confidentiality agreement

CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA

As Text to Next Teknoloji Anonim Şirketi (“Text to Next” or “Company”), it is our top priority to process your personal data in accordance with the law, especially the Personal Data Protection Law No. 6698 (“KVKK”). In this context, this information text has been prepared by us in order to inform you about your personal data to be processed and to fulfill our obligation to inform you in accordance with Article 10 of the KVKK.

Personal data means any information that identifies or identifies your identity. Your personal data processed by us, the purposes for which they are processed, the recipient groups to which they may be transferred, the method of collection, the legal reason and your rights regarding the personal data in question are listed below.

1. YOUR PROCESSED PERSONAL DATA

If you create a profile to place orders through the website and mobile application provided by T2N or place an order as a guest user without creating a profile, your following personal data is processed:

• Your Identity Information: Your name, surname, nationality, gender, age, TR ID number.

• Your Contact and Location Information: Your mobile phone number, billing and delivery address, e-mail address,

• Your Customer Transaction Information: Your order and invoice information, your delivery transaction information, transaction history information regarding your purchases, your request and complaint information, your comments about the product, information about the content of your conversations with us through the website or mobile application,

• Financial Information: Information regarding payment method and amount, credit card information, bank account and IBAN number information,

• Your Transaction Security Information: IP address information, username and password information, cookie information, traffic data on the website and mobile application, login and exit information on the website and mobile application,

• Your Legal Transaction Information: Information regarding the contracts concluded with you, notifications such as preliminary information text and clarification text made to you in accordance with the legislation, information in correspondence with authorized persons, institutions and organizations in case of a possible legal dispute, information in lawsuit and enforcement files, your legal information request information,

• Your Audio Recording Information: Your voice recording in case you call the call center.

2. METHOD OF COLLECTING YOUR PERSONAL DATA

Your identity, contact, customer transaction, financial, transaction security and legal transaction information mentioned above are collected from you electronically via the mobile application or website and processed automatically. Your legal transaction information may also be collected and processed through official letters and other printed/electronic documents from judicial and administrative authorities. Your audio recording information is collected through communication channels and processed automatically if you contact the call center.

3. PURPOSES AND LEGAL REASONS FOR PROCESSING YOUR PERSONAL DATA

Your personal data is processed for the purpose of providing you with a better and higher quality service, carrying out and regulating the Company's activities, fulfilling the obligations and responsibilities arising from the law completely and accurately, and ensuring corporate and administrative management.

In accordance with the mandatory provisions of the law, it is essential that the information of real persons is kept accurate and up-to-date. Accordingly, if there is any change in your information, you are expected to forward this information to the Company.

The personal data detailed above is processed for the specified purposes based on the legal reasons stated below.

Data Category Purpose of Processing Legal Reason

Your Identity Information

Carrying out Finance and Accounting Affairs, Carrying out Communication Activities; Execution of Commitment Processes for Company / Product / Services; Conducting Activities in Compliance with Legislation; Follow-up and Execution of Legal Affairs; Carrying out Business Continuity Ensuring Activities; Conduct and Control of Business Activities; Execution of Goods / Service Sales Processes; Execution of Goods/Service After-Sales Support Services; Execution of Customer Relationship Management Processes; Carrying out Activities for Customer Satisfaction; Execution of Advertising, Campaign and Promotion Processes; Carrying out Storage and Archive Activities; Execution of Contract and Membership Processes; Tracking of Requests / Complaints; Planning and Execution of Business Strategies; Execution of Business Processes to Benefit from the Products and Services Offered; Providing Information to Authorized Persons, Institutions and Organizations

 It is clearly stipulated in the law,

 It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,

 It is mandatory for the data controller to fulfill its legal obligation.

Your Contact and Location Information

Conducting Finance and Accounting Affairs; Carrying out Communication Activities; Conducting Business Activities; Execution of Commitment Processes for Company / Product / Services; Pursuit and Execution of Legal Affairs; Execution of Goods/Service Sales Processes; Goods/Service After-Sales Support Services

 It is clearly stipulated in the law,

 It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,

 Fulfilling the legal obligation of the data controller

Execution; Execution of Customer Relationship Management Processes; Carrying out Activities for Customer Satisfaction; Conducting Marketing Analysis Studies; Execution of Advertising, Campaign and Promotion Processes; Tracking of Requests / Complaints; Execution of Marketing Processes of Products / Services; Conducting Storage and Archive Processes; Providing Information to Authorized Persons, Institutions and Organizations

It is mandatory to bring

Your Customer Transaction Information:

Execution of Supply Chain Management Processes; Conduct and Control of Business Activities; Providing Information to Authorized Persons, Institutions and Organizations; Conducting Activities in Compliance with Legislation; Conducting Finance and Accounting Affairs; Carrying out Storage and Archive Activities; Execution of Contract Processes; Execution of Goods / Service Sales Processes; Execution of Goods/Service After-Sales Support Services; Execution of Customer Relationship Management Processes; Carrying out Activities for Customer Satisfaction; Conducting Marketing Analysis Studies; Execution of Advertising, Campaign and Promotion Processes; Tracking Requests / Complaints, Carrying Out Marketing Processes of Products / Services

 It is clearly stipulated in the law,

 It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,

 It is mandatory for the data controller to fulfill its legal obligation and

 It is necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

Financial Information

Conducting Activities in Compliance with Legislation; Follow-up and Execution of Legal Affairs; Conducting Finance and Accounting Affairs; Conducting Return Processes; Conduct and Control of Business Activities; Execution of Goods / Service Sales Processes; Storage

 It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract, and

 Fulfilling the legal obligation of the data controller

and Carrying out Archive Activities; Execution of Risk Management Processes; Execution of Contract Processes; Providing Information to Authorized Persons, Institutions and Organizations

It is mandatory to bring

Your Transaction Security Information

Execution of Information Security Processes; Audit / Conduct of Ethical Activities; Conduct and Control of Business Activities; Carrying out Storage and Archive Activities; Ensuring the Security of Data Controller Operations; Providing Information to Authorized Persons, Institutions and Organizations; Conducting Activities in Compliance with Legislation; Follow-up and Execution of Legal Affairs; Execution of Goods / Service Sales Processes; Tracking of Requests / Complaints

 It is clearly stipulated in the law,

 It is mandatory for the data controller to fulfill its legal obligation and

 It is necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

Your Legal Transaction Information

Follow-up and Execution of Legal Affairs; Conduct and Control of Business Activities; Providing Information to Authorized Persons, Institutions and Organizations; Conducting Activities in Compliance with Legislation; Carrying out Storage and Archive Activities; Execution of Risk Management Processes; Execution of Contract Processes; Tracking of Requests / Complaints

 It is mandatory for the data controller to fulfill its legal obligation,

 Data processing is mandatory for the establishment, exercise or protection of a right and

 It is necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

Your Audio Recording Information

Execution of Commitment Processes to Company Products and Services; Execution of Customer Relationship Management Processes; Carrying out Activities for Customer Satisfaction; Execution of Goods/Service After-Sales Support Services; Carrying out Storage and Archive Activities; Tracking of Requests / Complaints; Your Products/Services

 It is clearly stipulated in the law,

 It is mandatory for the data controller to fulfill its legal obligation, and

 Data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Execution of Marketing Processes; Execution of Customer Relationship Management Processes; Conducting Marketing Analysis Studies; Providing Information to Authorized Persons, Institutions and Organizations

processing is mandatory

4. TRANSFER OF PERSONAL DATA

Your personal data can be transferred to third parties only to the extent necessary to achieve the relevant purpose, by complying with the rules in Article 8 of the KVKK titled "Transfer of Personal Data" and/or Article 9 titled "Transfer of Personal Data Abroad" and by taking the necessary technical and administrative measures. .

In this direction; Based on the legal reasons that it is clearly stipulated in the legislation to which our company is subject, that it is mandatory for the fulfillment of its legal obligation, or that it is necessary for the establishment or execution of the contract;

• With cargo companies and private couriers in order to carry out logistics activities, make deliveries and track them,

• With our business partners, consultants and service providers, banks and financial advisors in order to receive payments and carry out finance, accounting and invoicing processes,

• With business partners and other service providers who provide call center services for the sale of goods and services and after-sales support services,

• With business partners and service providers who provide services in the field of quality control, complaint management and risk analysis of services,

• With our business partners and service providers who provide, operate or provide services to our technological infrastructure,

• With our business partners who provide services in the field of risk management and financial reporting processes,

Based on the legal reasons that data processing is mandatory for the establishment, exercise or protection of a right, that it is clearly stipulated in the legislation to which our company is subject, and that it is mandatory for the fulfillment of its legal obligation;

• With lawyers, auditors, digital forensic experts, cyber security consultants, tax consultants and other third parties and business partners from whom we receive consultancy and services, within the scope of fulfilling legal obligations,

• With authorized public institutions and organizations such as regulatory and supervisory institutions, courts and enforcement offices,

• It may be shared with other public institutions or organizations authorized to request your personal data, our domestic and/or foreign subsidiaries, suppliers, business partners, contracted banks and third parties from whom we purchase products or services.

5. YOUR RIGHTS REGARDING YOUR PERSONAL DATA

According to Article 11 of the KVKK, which regulates the rights of the relevant person;

 Learning whether personal data is processed or not,

 Requesting information if personal data has been processed,

 Learning the purpose of processing personal data and whether they are used for their intended purpose,

 Knowing the third parties to whom personal data is transferred domestically or abroad,

 Request correction of personal data if they are incomplete or incorrectly processed,

 Requesting the deletion or destruction of personal data,

 To request that transactions regarding the correction, deletion or destruction of personal data be notified to third parties to whom personal data has been transferred,

 Object to the emergence of a result that is unfavorable to the individual by analyzing the processed data exclusively through automatic systems,

 In case of damage due to illegal processing of personal data, you have the right to request compensation for the damage.

You can submit your requests within the scope of Article 11 of the Law, which regulates the rights of the relevant person, to Caddebostan Mahallesi, Ogün Sokak, San. in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. You can send it in writing to No: 1, İç Kapı No: 14, Kadıköy/İSTANBUL or via your e-mail address registered in our system to bilgi@texttonext.com.

[ ] I have read the Clarification Text Regarding the Processing of Personal Data above.

EXPRESS CONSENT TEXT REGARDING THE PROCESSING OF PERSONAL DATA

In line with what is stated in the "Information Text on the Processing of Personal Data" prepared by Text to Next Anonim Şirketi ("TEXT TO NEXT") as the data controller, I expressly consent to the matters marked below as "I SHOW EXPLICIT CONSENT/WANT TO BE INFORMED", without being influenced in any way. I accept, declare and undertake.

 Transfer of my personal data obtained by T2N in accordance with KVKK and information text abroad in accordance with the purposes specified in the information text (especially in case of using various services whose servers are located abroad, it allows the transfer of the said service to servers abroad)