transactions if the payment and collection transactions are carried out with a credit card / debit card, and to the cargo companies for the delivery of the products you have purchased.

Based on the data processing condition of our Company relevant to the “mandatory data processing in order to fulfill the legal obligation”, which is regulated in Article 5/2 (ç) of the KVK Law, your personal data may be transferred to courts and public institutions and organizations that request information, when necessary.

Based on the data processing condition for the “establishment, use or protection of a right” regulated in article 5/2 (e) of the KVK Law, your personal data may be transferred to law offices and other consultants for the purposes of providing proof in possible disputes, obtaining legal consultancy and technical support, implementing the contract, and auditing whether the parties comply with their obligations.

Based on the legal ground of “legitimate interest of the data controller” regulated in article 5/2 (f) of the KVK Law, your personal data may be transferred to group companies for the purposes of carrying out finance and accounting works and performing management activities.

Based on the “explicit consent” data processing condition in Article 9/1 of the KVK Law, your personal data may be transferred to data storage and/or cloud service supplier companies (Hetzner) whose servers are located abroad for the purposes of carrying out storage and archiving processes, and using cloud and e-mail services.

STORAGE OF YOUR PERSONAL DATA

Based on one of the data processing conditions specified in Article 5 of the KVK Law and in accordance with the general principles specified in Article 4 of the KVK Law, your personal data are stored for the period stipulated in the relevant legislation or required for the purpose, taking into account the periods specified in the Storage and Disposal Policy, which is regulated in accordance with Article 7 of the KVK Law, and are destroyed within the destruction period.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA

As a data subject, you have the right to:

Learn whether your personal data have been processed,

Request information if your personal data have been processed,

Learn the purpose of processing your personal data and whether they have been used in accordance with the relevant purpose,

Learn the domestic or foreign third parties who received your personal data,

Request correction in case of incomplete or incorrect processing of your personal data, and to request the notification of the third parties who received your personal data accordingly,

Request the deletion or destruction of your personal data in the event that the reasons requiring their processing are no longer valid, despite the fact that they have been processed in accordance with the provisions of the Law no. 6698 and other relevant laws, and to request the notification of the third parties who received your personal data accordingly

Object to any unfavorable results obtained against you upon analyzing the processed data exclusively through automated systems,

Request compensation in case of damages due to the unlawful processing of your personal data.

APPLICATION TO THE DATA CONTROLLER

In case you submit your requests regarding your rights as a data subject to the Company in writing pursuant to paragraph 1 of Article 13 of the KVK Law or through the methods set forth in the Communiqué on the Principles and Procedures for the Request to Data Controller (https://www.resmigazete.gov.tr/eskiler/2018/03/20180310-6.htm), our company shall conclude the request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the procedure requires a separate cost, the fee in the tariff determined by the Personal Data Protection Authority shall be charged by the Company.

In order to exercise your above-mentioned rights, you can fill in the application form on our website and send a signed copy of your request, which contains the necessary information identifying your identity and your explanations regarding your right that you request to exercise from the rights specified in Article 11 of the KVK Law, to our address, deliver it in person or through a notary public or send the relevant form to our KEP address with a secure electronic signature.

Our company’s contact information are as follows:

Address: Otacı Bitkisel Ürünler San. Tic. A.Ş. A2 Blok Burak Plaza K:7 Bağcılar/İstanbul

Telephone: 0212 480 3050

KEP Address: [email protected]

E-mail address: [email protected]

Date of Update: 01.02.2021