As ORGANUCA GIDA A.Ş. (COMPANY), we would like to inform you about your personal data in accordance with the "Personal Data Protection Law No. 6698" (KVKK), which was drafted and enacted to protect fundamental rights and freedoms, especially the right to privacy.

Your personal data is processed for the period stipulated in the relevant legislation or necessary for the purpose for which it is processed, within the framework of the methods, basis, purposes, and conditions specified below. Our company takes all necessary administrative and technical measures to protect it.

1. Data Controller and Representative:

ORGANUCA GIDA A.Ş. (company name) is the "data controller" for your personal data collected on behalf of our company by our office, affiliated units, subcontractors, suppliers, business partners, and their representatives.

2. Methods of Collecting Personal Data:

Your personal data may be collected automatically or non-automatically, in written, verbal, or electronic formats, through our Company's office, websites, social media accounts, mobile applications, parties from whom our Company receives services that complement or extend our operations, contracted organizations, business partners, suppliers, subcontractors, or overlays, and other similar channels.

3. Legal Grounds for Collecting Personal Data and Purposes of Processing:

ORGANUCA may collect personal data in categories such as identity information, contact information, customer information, customer transaction information, transaction security information, legal transaction and compliance information from parties such as its customers, employees, potential customers, job candidates, business partners, and suppliers.

Customer personal data is processed in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law. These include: carrying out the necessary work by the business units and executing the relevant business processes to enable the relevant individuals to benefit from the products and services offered by ORGANUCA; carrying out the necessary work by the business units and executing the relevant business processes to carry out the commercial activities carried out by our Company; planning and executing our Company's commercial and/or business strategies; ensuring the legal, technical, and commercial-occupational security of the relevant individuals with whom we have a business relationship; and planning and executing the activities necessary to recommend and promote the products and services we offer to the relevant individuals by customizing them according to their tastes, usage habits, and needs.

In this context, customer personal data: This information may be processed, subject to the Customer's consent, and shared with the parties specified in this Disclosure Statement, for the purposes of creating customer-oriented campaigns, conducting cross-selling, identifying target audiences, tracking customer activity and carrying out activities to enhance the user experience, improving the operation of the company's website and mobile application and personalizing it according to customer needs, conducting direct and indirect marketing, personalized marketing and remarketing activities, conducting personalized segmentation, targeting, analysis, and internal reporting activities, planning and executing market research, customer satisfaction activities, and planning and executing customer relationship management processes. This information may be processed and shared with the parties specified in this Disclosure Statement within the scope of planning and executing the sales and marketing processes of the company's products and/or services, and planning and executing processes to establish and/or increase loyalty to the products and/or services we offer.

4. Purposes for Processing Personal Data

• To fulfill our legal obligations arising from legislation,

• To provide you with company products and services, to fulfill our obligations to you, to prepare records and documents, to comply with information storage, reporting, information, tax, and other obligations stipulated by local and international legislation,

• To fulfill, execute, perform, prove, and improve transactions related to our obligations, to report to customers, and to fulfill the requirements of contracts you have entered into and/or we have entered into; Statistics and customer satisfaction studies

• Sending advertising and promotional emails and SMS messages to parties whose prior explicit consent has been obtained pursuant to Law No. 5653 on the Regulation of Electronic Commerce and whose contact information is shared due to their commercial activities within our organization.

• Planning, auditing, and executing information security processes

• Establishing and managing the information technology infrastructure

• Planning and executing fringe benefits and benefits for employees

• Planning and executing corporate communications for employees and/or corporate social responsibility and/or non-governmental organization activities in which employees participate

• Planning and executing employee-focused activitiesPlanning and execution of access rights to information

• Monitoring and/or auditing employee work activities

• Monitoring finance and/or accounting activities

• Planning human resources processes

• Planning and/or execution of activities to analyze the effectiveness/efficiency and/or appropriateness of business activities

• Planning and execution of business activities

• Planning and execution of information access rights for business partners and/or suppliers

• Managing relationships with business partners and/or suppliers

• Planning and/or execution of occupational health and/or safety processes

• Planning and/or execution of business continuity activities

• Planning and execution of corporate communication, logistics, and administrative activities

• Planning and execution of customer relationship management processes

• Planning and/or execution of customer satisfaction activities

• Monitoring customer requests and/or complaints

• Fulfilling the obligations arising from recruitment, employment contracts, and/or legislation for company employees

• Planning and execution of company audit activities Execution

• Planning and executing internal and external training and orientation activities

• Planning and executing operational activities necessary to ensure that company activities are carried out in accordance with company procedures and/or relevant legislation

• Ensuring the security of company operations

• Ensuring the security of company premises and/or facilities

• Planning and/or executing processes to establish and/or increase loyalty to the company's products and/or services

• Planning and/or executing the company's production and/or operational risk processes

• Carrying out corporate and partnership law transactions

• Monitoring contract processes and/or legal claims

• Executing strategic planning activities

• Planning and executing supply chain management processes

• Compensation management

• Planning and executing production and/or operational processes

• Planning and executing market research activities for the sales and marketing of products and services

• Planning and executing sales and marketing of products and/or services

• Ensuring that data is accurate and up-to-date Ensuring

• Providing information to authorized institutions as required by law

• Your personal data is processed for the purpose of creating and monitoring visitor records.

5. Provisions that do not require explicit consent

According to the Personal Data Protection Law, processing of general personal data is possible without your explicit consent if one of the following conditions listed in the Law is met:

a) It is expressly provided for by the law,

b) It is necessary for the protection of the life or physical integrity of the person who is unable to give consent due to a practical impossibility, or whose consent is not legally valid, or of another person.

c) The processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract.

d) It is necessary for our Company, as the data controller, to fulfill its legal obligations.

e) It is made public by the data subject.

f) Data processing is necessary for the establishment, exercise, or protection of a right.

g) Data processing is necessary for the legitimate interests of our Company, provided that it does not prejudice the fundamental rights and freedoms of the data subject.

6. Persons/Organizations to Which Personal Data May Be Transferred:

• To the COMPANY's business partners, shareholders, and affiliates,

• To persons or organizations permitted by the Tax Procedure Law, the Social Security Institution legislation, the Court of Accounts, the Turkish Commercial Code, the Code of Obligations, and other legislative provisions,

• To legally authorized public institutions and organizations, administrative authorities, and legal authorities,

• To natural or legal persons from whom we receive services and collaborate for product/service comparison, analysis, evaluation, advertising, and the aforementioned purposes, to institutions with which we have agreements for sending messages to our customers, and to logistics companies that deliver orders to you, in accordance with the personal data processing conditions and purposes specified in Articles 8 and 9 of Law No. 6698.

7. Rights of Personal Data Owners:

Pursuant to Article 11 of the Personal Data Protection Law, you have the following rights regarding your personal data:

• To learn whether personal data has been processed,

• To request information if personal data has been processed,

• To learn the purpose of processing personal data and whether it is being used in accordance with its intended purpose,

• To know the third parties to whom personal data has been transferred, both domestically and internationally,

• To request correction of personal data if it has been processed incompletely or incorrectly, and to request notification of the actions taken to third parties to whom personal data has been transferred,

• To request the deletion or destruction of personal data within the framework of the conditions stipulated in the Personal Data Protection Law, and to request notification of the actions taken to third parties to whom personal data has been transferred.Requesting resurrection,

• Objecting to the analysis of processed data exclusively through automated systems that results in a result detrimental to the individual,

• Requesting compensation for damages incurred due to unlawful processing of personal data