KVKK PRIVACY NOTICE

PRIVACY NOTICE UNDER PERSONAL DATA PROTECTION LAW NO. 6698 (“KVKK”)

This Privacy Notice outlines how our Company processes personal data obtained from our Customers to whom we provide services and products, in accordance with Personal Data Protection Law No. 6698 (KVKK) and other relevant legislation. Processing is defined in Article 3 of KVKK as operations such as recording, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying personal data.

A. COLLECTED PERSONAL DATA AND COLLECTION METHOD

The following personal data, including but not limited to: name, surname, copies of ID card or driver’s license or passport, place and date of birth, address, phone number, email address, bank and credit card account information, photographs, security camera recordings (CCTV), call center voice recordings, and any data falling under the definition of personal data, are processed by La Baia (Burcu Bostancı Sole Proprietorship) under the following conditions and scope, for the purposes of providing services, ensuring service continuity, and monitoring service quality through our communications, establishing and executing contracts with natural persons who are party to the contract or benefiting from our services.

B. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data will be processed by La Baia (Burcu Bostancı Sole Proprietorship) for the following purposes within the scope of personal data processing conditions and purposes specified in Articles 5 and 6 of KVKK:

1. Use of products or services, planning and execution of sales processes, planning and execution of operational processes, planning or execution of after-sales support service activities, ensuring continuity in the provision of services such as infrastructure or device maintenance, repair, installation, on-site service, creation and monitoring of visitor records,

2. Execution of transactions and operations related to services provided to you, proper fulfillment of contractual obligations, monitoring of matters such as service quality,

3. Maintaining financial and accounting records,

4. If you have accepted the Authorized User Database Registration and Electronic Commercial Communication Permission Text, for campaign, promotion, and similar marketing activities of La Baia (Burcu Bostancı Sole Proprietorship) and Business Partners,

5. Within the scope of regular information obligations to the Information Technologies Communication Authority under relevant legislation,

6. Fulfillment of obligations before any legal authority to protect La Baia (Burcu Bostancı Sole Proprietorship)‘s legal rights and notification requirements to relevant Public Institutions and Organizations, Notary, Courts and Prosecutors,

7. Informing relevant parties for security and identity verification purposes for establishing transactions, installation, maintenance, and similar operations with business partners and other infrastructure providers,

8. Written and verbal communication for making payments,

9. Providing information when requested by judicial and administrative authorities,

10. Fulfillment of all other legal obligations.

C. TO WHOM AND FOR WHAT PURPOSES PERSONAL DATA MAY BE TRANSFERRED

Your personal data may be transferred within the framework of personal data processing conditions and purposes specified in Articles 8 and 9 of KVKK, for La Baia (Burcu Bostancı Sole Proprietorship)‘s commercial sustainability and to achieve the purposes mentioned above:

1. To our group companies and affiliates, shareholders and board members, company officials,

2. To our company’s independent auditors, financial advisors, suppliers, consultants, lawyers, banks we work with, and authorized employees of these mentioned parties,

3. To judicial and administrative authorities, legally authorized public and private institutions and organizations,

4. To domestic and international Business Partners, and if consent has been given to the authorized database text, to campaign, event, and organization officials.

D. KEEPING PERSONAL DATA ACCURATE AND UP TO DATE

Pursuant to Article 4 of KVKK; in accordance with Data Controllers’ obligation to keep personal data accurate and up to date, the Data Subject guarantees that the personal data shared with our Company is accurate and commits to updating it when changes occur, and acknowledges that they will not claim any rights due to not notifying our Company of current personal data. The Data Subject declares acceptance of being contacted by our Company at certain intervals to ensure data accuracy and currency when necessary.

E. STORAGE PERIOD AND DISPOSAL

Personal data processed under this agreement is stored for 10 years following the termination of the agreement as required by relevant legislation and is disposed of within 180 days after the completion of 10 years if neither party files a lawsuit within this 10-year period.

F. RIGHTS OF THE PERSONAL DATA SUBJECT UNDER KVKK NO. 6698

Under Article 11 of KVKK No. 6698, everyone has the right to apply to La Baia (Burcu Bostancı Sole Proprietorship) as data controller regarding the following matters:

1. Learning whether personal data is being processed,

2. Requesting information if personal data has been processed,

3. Learning the purpose of processing personal data and whether they are used in accordance with their purpose,

4. Knowing the third parties to whom personal data is transferred domestically or abroad,

5. Requesting correction if personal data is processed incompletely or incorrectly,

6. Requesting deletion or destruction of personal data within the framework of conditions stipulated in accordance with Article 7 of KVKK No. 6698 and relevant other law provisions, even though it has been processed in compliance with the law, if the reasons requiring its processing no longer exist,

7. 7. Requesting notification of transactions carried out pursuant to paragraphs 5 and 6 to third parties to whom personal data has been transferred,

8. Objecting to the emergence of a result against the person by analyzing the processed data exclusively through automated systems,

9. Requesting compensation for damages in case of loss due to unlawful processing of personal data.

G. RIGHTS OF THE DATA SUBJECT AND METHOD OF EXERCISING RIGHTS

The “Data Subject” can communicate their rights and requests under Article 11 of the Personal Data Protection Law by completing the La Baia (Burcu Bostancı Şahıs Şirketi) at www.labaiaatelier.com in accordance with the specified procedure.