INFORMATION TEXT

HEY FEYB INFORMATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

As FEYZA BALTACI (“Hey Feyb” and/or “Brand”), acting as the data controller of your personal data, we attach great importance to protecting the confidentiality and ensuring information security of your personal data requested during your shopping or membership transactions by visiting our website https://www.heyfeyb.com/ (“Website”).

Within the framework of Personal Data Protection Law No. 6698 ("KVKK"), we take the necessary technical and administrative measures to ensure the lawful processing and storage of all personal data belonging to all individuals associated with Hey Feyb. In this context, the personal data you share with our brand within the scope of the services offered on the Hey Feyb website is processed by Hey Feyb in accordance with KVKK and other relevant legislation under the circumstances specified below.

Natural persons whose personal data are processed within the scope of KVKK can obtain information about the personal data collected by Hey Feyb in its capacity as data controller, the purposes of processing, the persons to whom it can be transferred, the method of collection and the legal basis, and your rights regarding such personal data by reviewing this information text.

Processing of Personal Data by Hey Feyb
According to the KVKK, any operation performed on personal data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, whether fully or partially by automatic means or non-automatic means provided that it is part of any data recording system, is considered as "processing of personal data".

For what purposes and on what legal basis do we process your personal data processed by Hey Feyb?

i. If you become our customer by becoming a member through our website, your personal data processed by Hey Feyb, the purposes of processing and legal grounds are as follows:
Your identity data (your name, surname, Turkish ID number), your contact data (your phone number, e-mail address, postal address), your transaction security data (your password information, consent records, IP address, device information, internet browser information), your financial data (your credit card information, bank account, billing information):

In case of your explicit consent within the scope of Article 5/1 of the KVKK, the data will be processed for the following data processing purposes:
• To get to know our members and improve our communication,
• Carrying out marketing and sales activities,
• Conducting market research activities for the sales and marketing of the products and services offered by the Brand,
• Traffic measurement, statistical and analytical analysis, profiling/segmentation studies for sales and marketing activities,
• Offering you opportunities for products and services tailored to you through targeting and re-targeting,
• Managing social media accounts and the Website,
• Planning and execution of corporate communication activities,
• Sharing content online or offline.

ii. If you become our customer by becoming a member through our website, your personal data processed by Hey Feyb, the purposes of processing and legal grounds are as follows:

Your identity data (your name, surname), your contact data (your telephone number, e-mail address, postal address), your transaction security data (your password information, consent records, IP address, device information, internet browser information), your financial data (your credit card information, bank account, billing information):

Within the scope of Article 5/2 of the KVKK, your data will be processed for the following data processing purposes without your explicit consent, based on the legal grounds that (i) it is expressly prescribed by law, (ii) it is necessary for the data controller to fulfill its legal obligations, and (iii) data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person:

• Fulfilling the requirements of contracts concluded with customers and members (“Processing personal data of the parties to the contract is necessary, provided that it is directly related to the establishment or execution of a contract, it is mandatory for the data controller to fulfill its legal obligations, and data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person)

• Carrying out the necessary activities to carry out the internal operations of the brand, business activities and to ensure the security of the brand operations, to carry out the effectiveness, efficiency and appropriateness analyses of the business activities (provided that it is necessary for the data controller to fulfill its legal obligations and that data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person).

• Ensuring business continuity and planning and execution of corporate governance and sustainability activities (where data processing is necessary for the data controller to fulfill its legal obligations and where processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject)

• Carrying out activities with legal, technical and administrative consequences and providing information to authorized institutions arising from legislation, activities related to legal requests and carrying out legal affairs (if it is necessary for the data controller to fulfill its legal obligations).

• Planning and execution of corporate communication activities and organizing campaigns, sweepstakes and competitions within this scope, participating in and supporting social responsibility projects (provided that data processing is necessary for the data controller to fulfill its legal obligations and that data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person),
• Keeping the data accurate and up-to-date (mandatory for the data controller to fulfill its legal obligations)
• Planning and execution of customer relations management processes, planning and/or execution of customer satisfaction activities (data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person),
• To provide better and more reliable service to the customer, to develop more suitable services and products and to maintain these without interruption (data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person),
• To accelerate your purchasing transactions, receive and deliver your orders, and manage supply processes and customer relations within this scope (provided that it is directly related to the establishment or execution of a contract, the processing of personal data of the parties to the contract is necessary and the processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person).
• To ensure the fulfillment of obligations within the scope of the Consumer Protection Law, the Distance Contracts Regulation and other legal legislation through our Brand and our branches, call center, affiliated companies on behalf of our Brand or through our websites and social media pages or any other channels including but not limited to these (processing is mandatory by law, it is mandatory for the data controller to fulfill its legal obligations).
• Carrying out activities related to information security processes and information technology infrastructure (processing is mandatory by law, it is mandatory for the data controller to fulfill its legal obligations, data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person)
• To make our website easier to use, to improve it and to carry out development activities such as feedback (if it is necessary for the data controller to fulfill its legal obligations, if data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person)
• Return, request and complaint management (by viewing your shopping details, "Processing is mandatory by law" in accordance with the Consumer Protection Law, it is mandatory for the data controller to fulfill its legal obligation to collect, evaluate and meet the data owner's complaints, questions, requests and suggestions, and data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person)

ii. If you become a customer by making a purchase through our website without membership, your personal data processed by Hey Feyb, the purposes of processing and legal grounds are as follows:

Your identity data (your name, surname), your contact data (your telephone number, e-mail address, postal address), your financial data (your credit card information, bank account, billing information):

Your personal data in question will be processed within the scope of Article 5/2 of the KVKK without your explicit consent, if (i) it is expressly prescribed by law, (ii) it is necessary for the data controller to fulfill its legal obligations, and (iii) it is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person, for the following data processing purposes:

• Execution and follow-up of financial transactions: (in accordance with the Tax Procedure Law and other legislation, the Code of Obligations and the Consumer Protection Law, and the Regulation on Measures to Prevent Laundering of Proceeds of Crime and Financing of Terrorism for the purpose of issuing your invoice, performing identity verification and following up on payment transactions, "Processing is mandatory by law", "Processing personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or execution of a contract", and processing is mandatory for the data controller to fulfill its legal obligations and for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person)
• Return, request and complaint management (Data processing is mandatory in accordance with the Consumer Protection Law, in order for the data controller to fulfill its legal obligation to collect, evaluate and meet the data owner's complaints, questions, requests and suggestions, and in order for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject)
• To ensure that obligations are fulfilled within the scope of the Consumer Protection Law, the Distance Contracts Regulation and other legal legislation through our Brand and on behalf of our Brand, through our branches, call center, affiliated companies or through our websites and social media pages or through all kinds of channels, including but not limited to these.
• Planning and execution of customer relations management processes, planning and/or execution of customer satisfaction activities (data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person),
• To provide better and more reliable service to the customer, to develop more suitable services and products and to maintain these without interruption (data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person),
• To accelerate your purchasing transactions, receive and deliver your orders, and manage supply processes and customer relations within this scope (provided that it is directly related to the establishment or execution of a contract, the processing of personal data of the parties to the contract is necessary and the processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person).
• Carrying out activities with legal, technical and administrative consequences and providing information to authorized institutions arising from legislation, activities related to legal requests and carrying out legal affairs (if it is necessary for the data controller to fulfill its legal obligations).
• Keeping the data accurate and up-to-date (mandatory for the data controller to fulfill its legal obligations)

Collection Method of Your Personal Data Processed by Hey Feyb
Your personal data is stored through various channels such as the information you provide to us through our Website or via e-mail, SMS or other means, technical communication files called "cookies" (small files placed on your hard drive) that enable our computers to automatically recognize you when you visit our website, through our social media accounts, digital platforms, software, mobile communication channels, and various methods, including verbal, written or electronic means.
You can find our detailed explanations and detailed information regarding the collection of your personal data by our Brand in the "Cookie Policy" located at https://www.heyfeyb.com.

Transfer of Your Personal Data
Your personal data is collected through various channels in order to carry out Hey Feyb's activities; and based on the legal grounds of ensuring compliance with the legislation and Hey Feyb's policies. Your collected personal data will be shared with our business partners, suppliers, all representatives, service providers and/or subcontractors and affiliated companies of Hey Feyb, residing in Turkey, in accordance with the basic principles stipulated by the KVKK and within the scope of the data processing purposes listed among the cases in Article 5/1 of the KVKK above and in accordance with Article 8/1 of the KVKK, with your explicit consent, to our business partners, suppliers, all representatives, service providers and/or subcontractors and affiliated companies of Hey Feyb, cargo companies, banks and payment institutions, GSM operators, social media sharing sites, and for the data processing purposes and within the scope of the data processing purposes listed among the cases in Article 5/2 of the KVKK above and in accordance with Article 8/1 of the KVKK. According to 8/2, your personal data can be transferred to our business partners, suppliers, any representative, service provider and/or subcontractor and affiliated companies of Hey Feyb, cargo companies, banks and payment institutions published in the Official Gazette dated January 9, 2008 and numbered 26751, GSM Operators, legally authorized public institutions and organizations and legally authorized private institutions without your explicit consent.

Hey Feyb stores your personal data collected from you on its domestic servers, and your data will only be transferred to Hey Feyb in the event of an adequacy decision pursuant to Article 9 of the KVKK, or if not, within the scope of appropriate safeguards listed in Article 9/4 of the KVKK, to e-mail service providers due to sending e-mails to the e-mail addresses used by Hey Feyb and the e-mail system used being located abroad, to social media platforms in case of access to the social media links on our website, and to intermediary service providers providing cloud-based payment services for the purpose of completing payment services through our website.

Permission
Hey Feyb believes that explicit consent is one of the most important privacy principles. You have the right not to provide us with your personal data or to anonymize your existing personal data through the "Cancel My Membership" mechanism on the Website.

Cookies
Cookies are information signals sent to your browsers through our Website, and are used only when you log in to our Website. Cookies send a unique identifier to your web browsers that is used to better understand how our Website is used, so we can understand which areas of our Website users prefer to use (e.g., based on the number of visitors to those areas). While cookies do not generally contain personal data, they may be associated with information about you that you have disclosed to us.
Only Hey Feyb can use the cookies we place; Hey Feyb cannot access or read other parties' cookies. Hey Feyb may also use cookies in the aggregate to track navigation and traffic trends within the site. This aggregated and anonymous information will allow Hey Feyb to improve the content of our Website and may be shared with partners or other third parties.
If you are a registered user of our Website (a "Member"), Hey Feyb may send you a cookie containing your identifier, which is stored by your browser, when you log in. This type of cookie is used to identify you and allows you to access areas reserved for registered users, such as the ability to view and manage your account.
If you want to place an order without registering or simply browse, you are not required to accept cookies from our Website. However, if you decide to register and access private areas of our Website and have configured your browser not to accept cookies, you should configure your browser to accept the cookies sent by Hey Feyb to ensure that the service is not interrupted.

Pixel Tags
Our Website may use "pixel tags" in conjunction with cookies to measure activity and/or traffic on our Website. A pixel tag is a type of web page graphic, typically invisible because it's 1x1 pixel. These tags track the number of users visiting our Website and track their navigation within it. For example, we may use this tag when we want to statistically count which pages our members have visited while using our Website.

Pixel tag technology is not used to collect any personal data.
We sometimes include pixel tags in HTML email messages that we send (or that are sent on our behalf) to determine which email messages have been opened and whether any action has been taken based on the email messages. You can render some pixel tags unusable by disabling their associated cookie.

IP Addresses
An Internet Protocol (IP) address is a number that your Internet Service Provider (ISP) typically automatically assigns to your device when you connect to the Internet. Like other websites, Hey Feyb collects IP addresses to analyze visitor numbers and site usage in the aggregate. Your IP address is not linked to any personal information you provide. However, Hey Feyb reserves the right to use IP addresses, in accordance with regulatory requirements, to identify individuals who pose a threat to our Website, our services, or our customers, members, or Website visitors.

Clickstream
"Clickstream" or "clickstream data" reflects the web pages a user visits and, more importantly, the traffic pattern or circumstances that lead a user from one web page to another. Hey Feyb tracks such information only within our Website and does not specifically track clickstream activity outside of Hey Feyb web pages.

Clickstream data does not contain or disclose any personal data about the user, nor do we compare this data with personal data you have provided.
You can find detailed explanations and detailed information regarding the method of collecting your personal data by our Brand in the "Cookie Policy" located at https://www.heyfeyb.com/

Your Rights as a Data Owner under KVKK
We hereby inform you that, as a personal data owner, you have the following rights in accordance with Article 11 of the KVKK:
• Learning whether your personal data is being processed,
• Request information regarding your personal data if it has been processed,
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• Knowing the third parties to whom your personal data is transferred, whether domestically or abroad,
• To request correction of your personal data if it is processed incompletely or incorrectly and to request that the action taken in this context be notified to third parties to whom your personal data has been transferred,
• To request the deletion or destruction of personal data in case the reasons requiring processing are eliminated, even though it has been processed in accordance with the KVKK and other relevant legal provisions, and to request that the action taken within this scope be notified to third parties to whom your personal data has been transferred,
• To object if a result against you arises as a result of the analysis of processed data exclusively through automated systems,
• To request compensation for damages in case you suffer damages due to the unlawful processing of your personal data.

To exercise your rights listed above, you can fill out the Hey Feyb Data Owner Application Form, which you can access at https://www.heyfeyb.com/, and submit it to info@heyfeyb.com with the subject line "Personal Data Protection Law Information Request." Depending on the nature of your request, your application will be processed free of charge as soon as possible and within thirty days at the latest. However, if the process requires additional costs, you may be charged a fee according to the tariff determined by the Personal Data Protection Board.