Privacy Agreement
Protection of Personal Data and Privacy Policy

Website Privacy Agreement

While you visit this website and benefit from the services we offer through this site, the information we obtain regarding you and the services you request will be used and protected according to the terms and conditions set forth in this "Privacy Policy". By visiting this website and requesting to benefit from the services we offer through this site, you accept the terms and conditions set forth in this "Privacy Policy".

I. Purpose of the Personal Data Protection and Processing Policy

The Personal Data Protection Law No. 6698 ("Law") was published in the Official Gazette on April 7, 2016 and entered into force. The Law sets forth the procedures and principles regarding the processing of personal data by real or legal persons who are classified as "data controllers" of personal data and who determine the purposes and means of processing personal data and are responsible for the establishment and management of the data recording system.

Data controllers are obliged to inform and enlighten the real persons whose data is processed when obtaining data belonging to a real person. Within the scope of this obligation, data controllers are obliged to inform data owners about;

✓ The identity of the data controller and its representative, if any,

✓ The purpose for which personal data will be processed,

✓ To whom and for what purpose the processed personal data can be transferred,

✓ The method and legal reason for collecting personal data,

✓ Other rights listed in Article 11 of the Law,

The subject of this Policy is our Company's real and legal person customers, real person authorities, shareholders and employees of legal person customers, prospective customers, our group companies, real person authorities, partners and employees of our business partners and suppliers, our working candidates, people who have worked for our company from the past to the present and interns, our visitors, company authorities and partners, business partners and prospective suppliers and other third parties, and the matters regarding the processing of personal data regarding company employees are in accordance with the legal legislation.

We thank you for your interest in our website. Data security is extremely important to us and we take all necessary measures to protect this data. Our website

can generally be used without providing any personal data. However, if the products and services specified on our website are to be used through our website, your personal data

may need to be processed.

Personal data is all information related to an identified or identifiable real person. A natural person can be identified directly or indirectly, in particular by a name, an identification number, location data,

an online identifier or the physical, physiological, genetic, psychological,

economic, cultural or social identity of that natural person.

The data controller is the natural or legal person, authority, institution or other body that determines the purposes and means of processing personal data,

alone or together with others.

This policy is regulated within the scope of the protection of employee personal data given to company employees.

II. Scope and Amendment of the Personal Data Protection and Processing Policy

This Policy prepared by our Company has been prepared in accordance with the Personal Data Protection Law No. 6698 (“KVKK”). The Law has entered into force with all its provisions as of today. Data obtained from you with your consent or in accordance with other laws listed in the Law will be used to improve the quality of the services we provide, and to improve the services provided to you and our quality policy. Again, some of the data we have is depersonalized and anonymized. These data are data used for statistical purposes and are not subject to the application of the Law and our Policy. Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi Personal Data Protection and Processing Policy aims to protect the automatically obtained data of our customers, prospective customers, employees, and customers and employees of companies working with us in solution partnerships or other persons and includes the regulations regarding these. Our Company has the right to amend our policy and Regulation - provided that they comply with the Law and provide better protection of personal data.

III. Basic Rules Regarding the Processing of Personal Data

General Principles Regarding the Processing of Personal Data

Personal data must be processed in accordance with the procedures and principles specified in the legal legislation in accordance with Article 4 of the KVKK. In this context, data controllers must fulfill their obligation to inform and comply with the general principles specified in Article 4 of the KVKK and stated below:

✓ Being in compliance with the law and the rules of honesty.

✓ Being accurate and up-to-date when necessary.

✓ Being processed for specific, clear and legitimate purposes.

✓ Being related to, limited and proportionate to the purpose for which they are processed.

✓ Being kept for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed.

Purposes of Processing and Transferring Personal Data Within the Scope of the Law

a. Purposes Regarding the Processing of Personal Data

Personal data cannot be processed without the consent of the natural person who owns the data. However, in some cases (KVKK art. 5 and 6) personal data may be processed without explicit consent.

According to Article 5 of the KVKK, personal data may be processed without the consent of the natural person whose data is processed in cases such as;

✓ Data processing is clearly prescribed by law,

✓ Processing of the relevant data is mandatory for the protection of the life or physical integrity of the person who is unable to give his/her consent due to a de facto impossibility or whose consent is not legally valid, or of another person,

✓ Processing of personal data belonging to the parties to the contract is necessary, provided that it is directly related to the establishment or performance of a contract,

✓ Data processing is mandatory for the data controller to fulfill its legal obligation,

✓ Personal data is made public by the relevant person,

✓ Data processing is mandatory for the establishment, exercise or protection of a right,

✓ Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.

In addition, data related to health, sexual life, sexual preference, ethnicity, race, political opinion, belief, sect, dress code, foundation or union membership, criminal conviction and security measures, as well as biometric and genetic data, have been designated as “special” data in the law, considering that the person would be subject to discrimination if they were to be discovered, and the processing conditions for these data have been made more stringent. Accordingly, special data may be processed under the following conditions, except for cases where explicit consent is obtained:

✓ The data owner's religion, sect or other beliefs, ethnic origin, race, philosophical belief, political opinion, criminal conviction and security measures, appearance and dress, association, foundation or union membership data, and biometric and genetic data may be processed in cases specified by law.

✓ Data related to health and sexual life may be processed by persons, institutions and organizations with a confidentiality obligation for the purposes of protecting public health, medical diagnosis, planning health duties and financing, preventive medicine, treatment and care processes, and their management.

b. Purposes of Sharing Personal Data

In order to share the obtained personal data with a third party person or institution, explicit consent must be obtained from the relevant data owner. However, according to Article 8 of the KVKK, data transfer can also be provided under the conditions permitted for data processing, and in this respect, personal data transfer can be made even if the explicit consent of the data owner is not present, provided that the conditions specified in Section 2.II.a above are met.

The transfer of personal data to third parties in the country or abroad is subject to special conditions. Personal data can be transferred abroad in the event of the explicit consent of the natural person who owns the data, or in the event that the natural person who owns the data does not have the explicit consent but one or more of the other conditions specified above are present; if the necessary protection measures are taken in the country to which the relevant data is transferred and if the necessary protection measures are not present in the country to which the relevant data is transferred, the data controller undertakes the necessary protection together with the data controller in the country to which the data is transferred and permission is obtained from the board.

Cases Out of Scope

According to Article 28 of the KVKK, the legal provisions will not apply in the following cases: ✓Processing of personal data by natural persons within the scope of activities related to themselves or their family members living in the same residence, provided that they are not disclosed to third parties and that the obligations regarding data security are complied with.

✓ Processing of personal data for purposes such as research, planning and statistics by making them anonymous with official statistics.

✓ Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy or personal rights or does not constitute a crime.

✓ Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order or economic security.

Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution procedures.

IV. Deletion of Personal Data

When the periods required by law to be stored expire, judicial processes are completed or other requirements are eliminated, personal data is deleted, destroyed or anonymized by our company on its own or upon the request of the relevant person.

Zayn Giyim Sanayi Ticaret Ltd Şti, as a rule, processes the data in its structure as declared upon the declaration of the relevant persons.
The Joint Stock Company is not obliged to investigate the accuracy of the data declared by customers or persons who contact it, and this is not done due to law and our working principles. The declared data is considered correct. The principle of accuracy and up-to-dateness of personal data has also been adopted by Zayn Giyim Ticaret Ve Sanayi Anonim Şirketi. Our company updates the personal data it has processed from the official documents it receives or upon the request of the relevant person. It takes the necessary measures for this.

Zayn Giyim Sanayi Ticaret Ltd Şti

Zayn Giyim Sanayi Ticaret Ltd Şti

V. Privacy and Data Security

Personal data is confidential and Zayn Giyim Sanayi Ticaret Ltd Şti also complies with this confidentiality. Only authorized persons can access personal data within the company. All necessary technical and administrative measures are taken to protect personal data collected by Zayn Giyim Ticaret Ve Sanayi Ltd Şti and to prevent it from falling into the hands of unauthorized persons and to prevent our customers and potential customers from being victimized. In this context, it is ensured that software complies with standards, third parties are carefully selected and the data protection policy is complied with within the company.

VI. Data Processing Purposes

Zayn Giyim Sanayi Ticaret Ltd Şti's collection and processing of personal data will be carried out in accordance with the purposes specified in the disclosure text.

✓  Supervision, planning and execution of employees’ data access authorizations,

✓  Supervision and monitoring of employees’ work activities,

✓  Supervision of finance and/or accounting affairs,

✓  Supervision of legal, litigation and enforcement processes,

✓  Planning and monitoring of human resources processes,

✓  Provision of work efficiency/productivity and/or appropriateness reviews,

Planning and/or execution of processes,

✓  Planning and execution of business partners’ and/or suppliers’ data access authorizations,

✓  Management of relationships with business partners and/or suppliers,

✓  Planning and/or execution of occupational health and/or safety processes,

✓  Planning and/or execution of business continuity activities,

✓  Planning and execution of corporate communication activities,

✓  Planning of corporate management activities and execution,

✓ Planning and execution of logistics activities,

✓ Planning and execution of customer relations management processes,

✓ Planning and/or execution of customer satisfaction activities,

✓ Monitoring of customer demands and complaints,

✓ Execution of personnel supply processes,

✓ Fulfillment of obligations arising from employment contracts and/or legislation for company employees,

✓ Planning and execution of company audit activities,

✓ Planning and execution of external training activities,

✓ Planning and execution of operational activities required to ensure that company activities are carried out in accordance with company procedures and/or legal legislation,

✓ Planning and/or execution of in-company training activities,

✓ Ensuring the security of company operations,

✓ Ensuring the security of company headquarters, branches and warehouses procurement,

✓  Planning and/or executing processes to create and/or increase loyalty to products and/or services offered by the company,

✓  Planning and/or executing the company's production and/or operational risk processes,

✓  Performing corporate and partnership law transactions,

✓  Following up contract processes and/or legal demands,

✓  Executing strategic planning activities,

✓  Planning and executing supply chain management processes,

✓ Fee management,

✓  Planning and executing production and/or operation processes,

✓  Planning and executing market research activities for sales and marketing of products and services,

✓  Planning and executing marketing processes of products and/or services,

✓  Planning and executing sales processes of products and/or services,

✓ Ensuring that data is accurate and up-to-date,

✓ Providing information to authorized institutions based on legislation,

✓ Creating and monitoring visitor records

VII. Categorization of Personal Data Processed by Our Company

The personal data and categories processed by our company are as follows:

Data Category

Contact Information Location Data Customer Data Customer Data

Personal Data Categorization Description

Information used to communicate with the relevant natural person (e.g. residence address, e-mail address, mobile phone number) Data used to determine the location of the data owner (e.g. location data obtained during vehicle use) Data regarding our customers who benefit from our goods and services (e.g. customer number, occupation information, etc.)

Data regarding all kinds of transactions performed by recipients who benefit from our goods and services (e.g. request, instruction, order, etc.)

Data included in documents such as driver's license, ID card, residence record, passport, attorney's ID, marriage certificate (e.g. TR ID, passport no., identity card serial no., name-last name, photograph, place of birth, date of birth, age, place of registration, sample identity card with certificate)

Customer Transaction Data

Personal data regarding records and documents taken at the entrance to the company's headquarters, branches and warehouses, during their stay at the headquarters, branches and warehouses (e.g. visit data, visual and audio data, camera recordings, etc.)

Physical Location Security Data

Personal information processed to ensure the administrative, technical, legal and commercial security and integrity of our company and related persons

Transaction Reliability Data

Personal data processed for your security (technical, administrative, legal and commercial) and to fulfill our company's legal obligations

Risk Management Data

Personal data processed to eliminate our company's commercial, technical and administrative risks

Financial Data

Personal data required to achieve this purpose for the purpose of auditing and reporting accounting and finance transactions (e.g., debit and credit balance, credit amount, credit card information, credit payments, credit interest rate and amount, etc.)

Personnel Data

The obligation to keep the personnel files of company employees at the workplace in accordance with the Labor Law No. 4857, 75, and all kinds of personal data processed within this scope

Employee Candidate Data

Personal data obtained during the application evaluation and interview process within the framework of the legal relationship between the employee candidate and the employer candidate established between our company and the data owners who share their information to apply for a job with our company (e.g., resume, education information, language skills results, etc.)

Employee Transaction Data

Personal data related to all kinds of transactions carried out by company employees related to work (e.g. records belonging to company computers, entry-exit records, business trips, data regarding the trainings attended, e-mail traffic tracking information, vehicle location and usage information, etc.)

Employee Performance and Career Development Data

Personal information processed for the purpose of evaluating the performance of company personnel and planning and executing their career development in line with HR policies (e.g. performance reports, interview results)

Side Benefits and Benefits Data

Personal information processed for the purpose of monitoring the side benefits and benefits offered to company personnel and ensuring that personnel benefit from them (e.g. private health insurance, vehicle allocation)

Marketing Data

Information to be used by our company in marketing activities (e.g. price offer, determination, customer habits, reports and determinations showing their likes)

Legal Transaction and Compliance Information

Personal data processed for the purpose of fulfilling our legal obligations as a company, exercising our rights such as defense, recourse, etc., managing and following up on lawsuit and enforcement processes

Audit and Inspection Information

Personal data processed for the purpose of fulfilling our company's legal obligations and implementing company policies

Special Personal Data

Individuals' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and attire, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data

Request/Complaint Management Data

Personal data regarding receiving and evaluating customer complaints, resolving the complaint or providing alternative suggestions (e.g. product or service-related requests and complaints, records and reports)

Visual and audio recordings associated with the owner of the personal data (e.g. Audio Recordings, photographs, camera recordings and voice recordings)

VIII. Customer, potential customer and business and solution partner data

Collection and processing of data for contractual relationships

If a contractual relationship has been established with our customers and potential customers, the personal data collected may be used without the customer's consent. However, this use is made in line with the purpose of the contract. Data is used to the extent of better execution of the contract and the requirements of the service and updated by contacting the customers when necessary. On the other hand, the data that our potential customers (potential customers) leave us is processed to provide them with easier and higher quality service later on. If this data has not turned into a contractual relationship upon their request, it is deleted.

Business and Solution Partner Data

Zayn Giyim Sanayi Ticaret Ltd Şti adopts the principle of acting in accordance with the law when sharing data with both business and solution partners. With business and solution partners, data is shared with a commitment to data confidentiality and only as much data as the service requires, and these parties are forced to take measures to ensure data security.

Data processing for advertising purposes

In accordance with the Law on the Regulation of E-Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages, electronic messages for advertising purposes can only be sent to persons for whom prior approval has been obtained. The clear approval of the person to whom the advertisement will be sent is a must. Again, Zayn Giyim Sanayi Ticaret Ltd Şti complies with the details of the “approval” determined in accordance with the same legislation.

Data transactions made due to the legal obligation of the company or explicitly foreseen in the law Personal data can be processed without obtaining additional approval in order to fulfill a legal obligation specified in the relevant legislation or to the processing of the data. The type and scope of data transactions must be necessary for the legally permitted data processing activity and must comply with the relevant legal provisions.

Data Processing of the Company

Personal data can be processed in line with the services and legitimate purposes offered by the company. However, the data cannot be used for illegal services in any way.

Processing of Special Data

According to the Law, data related to the race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures of individuals, as well as biometric and genetic data are special personal data. Zayn Clothing Industry Trade Ltd. Co. also takes sufficient measures determined by the Board in the processing of special personal data.

Zayn Clothing Industry Trade Ltd. Co. may process special data only for the purpose for which it was collected with the consent of individuals in order to provide better services.

Zayn Clothing Industry Trade Ltd. Co. acts in accordance with the Law regarding data processed through automated systems. Information obtained from this data cannot be used against the individual without the explicit consent of the individuals. However, Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi may make decisions regarding the individuals it will process using the data in its own system.

Functional and Analytical Cookies include data about remembering your preferences, using the website effectively, optimizing the site to respond to user requests, and how visitors use the site. Due to their nature, these types of cookies may include personal information such as usernames, etc.

Third Party Cookies

Zayn Giyim Sanayi Ticaret Ltd Şti websites/mobile applications/mobile websites work with third-party reliable, well-known advertising providers. Third-party service providers place their own cookies to offer you personalized ads. Cookies placed by third parties collect, process and analyze how visitors use the websites.

Commercial Cookies

It is used to increase your user experience by offering products/content that are similar to the ones you target in line with your interests and preferences and by offering a more advanced, personalized advertising portfolio. The session, persistent, functional and analytical and commercial cookies mentioned above are kept in the background for approximately 2 (two) months, and the necessary adjustments can be made from the personal internet browser settings. The removal process from these settings may vary depending on the internet browser.

How can I delete cookies?

Many internet browsers are set to automatically accept and use cookies when they are first installed on your computer. You can block cookies or alert your device when cookies are sent by using the help or settings menus of your internet browser. You can use your browser's instructions or help options screen to learn about different ways to manage cookies and to get detailed information about how to adjust the settings of the browser you are using.

IX. Data belonging to our employees

Processing data for business relationships

Personal data of our employees may be processed without obtaining consent to the extent necessary for business relationships and health insurance. However, Zayn Giyim Sanayi Ticaret Ltd Şti ensures the confidentiality and protection of data belonging to its employees.

Processing Due to Legal Obligations

Zayn Giyim Sanayi Ticaret Ltd Şti may process personal data belonging to its employees without obtaining consent if the processing is explicitly stated in the relevant legislation or for the purpose of fulfilling a legal obligation determined by the legislation. This matter is limited to obligations arising from the law.

Processing for the Benefit of Employees

Zayn Giyim Sanayi Ticaret Ltd. Şti may process personal data without obtaining consent for transactions that benefit company employees, such as private health insurance. Zayn Giyim Sanayi Ticaret Ltd. Şti may also process employee data for disputes arising from business relationships.

Processing of Special Data

According to the Law, data related to individuals' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are special personal data. Zayn Giyim Sanati Ticaret Ltd. Şti also takes sufficient measures determined by the Board in addition to the consent of the relevant person in the processing of special personal data. Special personal data may only be processed without the consent of the person and in a limited manner in cases permitted by the Law. Qualified data obtained from our employees so that they can benefit from insurance and health services are used only by being specific to the purpose.

Data Processed by Automatic Systems

Data processed by automatic systems regarding employees can be used in internal promotions and performance evaluations. Our employees have the right to object to the result that is against them and they do this by complying with the internal procedures. Employees' objections are also evaluated within the company.

Telecommunications and Internet

Computers, phones, e-mails and other applications allocated to employees within the company are allocated to the employee only for business purposes. The employee cannot use any of these tools allocated to him/her by the company for his/her private purposes and communication. The company may control and audit all data on these tools. The employee undertakes not to keep any other data or information other than work on the computer, phones or other tools allocated to him/her from the moment he/she starts working.

X. Transfer of personal data domestically and abroad

Personal data may be shared with business and solution partners and affiliates in order to provide the service.

Zayn Giyim Sanayi Ticaret Ltd Şti may transfer personal data to the following persons and institutions for certain purposes;

Zayn Clothing Industry Trade Ltd. Co.

• •

•

• •

In order to ensure that the purposes of establishing the business partnership are fulfilled, Zayn Clothing Industry Trade Ltd. Co.'s business partners are limited to Zayn Clothing Industry Trade Ltd. Co.'s suppliers are limited to Zayn Clothing Industry Trade Ltd. Co.'s suppliers to ensure that the services required for the fulfillment of our Company's commercial activities are provided to our Company, which our Company outsources from suppliers,

In order to ensure that the commercial activities of our Company that require the participation of our Company's affiliates are carried out, Zayn Clothing Industry Trade Ltd. Co.'s solution partners,

its affiliates.

is authorized to transfer personal data domestically and internationally, in accordance with the other conditions in the Law and subject to the person's consent, within the conditions determined by the Board in the law.

Zayn Clothing Industry Trade Ltd. Co.

Zayn Clothing Industry Trade Ltd. Co.,

XI. Rights of the Data Subject

Zayn Giyim Sanayi Ticaret Ltd Şti accepts that the data subject has the right to obtain consent before data processing within the scope of the Law and has the right to determine the fate of his/her data after the data is processed.

Zayn Giyim Sanayi Ticaret Ltd Şti, announced on our website