DEFINITIONS

In this privacy notice;

Personal Data: Refers to any information relating to an identified or identifiable natural person.Personal Data Protection Law (“KVKK”): Refers to the Personal Data Protection Law No. 6698, which entered into force upon its publication in the Official Gazette on April 7, 2016.

Data Processor: Refers to the natural or legal person who processes Personal Data on behalf of the data controller, based on the authority granted by the data controller.

Data Controller: Refers to the natural or legal person who determines the purposes and means of processing Personal Data and is responsible for the establishment and management of the data recording system.

IDENTITY OF THE DATA CONTROLLER

As Eksen Pazarlama ve Satış Danışmanlık Anonim Şirketi and Gelişim Satış ve Pazarlama Hizmetleri Anonim Şirketi within TRİBAL, we hereby inform you that we process your personal data in the capacity of data controller within the scope of the Personal Data Protection Law No. 6698 and other relevant legislation.

Data Controller	Eksen Pazarlama ve Satış Danışmanlık Anonim Şirketi, Gelişim Satış ve Pazarlama Hizmetleri Anonim Şirketi within TRİBAL
Address of the Data Controller	Koşuyolu Mah. Cenap Şehabettin Sk. No:49/51 D:5 Kadıkö İstanbul
Communication Channel	info@tribal.com.tr

As Tribal-Eksen Pazarlama ve Satış Danışmanlık Anonim Şirketi and Gelişim Satış ve Pazarlama Hizmetleri Anonim Şirketi, we know the value of your trust in us. We would like to state that we process your personal data in accordance with the principles and rules stipulated under the Personal Data Protection Law No. 6698 (“Law No. 6698”), store it in secured environments, and are highly sensitive about your rights. In this context, we would like to inform you about the use and protection of your personal data processed by us in order to fulfill our disclosure obligation arising from Article 10 of the Personal Data Protection Law No. 6698 (hereinafter referred to as “KVKK”).

A) METHOD OF PERSONAL DATA COLLECTION, PURPOSE OF PROCESSING, AND LEGAL GROUNDS

1. General/Special Introduction and Announcement of Advertisements About Products and Services
(KVKK Art. 5 (1): Explicit consent)

2. Sharing of Content Such as Presentations and Newsletters, and Current Developments

(KVKK Art. 5 (2) (c): Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract.)

3. Execution of Product / Service Sales and Advertisement / Campaign / Promotion Processes

4. Execution of Service Procurement Processes

5. Execution of Service Sales Processes

6. Execution of Customer Satisfaction Oriented Activities

7. Execution of Customer Relationship Management Processes

8. Execution of Communication Activities

9. Execution of Activities in Compliance with the Legislation

10. Execution of Finance and Accounting Affairs

11. Execution of Contract Processes

(KVKK Art. 5 (2) (ç): It is mandatory for the data controller to fulfill its legal obligation.)

12. Execution of Storage and Archiving Activities

13. Providing Information to Authorized Persons, Institutions, and Organizations

(KVKK Art. 5 (2) (e): Data processing is mandatory for the establishment, exercise, or protection of a right.)

14. Follow-up and Execution of Legal Affairs

15. Follow-up of Requests / Complaints

Within the scope of fulfilling the purposes listed in this article, your personal data may be collected in accordance with Law No. 6698 via written and electronic media, through automatic and partially automatic methods, or non-automatic methods provided that they are part of a data recording system. This occurs through channels such as filling out the “contact us” form on our website, communicating via our “info@tribal.com.tr” e-mail address and our social media channels, our customer support hotline at +90 216 545 09 60, and through meetings and forms conducted via sales contracts, other agreements, events, and exhibitions.

Your personal data is processed in accordance with the general principles set forth in Article 4 of the Law; lawfully and fairly, accurately and where necessary kept up to date, for specified, explicit, and legitimate purposes, relevant, limited, and proportionate to the purposes for which they are processed, and retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

In this framework, your personal data is collected and processed by our Company based on the personal data processing conditions specified in Article 5 of the Law for the following purposes and legal grounds: Based on the legal ground that “it is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract”: Your identity and communication data will be processed for the purposes of creating product and service offers, providing information regarding stock statuses, and updating customer contact information; your identity, communication, customer transaction, and financial data will be processed for the purpose of executing product order processes, opening sales records, and carrying out invoicing activities.Based on the legal ground that “it is expressly provided for by the laws and it is mandatory for the data controller to fulfill its legal obligation”: Your identity, communication, and customer transaction data will be processed to fulfill the legal obligations to which our Company is subject, to provide information to authorized organizations arising from the legislation, and to fulfill official institution requests; your identity, communication, and financial data will be processed to execute financial operations and complete invoicing processes.

Based on the legal ground that “data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”: Your identity, communication, and customer transaction data will be processed for the purposes of executing and auditing customer relationship processes, and conducting studies aimed at improving our product supply and service processes; your identity, communication, customer transaction, financial, legal transaction, physical venue security, and audio-visual recording data will be processed to ensure the legal, technical, and commercial-business security of our company and the relevant persons who have business relations with our company; your transaction security data will be processed for the execution of information security processes; your identity, communication, customer transaction, financial, and marketing data will be processed for the reporting, auditing, and inspection of our business processes.

Based on the legal ground that “data processing is mandatory for the establishment, exercise, or protection of a right”: Your identity, communication, customer transaction, and audio recording data will be processed to receive, evaluate, and conclude your requests, questions, suggestions, and complaints; your identity, communication, customer transaction, legal transaction, and transaction security data may be processed to protect and exercise our rights and to follow up on legal processes in the event of a potential legal dispute.

In the presence of your explicit consent: Your identity and communication data will be processed to carry out promotional, newsletter, event, and campaign information communications and to send commercial electronic messages in accordance with the Regulation on Commercial Communication and Commercial Electronic Messages.

Your identity, communication, customer transaction, and marketing data will be processed to conduct the marketing processes of our Company’s products and services by contacting you, and to customize, suggest, and introduce the products and services offered by our Company according to your likes, usage habits, and needs, including profiling and analysis activities.

Your identity, communication, customer transaction, and marketing data may be processed to conduct research, surveys, and review studies regarding customer satisfaction.

Your explicit consent is requested separately and independently from this privacy notice, and even if you give consent, you always retain the right to withdraw this consent. Even if you do not grant explicit consent, you can continue to benefit from all our sales and after-sales services whose legal basis is not explicit consent.

Cookies are available on our Website in order to provide better service to our visitors and customers.

You can access detailed information regarding cookies from our cookie policy.

B) PROCESSED PERSONAL DATA

Within the scope of the above-mentioned purposes and processes, if you share them with us, we can process your identity, communication, customer transaction information (e.g., requests submitted to us, order information), marketing information, transaction security information, legal transaction information, visual and audio recordings, physical venue security information (closed-circuit camera recordings taken for security purposes), and financial information during payment transactions.

C) TO WHOM AND FOR WHAT PURPOSE THE PROCESSED PERSONAL DATA MAY BE TRANSFERRED

Your personal data may be transferred, within the scope of the specified purposes, domestically or abroad, to:

TRİBAL’s internal entities—Eksen Pazarlama ve Satış Danışmanlık Anonim Şirketi and Gelişim Satış ve Pazarlama Hizmetleri Anonim Şirketi, their business partners, the companies they serve, and other private and legal persons;

Companies acting on behalf and account of our company, and our authorized representatives;

Regulatory and supervisory institutions, and public institutions or organizations explicitly authorized by law to request your personal data;

Business partnerships, supplier and contractor companies, banks, credit risk and financial institutions, and other real or legal persons within the scope of the specified purposes;

Tax and similar consultants, persons mandatory for legal follow-up processes, institutions and organizations, and third parties from whom we receive consultancy, including auditors, and without limitation, business partners, service provider third parties, and authorized persons and organizations for the purposes mentioned above.

Your personal data may be shared with our business partners, service provider suppliers, affiliates, group companies, shareholders, legally authorized public institutions, and legally authorized private persons in accordance with the data transfer and processing conditions specified in Articles 8 and 9 of the Law, provided that adequate and effective measures are taken pursuant to the security and confidentiality principles determined in the legislation to ensure the fulfillment of the purposes listed above.

D) RIGHTS OF THE PERSONAL DATA SUBJECT ENUMERATED IN ARTICLE 11 OF LAW NO. 6698

As personal data subjects, your rights pursuant to Article 11 of Law No. 6698 are as follows:

To learn whether personal data is processed or not,

To request information if personal data has been processed,To learn the purpose of processing personal data and whether they are used appropriately for their purpose,

To know the third parties to whom personal data are transferred domestically or abroad,

To request correction of personal data if it is incomplete or incorrectly processed, and to request notification of this operation to third parties to whom personal data has been transferred,

To request the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist, despite being processed in accordance with the provisions of Law No.

6698 and other relevant laws, and to request notification of this operation to third parties to whom personal data has been transferred,

To object to the occurrence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,

To request compensation for the damage in case of loss due to unlawful processing of personal data.

Pursuant to paragraph 1 of Article 13 of the KVK Law, you can submit your request regarding the exercise of your above-mentioned rights to our company in writing or by other methods determined by the Personal Data Protection Board.

To exercise your above-mentioned rights, you can hand-deliver your request petition along with the necessary information identifying your identity, send it via a notary public or other methods determined by the Personal Data Protection Board, or transmit it to info@tribal.com.tr with a secure electronic signature.

Your applications will be concluded free of charge by our company as soon as possible and within 30 (thirty) days at the latest, depending on the nature of your request; however, if the transaction requires an additional cost, a fee may be charged according to the tariff to be determined by the Personal Data Protection Board.