NFORMATION ON THE PROTECTION OF PERSONAL DATA

We place great importance on ensuring the security of your personal information provided to us either through our website or by other means. The Law No. 6698 on the Protection of Personal Data (“Law”) has come into effect. We would like to inform you about this legislation and some definitions stated therein:

Personal Data: Any information relating to an identified or identifiable natural person.

Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, classifying, or preventing the use of data, either fully or partially by automatic means or by non-automatic means as part of a data recording system.

Data Processor: A real or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Data Recording System: A structured system where personal data are processed according to specific criteria.

Data Controller: A real or legal person who determines the purposes and means of processing personal data, responsible for establishing and managing the data recording system.

1. Purpose of the Personal Data Protection and Consent Text and Our Company’s Position as Data Controller:

The website www.vinolus.com.tr acts as a “data controller” within the scope of the Law No. 6698 on the Protection of Personal Data (“Law”) regarding customers’ personal data. This Personal Data Protection and Consent Text aims to inform customers about the personal data processing activities performed by our site under the Law and to obtain their explicit consent for the situations specified in Article 3 below.

2. Purpose of Processing Personal Data of Customers:

Personal data of customers are processed within the scope of the personal data processing conditions and purposes set forth in Articles 5 and 6 of the Law. These personal data are processed for:

• Necessary work by relevant business units to enable relevant persons to benefit from the products and services offered by our site and to carry out related business processes,

• Conducting commercial activities managed by our site and related business processes,

• Planning and execution of our site’s commercial and/or business strategies,

• Ensuring the legal, technical, and commercial-business security of relevant persons in business relations with our site, customizing and promoting our products and services according to their preferences, usage habits, and needs by planning and executing necessary activities,

• Establishing possible rights and receivables claims of the data subjects,

• Providing information to authorized institutions as required by legislation,

• Creating and monitoring visitor records,

• Fulfilling obligations within the scope of the Consumer Protection Law, Retail Trade Regulation Law, and other legislation through our company, call center, subsidiaries, websites, and social media channels,

• Providing better services to customers, offering various advantages, providing information about sales, marketing, promotions, campaigns and conditions, conducting surveys and customer satisfaction research, facilitating purchase transactions, order receiving, and delivery,

• Creating customer campaigns, cross-selling, identifying target audiences,

• Monitoring customer behaviors to enhance user experience, improving and personalizing the website and mobile applications, conducting direct and indirect marketing, personalized marketing, remarketing, segmentation, targeting, analysis, and internal reporting, as well as market research,

• Planning and executing customer satisfaction activities and customer relationship management processes,

and other purposes related to planning and execution of the sales and marketing processes of the products and/or services offered on our site, and increasing customer loyalty. Processing and sharing of personal data with parties specified in this Personal Data Protection Text is subject to customer consent.

Our site has the right to associate the behavior of users visiting the site, even if they are not members, with a browser cookie to enable online behavioral advertising and marketing, and to define remarketing lists based on metrics such as number of pages viewed, visit duration, and goal completion counts. Subsequently, targeted advertising content can be shown to these users on the site or other sites in the Display Advertising Network based on their interests. Google AFS ads may place cookies on users’ browsers or read cookies for data collection or use web beacons when directing users to our site.

3. Personal Data to Be Processed with Customers’ Explicit Consent and the Purposes of Processing:

For cases where personal data processing conditions specified in Articles 5/2 and 6/3 of the Law are not met, explicit consent of the customers must be obtained for the processing of personal data by our site.

4. Transfer of Customers’ Personal Data:

Customers’ personal data may be shared with company officials, subsidiaries, business partners, suppliers, shareholders, legally authorized public institutions and organizations, and private entities within the scope of the personal data processing conditions and purposes stated in Articles 8 and 9 of the Law, including but not limited to activities necessary for enabling relevant persons to benefit from products and services, carrying out commercial activities, planning and executing commercial and/or business strategies, ensuring legal, technical, and commercial-business security, customizing and promoting products and services.

User’s name and contact information may be shared with payment institutions for identity verification purposes within the framework of the payment institution agreement approved during payment and according to the Regulation on Measures Against Laundering of Crime Revenues and Financing of Terrorism published in the Official Gazette No. 26751 dated January 9, 2008.

Our site may transfer personal data to third parties domestically or abroad, provided that the conditions stipulated in Law No. 6698 are met.

5. Methods of Collection and Legal Basis for Personal Data:

Personal data is collected electronically from customers. The personal data collected on legal grounds mentioned above are processed and transferred according to the purposes specified in Articles 5 and 6 of the Law and this Personal Data Protection Text.

6. Retention Periods of Personal Data:

Our site stores personal data for the period prescribed in relevant laws and regulations.

If no period is stipulated by law, personal data is processed only for as long as necessary in connection with the activities conducted and in accordance with our practices and commercial life customs, after which it is deleted, destroyed, or anonymized.

If the purpose of processing personal data ends, and the storage periods stipulated by law and our site have expired, personal data may only be retained for potential legal disputes, to establish evidence, or to assert or defend related rights. The retention periods are determined based on statutes of limitation and prior similar requests to our site. Access to such data for other purposes is not allowed and will only be made available when necessary for the legal dispute. After this period, data is deleted, destroyed, or anonymized.

7. Rights of Customers as Personal Data Owners:

According to Article 11 of the Law, data subjects have the rights to:

(i) Learn whether their personal data is processed,

(ii) Request information if personal data has been processed,

(iii) Learn the purpose of processing and whether data is used accordingly,

(iv) Know the third parties domestic or abroad to whom personal data is transferred,

(v) Request correction if personal data is incomplete or inaccurately processed and request notification of this correction to third parties,

(vi) Request deletion or destruction of personal data if reasons requiring processing no longer exist, and request notification of this to third parties,

(vii) Object to results against themselves obtained by exclusively automatic processing,

(viii) Claim compensation for damages arising from unlawful processing of personal data.

Requests related to the exercise of these rights can be submitted via the methods specified by our site under Law No. 6698. Requests will be evaluated and concluded within 30 days.

The provisions in this form are subject to change in line with legal and technological developments.