INFORMATION TEXT ON THE PROTECTION OF PERSONAL DATA

As GÖKÇELİK E-TİCARET ANONİM ŞİRKETİ ("RAFİSTE" or "Company"); the confidentiality and security of your personal data are among our top priorities. In this context, in order to fulfill our disclosure obligation arising from Article 10 of the Personal Data Protection Law No. 6698 ("KVKK"), we would like to inform you about your personal data processed through the www.rafiste.com website and/or mobile application (together, "RAFİSTE"). Personal data means any information that determines or makes your identity identifiable. Your personal data processed by RAFİSTE, the purposes of processing, recipient groups to which it can be transferred, collection methods, legal reasons and your rights regarding such personal data are listed below.

1- Which of your personal data is processed by RAFİSTE?

Persons who accept the membership conditions on RAFİSTE and log in from the website or the application installed on mobile devices and follow and/or purchase the products on the website are defined as "Members". If you become a member of the RAFİSTE website, your personal data below may be processed.

• Your Identity Information: your name, surname, TR ID Number ( processed in accordance with the relevant legislation only if you purchase certain product groups ), gender, date of birth information if shared by you personally,
• Your Contact Information : your phone number, delivery address, e-mail address,
• Your Customer Transaction Information: Your order and invoice information, delivery transaction information, transaction history information regarding your purchases, request and complaint information, information you personally share in your comments and questions if you comment and/or ask questions regarding the products on the website.
• Your Transaction Security Information: IP address information, password and passcode information, cookie information
• Your Marketing Information: shopping history information, campaign information used, profiling and segmentation information, cookie records
• Your Legal Transaction Information: information in correspondence with authorized persons, institutions and organizations, information in lawsuit and enforcement files, information on legal information requests,
• Your Auditory Recording Information: Your voice recording in case you contact the call center.

2- What are the purposes of processing your personal data and the collection methods?

Your identity, contact and customer transaction information are collected and processed automatically electronically from you, via mobile application or website within the scope of our contractual relationship for the following purposes.

• Carrying out the processes for the establishment and execution of the contract,
• Execution and auditing of finance and accounting processes,
• Execution and supervision of the company's business activities,
• Carrying out billing processes,
• Carrying out logistics and cargo activities and monitoring delivery processes,
• Carrying out purchase transactions via the website/mobile applications and confirming the identity information of the person making the transaction,
• If you give your explicit consent, it can be used in various marketing and advertising activities, to provide you with a better shopping experience and to carry out activities to increase your satisfaction, especially by offering you products that suit your preferences.
• To increase customer satisfaction, to be able to recognize our customers who shop on the website and to use them in customer circle analysis, to carry out activities to develop and improve the products and services offered by our Company,
• Conducting strategic analysis studies,
• Carrying out communication activities,
• Presenting products that may interest you, taking into account your interests,
• To communicate and provide necessary information regarding the conditions, current status and updates of the contracts concluded through the website under the relevant articles of the distance sales contract and the Law on Consumer Protection,
• In case of your explicit consent, we will inform you about developments, opportunities and innovations at RAFİSTE.
• Carrying out activities to identify our customers who shop from the website and/or mobile applications and to use them in customer circle analysis.
• Evaluating your requests, complaints and suggestions regarding our products and services,
• Ensuring that you receive information about the products,
• Carrying out after-sales support services for goods and services,
• Carrying out information security processes,
• Ensuring the security of operations regarding the RAFİSTE website,
• Ensuring that activities are carried out in accordance with legislation,
• Monitoring and execution of legal affairs,
• Providing information to authorized persons, public institutions and organizations.

Your transaction security information is collected and processed automatically electronically from you, via mobile application or website within the scope of our contractual relationship for the following purposes.

• Carrying out the processes for the establishment and execution of the contract,
• Execution and supervision of the company's business activities,
• Making purchases through the website/mobile applications and confirming the identity information of the person making the transaction,
• If you give your explicit consent, it can be used in various marketing and advertising activities, to provide you with a better shopping experience and to carry out activities to increase your satisfaction, especially by offering you products that suit your preferences.
• To increase customer satisfaction, to be able to recognize our customers who shop on the website and to use them in customer circle analysis, to carry out activities to develop and improve the products and services offered by our Company,
• Carrying out information security processes,
• Ensuring the security of operations regarding the RAFİSTE website,
• Ensuring that activities are carried out in accordance with legislation,
• Providing information to authorized persons, institutions and organizations.

Your legal transaction information is collected and processed automatically electronically from you, the mobile application, and the website within the scope of our contractual relationship for the following purposes.

• Carrying out the processes for the establishment and execution of the contract,
• Execution and supervision of the company's business activities,
• Evaluating your requests, complaints and suggestions regarding our products and services,
• Carrying out information security processes,
• Ensuring the security of operations regarding the RAFİSTE website,
• Ensuring that activities are carried out in accordance with legislation,
• Monitoring and execution of legal affairs,
• Providing information to authorized persons, institutions and organizations.

Your audio recording information is collected and processed for the following purposes if you contact the call center.

• Carrying out the processes for the establishment and execution of the contract,
• Carrying out communication activities,
• Carrying out activities aimed at providing you with a better shopping experience and increasing your satisfaction, especially by running campaigns and offering you products that suit your preferences,
• Carrying out activities aimed at developing and improving the products and services offered by our company,
• Presenting products that may interest you, taking into account your interests,
• To communicate and provide necessary information regarding the conditions, current status and updates of the contracts concluded through the website under the relevant articles of the distance sales contract and the Law on Consumer Protection,
• In case of your explicit consent, we will inform you about developments, opportunities and innovations at RAFİSTE.
• Carrying out activities to identify our customers who shop from the website and/or mobile applications and to use them in customer circle analysis.
• Evaluating your requests, complaints and suggestions regarding our products and services,
• Ensuring the security of operations regarding the RAFİSTE website,
• Ensuring that activities are carried out in accordance with legislation,
• Monitoring and execution of legal affairs,
• Providing information to authorized persons, institutions and organizations.

3- What is the legal reason for processing your personal data?

RAFİSTE processes your personal data under the heading "Which personal data of yours is processed by RAFİSTE?" for the purposes stated above and based on the legal reasons stated in Articles 5, 8 and 9 of the KVKK and listed below.

• Based on the legal reason that it is clearly foreseen in the legislation to which our Company is subject, primarily the Law on Regulation of Electronic Commerce No. 6563, the Turkish Commercial Code No. 6102, the Turkish Penal Code No. 5237 and the Law on Consumer Protection No. 6502; ensuring the security of the operations on the company's website, carrying out information security processes, fulfilling our obligations arising from the legislation, especially the activities aimed at ensuring that the activities are carried out in accordance with the legislation,
• Based on the legal reason that processing your personal data is necessary, provided that it is directly related to the establishment or execution of the contract; carrying out the activities of establishing contracts concluded through the website under the relevant articles of the Consumer Protection Law, such as distance selling contracts, carrying out activities for the realization of your purchase transactions, carrying out and auditing the company's business activities, monitoring delivery processes, evaluating your requests, complaints and suggestions regarding our products and services, carrying out and auditing finance and accounting processes, carrying out communication activities,
• Based on the legal reason that it is mandatory for our Company to fulfill its legal obligations; fulfilling the legal obligations specified in the secondary legislation to which our Company is subject, especially the Regulation on Distance Contracts and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce, and/or in the decisions, guides and guides published by the authorized authorities, providing information to authorized persons, institutions and organizations, ensuring that the activities are carried out in accordance with the legislation, following up and carrying out legal affairs, carrying out financial and accounting affairs,
• Based on the legal reason that data processing is mandatory for the establishment, exercise or protection of a right; conducting legal and litigation affairs,
• Based on the legal reason that data processing is mandatory for the legitimate interests of our company, provided that it does not harm fundamental rights and freedoms; to carry out activities aimed at developing and improving the products and services offered by our company,
• Transfer of personal data abroad based on the legal ground of having your explicit consent .

4- To whom and for what reasons does RAFİSTE transfer your personal data?

Our company takes care to process your personal data in accordance with the "need to know" and "need to use" principles, by ensuring the necessary data minimization and by taking the necessary technical and administrative security measures. Since the execution or control of business activities, ensuring business continuity, and operating digital infrastructures necessitate continuous data flow with different stakeholders, we are required to transfer the personal data we process to third parties for certain purposes. In addition, it is very important for your personal data to be accurate and up-to-date in order to fully and properly fulfill our contractual and legal obligations. For this purpose, we have to work with various business partners and service providers.

Your personal data may be used for the purposes of carrying out the delivery processes of the products you order, managing your requests for assistance and support regarding your processes, carrying out activities aimed at increasing your experience and satisfaction, carrying out activities aimed at developing and improving the products and services offered by our company, providing you with a better shopping experience and carrying out activities aimed at increasing your satisfaction, ensuring business continuity, ensuring information security, fulfilling legal obligations, and limited to the purposes specified in the second article of this information text, to the extent necessary:

Based on the legal reasons that it is clearly stipulated in the legislation to which our company is subject and that it is mandatory for the fulfilment of its legal obligations and that it is necessary for the establishment or execution of the contract;

• In order to carry out logistics activities and follow up on delivery processes, you and/or the person to whom the product will be delivered will be sent to cargo companies and private couriers,
• With our service providers, banks, and financial advisors to carry out billing processes,
• Business partners and other service providers that provide call center services for the sale of goods and services and the provision of after-sales support services,
• With business partners and service providers that provide services in the field of quality control, complaint management and risk analysis of services,
• With our relevant business partners, consultants and service providers, banks, financial advisors for the management of financial and accounting processes, identification and evaluation of risks, and prevention of fraud,
• With an e-invoice business partner to send the e-invoice to the customer electronically; with cargo and courier companies to make physical contract or invoice delivery, and with our business partners that provide independent auditing, customs, financial advisor/accounting services,
• With tax offices to fulfill tax obligations, and with the authorities of the Ministry of Treasury and Finance of the Republic of Turkey for invoices and collection receipts during tax audits,
• With our business partners and service providers who provide, operate or provide services for our IT infrastructure,
• With our business partners who provide services in the field of risk management and financial reporting processes,

Based on the legal grounds that data processing is mandatory for the establishment, exercise or protection of a right, that it is expressly provided for in the legislation to which our company is subject, and that it is mandatory for the fulfilment of its legal obligation;

• With lawyers, auditors, computer forensics experts, cyber security consultants, tax consultants and other third parties and business partners from whom we receive consultancy and services within the scope of fulfilling legal obligations,
• Authorized public institutions and organizations such as regulatory and supervisory bodies, courts and enforcement offices,
• Your personal data may be shared with other public institutions or organizations authorized to request it, our domestic and/or foreign subsidiaries, suppliers, business partners, banks with which we have agreements, and third parties from whom we receive products or services.

HOW DOES RAFİSTE PROTECT YOUR PERSONAL DATA?

Personal data shared with RAFİSTE is under the supervision and control of RAFİSTE. RAFİSTE has assumed responsibility as the data controller to establish the necessary organization and to take and adapt technical measures in order to protect the confidentiality and integrity of information in accordance with the relevant legislation in force. Being aware of our obligation in this regard;

• Penetration tests are conducted at periodic intervals in accordance with international and national technical standards regarding data confidentiality.
• The personal data you transmit to RAFİSTE via the website, mobile site and mobile application is protected using SSL (Secure Sockets Layer) technology.
• Risk analyses regarding personal data processing activities are regularly conducted and actions are taken to reduce risks.
• Access and authorization controls are implemented to prevent unauthorized access to personal data.
• In this context, we would like to inform you that we always update our data processing policies.

YOUR RIGHTS REGARDING THE PROTECTION OF YOUR PERSONAL DATA

By applying to our Company using the methods in the "Communication for Your Rights and Requests" section of this Information Text,

• To learn whether your personal data is being processed,
• Requesting information about your data if it has been processed,
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• Knowing the third parties to whom the data is transferred, either domestically or abroad,
• To request correction of personal data if it is processed incompletely or incorrectly,
• Request the deletion or destruction of your personal data within the framework of the conditions set forth in the KVKK,
• Request that the actions taken in accordance with your rights of correction, deletion and destruction specified above be notified to third parties to whom personal data has been transferred,
• To object to a result that is to your detriment as a result of your processed personal data being analyzed exclusively by automated systems,
• If you suffer damages due to your personal data being processed in violation of the relevant legislation, you have the right to demand compensation for your damages.

CONTACT FOR YOUR RIGHTS AND REQUESTS

You can submit your questions and requests regarding your personal data to the Data Controller by submitting a petition prepared in accordance with the conditions specified in the Communiqué on Application Procedures and Principles or by using the "GÖKÇELİK E-TİCARET ANONİM ŞİRKETİ Application Form" using the following methods. You can access the application form here .

Belonging to our company  You can access detailed information about your personal data processed through the www.rafiste.com website and/or mobile application at https://www.rafiste.com/kisisel-verilerin-korunmasi .

*Relevant Persons who will apply by "Personal Written Application" are required to submit documents proving their identity. In this context, in your personal written applications to Minareliçavuşosb Mah. Nilüfer Bul. No: 12 Nilüfer/Bursa, we kindly request that you submit only the front side of the ID photocopy (without showing blood type and religion section) along with the application form.

**We kindly request that " Personal Data Protection Law Related Person Request " be written in the notification envelope of the application form or in the subject section of the e-mail.

As personal data owners, if you submit your requests regarding your rights to RAFİSTE, RAFİSTE will finalize your request free of charge within 30 (thirty) days at the latest. However, if the response to your application requires a cost in accordance with the legislation, RAFİSTE may charge a fee in the tariff determined by the Personal Data Protection Board.

ABOUT THE INFORMATION TEXT

RAFİSTE reserves the right to update this Information Text on the Protection of Personal Data at any time, within the framework of changes that may be made in the current legislation.

Updated Date: 17.04.2023