INFORMATION ABOUT PRIVACY AND PROTECTION OF PERSONAL DATA

Dear Customers,

We request some of your personal data in order to provide you with better service and to fulfill our obligations arising from the Consumer Protection Law No. 6502 and the Distance Contracts Regulation.

As TEST A.Ş. ("TEST"), we present the following explanations to the attention of our valued customers and third parties using our website in order to fulfill the disclosure obligation arising from Article 10 of the Personal Data Protection Law No. 6698 (" KVKK ").

1. What is the legal basis for SÜTAŞ to collect personal data?

First of all, the principles of protection of personal data have been determined by the Constitution of the Republic of Turkey and the KVKK numbered 6698. In addition, the Law on Regulation of Electronic Commerce numbered 6563 also includes provisions regarding the protection of personal data. The Turkish Penal Code numbered 5237 provides for penal sanctions to be applied in some cases to ensure the protection of personal data. On the other hand, the collection and use of data is required to fulfill our obligations arising from the Law on Consumer Protection numbered 6502 and the Distance Contracts Regulation.

2. What methods does SÜTAŞ use to collect personal data?

https://sutas.market The data provided by our customers who make transactions through the website, mobile applications and our call center are processed by SÜTAŞ with the consent of our customers and in accordance with the provisions of the legislation.

SÜTAŞ will collect, process, share with third parties and store securely your browsing information in order to provide better service to https://sutas.market visitors and within the framework of its legal obligations, within the purposes and scope specified in this Information on Privacy and Protection of Personal Data.

https://sutas.market may monitor your browsing information and/or usage history on the website, analyze and interpret your visitor movements and preferences in order to make special promotions for you, to present promotional and marketing offers, to improve the content of the website or mobile application for you and/or to determine your preferences.

SÜTAŞ also enables you to connect to the https://sutas.market website or applications through social media platforms (e.g. Facebook, Google social networking sites), and during such a connection, it may collect the profile information and personal data that you and your social media friends share publicly on their social media accounts, together with your browsing/traffic information on the websites and applications.

https://sutas.market may match information collected online and offline with information collected from you on the site through different methods or at different times and use this information together with information obtained from other sources, such as third parties.

We would like to point out that the https://sutas.market website is a site that uses cookies. A cookie is a file consisting mostly of letters and numbers that is stored on the internet browser or hard drive of the device being used, allowing the device in question to be identified.

https://sutas.market uses cookies to remember the choices you make and to personalize your use of the website/mobile application. This use includes cookies that save your password and ensure that your website/mobile application session remains open, thus saving you the trouble of entering your password multiple times on each visit, and cookies that remember and recognize you on subsequent visits to the website/mobile application.

https://sutas.market uses cookies to determine how you use the website/mobile application, including tracking how you use the website/mobile application, such as where you connect to the website from, what content you view on the website/mobile application, and the duration of your visit.

Cookies on the https://sutas.market website are used for advertising/promotion purposes to provide you with more appropriate content and advertisements according to your interests. In this way, when you use the website/mobile application, it offers you more appropriate content, personalized campaigns and products and does not offer you content or opportunities that you have previously stated you do not want.

https://sutas.market website cookies may also be used to activate "advertising technology" in order to present you with advertisements that it thinks may be of interest to you when you visit search engines, the website, mobile application and/or the websites where the website advertises. Advertising technology uses information about your previous visits to the website/mobile application and the websites/mobile applications where the website advertises in order to present you with advertisements that are specific to you.

https://sutas.market uses session cookies and persistent cookies in its mobile application. A session ID cookie expires when you close your browser. A persistent cookie remains on your hard drive for a long time. You can remove persistent cookies and reject both session cookies and persistent cookies by following the instructions in your internet browser's "help" file or by visiting https://www.allaboutcookies.org or https://www.youronlinechoices.eu. If you reject persistent cookies or session cookies, you can continue to use the website/mobile application, but you may not be able to access all the functions of the website/mobile application or your access may be limited.

3. For what purposes does SÜTAŞ use personal data?

SÜTAŞ may record, store, update, disclose to third parties, transfer, classify and process your personal data in the cases and to the extent permitted by the legislation. Any operation performed on your personal data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing its use, through fully or partially automatic means or non-automatic means provided that it is part of any data recording system, is considered as "processing of personal data". Your personal data is processed for the following purposes:

• To confirm the identity information of the person performing the transaction/the person who has it performed,
• Recording the address and other necessary information for communication,
• To be able to contact you regarding the conditions or current status of your distance sales contract,
• To be able to organize all records and documents that will form the basis of the transaction in electronic (internet / mobile etc.) or paper environment,
• To be able to fulfill the obligations undertaken in accordance with the distance sales contract,
• In addition, with your approval, to design periodic campaign studies, special advertisements, campaigns and other promotional activities for customer profiles, to conduct customer "classification" studies in line with the obtained data, to conduct survey and telemarketing applications, data mining and other statistical analyses.
• To evaluate customer complaints and suggestions regarding our products and services,
• To be able to fulfill our obligations arising from KVKK and to exercise our rights arising from the legislation.

4. How does SÜTAŞ protect your personal data?

All personal data you have shared is under the supervision and control of SÜTAŞ, which has the title of "Data Controller" within the scope of the KVKK numbered 6698. SÜTAŞ has assumed the responsibility as the "Data Controller" to establish the necessary organization and to take and adapt technical measures in order to protect the confidentiality and integrity of information in accordance with the relevant legislation in force. Being aware of our obligation in this regard, we would like to inform you that we always update our data processing policies in accordance with international and national technical standards regarding data confidentiality.

5. Does SÜTAŞ share your personal data?

Sharing of your personal data with third parties is carried out within the framework of the permission you have given and, as a rule, personal data is not shared with third parties without the approval of our customers. However, due to and limited to our legal obligations, your personal data may be shared with courts and other public institutions. In addition, personal data is transferred to third parties with whom we have agreements in order to provide the services we undertake and to perform quality control of the services provided. Necessary technical and legal measures are taken to prevent violations of rights during data transfer to third parties. However, SÜTAŞ is not responsible for violations arising from the data protection policies of the third party receiving personal data and occurring under the responsibility of the third party.

6. Does SÜTAŞ share your personal data with third parties abroad?

Your personal data may be shared with SÜTAŞ Group (Yılmaz Holding A.Ş. and/or its affiliates, subsidiaries, joint ventures and all branches and offices thereof), program partner institutions and organizations that we cooperate with in order to carry out our activities, domestic/overseas persons and organizations from whom we receive data storage services in the cloud environment, companies from which we receive infrastructure services regarding websites and mobile applications, domestic/overseas organizations with which we have agreements regarding the transmission of commercial electronic messages that we will send to you, if you have your approval, the Interbank Card Center, banks with which we have agreements, survey companies with which we work within the scope of various marketing activities in order to provide you with better service and to ensure customer satisfaction, and other domestic/overseas third parties and relevant business partners.

7. What are your rights arising from the Personal Data Protection Law?

In accordance with KVKK, your personal data;

1. To find out whether it is processed or not,
2. Requesting information if it has been processed,
3. To learn the purpose of processing and whether it is used in accordance with its purpose,
4. Knowing the third parties to whom the data is transferred domestically / abroad,
5. Request correction if it is processed incompletely/incorrectly,
6. Request deletion/destruction within the framework of the conditions set forth in Article 7 of the KVKK,
7. Requesting notification of the transactions made pursuant to clauses (d) and (e) above to third parties to whom the data was transferred,
8. To object to a result that is to your detriment due to analysis by exclusively automated systems,
9. To request compensation for damages in case you suffer damages due to processing of your data in violation of the KVKK,

We would like to remind you that you have rights.

8. How can I be informed about changes in legislation regarding personal data?

We would like to inform you that in case of any change in the legislation regarding personal data, we will update the information on our page in accordance with the new legislation, and you can always easily follow the updates on this page.

9. How can I be sure that data is kept up to date and accurate?

According to Article 4 of the KVKK, SÜTAŞ is obliged to keep your personal data accurate and up-to-date. In this context, in order for SÜTAŞ to fulfill its obligations arising from the current legislation, our customers must share accurate and up-to-date data with SÜTAŞ. If your data changes in any way, we kindly request that you update your data by contacting us through the communication channels specified below.

10. Would you like to ask SÜTAŞ questions about your personal data?

As a data owner, you can inform us about your requests regarding your rights within the scope of KVKK using the "Sütaş Süt Ürünleri A.Ş. Application Form". As personal data owners, if you forward your requests regarding your rights to Sütaş using the methods specified in this Information Text on Privacy and Protection of Personal Data and the Sütaş Süt Ürünleri A.Ş. Application Form, Sütaş will finalize your request free of charge within 30 (thirty) days at the latest. However, if a fee is foreseen by the Personal Data Protection Board, the fee in the tariff determined by Sütaş may be requested.

INFORMATION ABOUT THE PROTECTION OF PERSONAL DATA

We attach great importance to ensuring the security of your personal information that you have provided to us, whether while using our website or through other means. The "Personal Data Protection Law" No. 6698 has entered into force. We would like to inform you about the aforementioned legislation and some definitions specified in this legislation:

Personal data : Any information relating to an identified or identifiable natural person,

Processing of Personal Data: All kinds of operations performed on personal data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, in whole or in part, by automatic means or non-automatic means provided that it is part of any data recording system,

Data processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted to him,

Data recording system: The recording system in which personal data is structured and processed according to certain criteria,

Data controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

1. Purpose of the Protection of Personal Data and Consent Text and Our Company's Data Controller Position:

Our shopping site has the title of "data controller" within the scope of the Law on the Protection of Personal Data No. 6698 ("Law") regarding personal data related to customers, and this Personal Data Protection and Consent Text aims to inform customers about the personal data processing activities carried out by our shopping site in accordance with the said Law and to obtain their explicit consent for the situations specified in Article 3 below.

3. Personal Data to be Processed with the Explicit Consent of Customers and the Purposes of Processing:

For the following situations where the personal data processing conditions in Articles 5/2 and 6/3 of the Law cannot be met, the explicit consent of the customers must be obtained in order for our Shopping site to process personal data.

2. Purpose of Processing Personal Data of Customers:

Personal data of customers are processed within the framework of the personal data processing conditions and purposes specified below and in Articles 5 and 6 of the Law. Personal data of customers;

• The necessary work to be done by the business units and the execution of the relevant business processes in order to enable the relevant people to benefit from the products and services offered by our shopping site,

• The necessary work to be done by the relevant business units and the execution of related business processes in order to carry out the commercial activities carried out by our shopping site,

• Planning and executing commercial and/or business strategies of our shopping site,

• To plan and execute the activities required to ensure the legal, technical and commercial-work safety of the relevant persons who have a business relationship with our shopping site, and to recommend and introduce the products and services offered by us to the relevant persons by customizing them according to their tastes, usage habits and needs,

• Establishment of possible rights and claims of the interested parties

• Providing information to authorized institutions based on legislation

• Creating and tracking visitor records

• To ensure that obligations are fulfilled within the scope of the Law on Consumer Protection, the Law on Regulation of Retail Trade and other legal legislation by our Company and our branches, call center, affiliated companies on behalf of our Company or through our websites and social media pages or through all kinds of channels, including but not limited to these,

• To provide better service to customers, to provide and offer various advantages, to provide information about sales, marketing, information, promotions, to provide information about campaigns and conditions, to conduct surveys and customer satisfaction research, to provide and accelerate your purchasing transactions, to receive and deliver your orders,

• Creating campaigns for customers, cross-selling, determining the target audience,

• To track customer movements and carry out activities that increase user experience, to improve the operation of our shopping site's website and mobile application and to personalize it according to customer needs, to carry out direct and indirect marketing, personalized marketing and remarketing activities, to carry out personalized segmentation, targeting, analysis and in-house reporting activities, market research,

• It may be processed in line with the consent of the Customer within the scope of planning and execution of sales and marketing processes of products and/or services of our shopping site, including the planning and execution of customer satisfaction activities and customer relations management processes, planning and execution of processes of creating and/or increasing loyalty to products and/or services offered by our shopping site, and it may be shared with the parties specified in this Personal Data Protection Text.

Our Shopping Site; has the right to associate the behavior of the user who visits the site, even if they are not a member, with a cookie in the browser for the purpose of online behavioral advertising and marketing, and to define remarketing lists based on metrics such as the number of pages viewed, duration of visit and number of goal completions. Targeted advertising content can then be displayed to this user on the site or on other sites in the Display Advertising Network, according to the interests of the users. During the redirection of Google AFS ads to our Shopping Site, Google may place cookies on the users' browsers or read the cookies in them or use web beacons to collect information.

4. Transfer of Personal Data of Customers:

Personal data belonging to customers may be shared with Company officials, our affiliates, business partners, suppliers, shareholders, legally authorized public institutions and organizations and private institutions within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, including the performance of the necessary studies by the business units and the execution of the relevant business processes in order to enable the relevant persons to benefit from the products and services offered by our shopping site, the performance of the necessary studies by the relevant business units and the execution of the related business processes in order to carry out the commercial activities carried out by our shopping site, the planning and execution of the commercial and/or business strategies of our shopping site, the planning and execution of the activities necessary to ensure the legal, technical and commercial-business security of our shopping site and the relevant persons who have a business relationship with our shopping site, and the planning and execution of the activities necessary to customize the products and services offered by our shopping site according to the tastes, usage habits and needs of the relevant persons and to recommend and introduce them to the relevant persons.

The User's Name and Contact Information may be shared with payment institutions for the purpose of identity verification in accordance with the framework agreement of the payment institution that the User will approve during the payment phase and in accordance with the Regulation on Measures to Prevent Laundering Proceeds of Crime and Financing of Terrorism published in the Official Gazette dated January 9, 2008 and numbered 26751.

Our Shopping Site may transfer personal data to third parties domestically and abroad, provided that the conditions stipulated in Law No. 6698 are met, within the scope of the purposes stated above.

5. Collection Method and Legal Reason of Personal Data:

Personal data is collected from customers electronically. Personal data collected for the legal reasons specified above can be processed and transferred for the purposes specified in Articles 5 and 6 of the Law and this Personal Data Protection Text.

6. Storage Periods of Personal Data

Our Shopping Site stores personal data for the period specified in the relevant laws and legislation, if stipulated in these legislations.

If there is no regulation in the legislation regarding how long personal data should be stored, Personal Data is processed for a period of time that is required to be processed in accordance with the practices and commercial practices of Our Shopping Site, depending on the activity carried out while Our Shopping Site was processing that data, and then deleted, destroyed or made anonymous.

If the purpose of processing personal data has ended; if the storage periods determined by the relevant legislation and our Shopping Site have also expired; personal data can only be stored as evidence in possible legal disputes or for the purpose of asserting the relevant right related to personal data or establishing a defense. In establishing the periods herein, the storage periods are determined based on the statute of limitations for asserting the said right and the examples of previous requests directed to our Shopping Site on the same issues despite the expiration of the statute of limitations. In this case, the stored personal data is not accessed for any other purpose and access is provided to the relevant personal data only when it is necessary to be used in the relevant legal dispute. Here too, after the mentioned period has expired, personal data is deleted, destroyed or anonymized.

7. Rights of Customers as Personal Data Owners:

In accordance with Article 11 of the Law, data owners; (i) They have the right to learn whether their personal data has been processed, (ii) if their personal data has been processed, to request information about it, (iii) to learn the purpose of processing personal data and whether they are used in accordance with their purpose, (iv) to know the third parties to whom personal data has been transferred in the country or abroad, (v) to request correction of personal data if they are processed incompletely or incorrectly and to request notification of the action taken within this scope to third parties to whom personal data has been transferred, (vi) to request deletion or destruction of personal data if the reasons requiring processing are eliminated despite the fact that it has been processed in accordance with the provisions of the Law and other relevant laws and to request notification of the action taken within this scope to third parties to whom personal data has been transferred, (vii) to object to the emergence of a result to the detriment of the person by means of analysis of processed data exclusively through automated systems and (viii) to request compensation for the damages in case the person suffers damages due to unlawful processing of personal data.

Requests regarding the use of the rights in question may be forwarded to personal data owners by our Shopping Site using the methods specified in Law No. 6698. Our shopping site will evaluate the requests in question and finalize them within 30 days.

There may be changes in the matters included in this form in line with legal and technological developments.