CUSTOMER PRIVACY NOTICE

This Privacy Notice has been prepared by Alpaya Doğal ve Kozmetik Ürünleri Sanayi ve Ticaret Anonim Şirketi (“Company”) for its customers in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in the Fulfillment of the Obligation to Inform, in its capacity as the data controller.
Through this Privacy Notice, the Company aims to properly manage the compliance process with all legal regulations regarding personal data, primarily the KVKK, with respect to all customers in relation to the services and sales we provide.
With the awareness of this responsibility, as the data controller within the scope of the Law on the Protection of Personal Data No. 6698 (“Law”) and the relevant legislation, we process your personal data in accordance with the law based on the legal grounds and purposes explained below.
The Company reserves the right to update this Privacy Notice within the framework of possible amendments in the applicable legislation. You may follow such updates by periodically visiting our website.

1. PURPOSE AND SCOPE OF THE PRIVACY NOTICE
Through this notice, we aim to inform personal data owners about:
• the purposes for which personal data collected in accordance with the Law No. 6698 are processed,
• the protection, storage, use, transfer, deletion and anonymization of such data in compliance with the Law,
• and the rights of the personal data owners regarding these matters.
Accordingly, detailed information will be provided below regarding:
• the purposes for which the Company processes personal data,
• to whom and for what purposes such data may be transferred,
• the methods and legal grounds for collecting personal data, and
• the rights of the data subject.

2. INFORMATION REGARDING YOUR PERSONAL DATA
2.1 Identity of the Data Controller
The Company acts in compliance with all obligations required by the relevant legislation, primarily the KVKK, in all personal data processing activities it conducts and takes the necessary security measures to ensure that your personal data are stored securely and protected against unlawful use.
Within the scope of the purchasing process, we process your personal data listed below for the purposes explained.

Personal Data Categories
Identity Data
This data includes your name and surname.
Processing Purposes:
• Managing the order placement process
• Managing the delivery of orders
• Completing membership registration to enable you to benefit from our services
• Fulfilling obligations arising from distance sales agreements
• Communicating with customers and managing customer relations
• Conducting customer surveys and customer satisfaction evaluations
• Conducting audits, data analysis, statistical studies and research
• Informing users about updates related to the website or mobile applications
• Conducting marketing analysis studies
• Carrying out advertising and marketing/communication activities
• Recording loyalty card membership and enabling customers to benefit from advantages
• Carrying out financial and accounting processes related to payments
• Ensuring the legal, technical and commercial security of the Company and related persons
• Fulfilling obligations arising from contracts executed under relevant legislation
• Fulfilling legal obligations and exercising our rights arising from applicable legislation
• Recording and verifying identity, address and contact information for purchases made via website or mobile applications
• Ensuring transaction and information security and preventing fraudulent or unlawful activities
• Providing information to public authorities upon request when required by legislation
• Following up and resolving customer requests and complaints
• Planning and executing the Company’s commercial strategies
• Improving shopping experience and service quality
• Using data as evidence in potential legal disputes
• Conducting and auditing business activities
Legal Grounds for Processing:
• Explicitly provided for by laws
• Necessity for the performance of a contract
• Necessity for the fulfillment of legal obligations of the data controller
• Necessity for the establishment, exercise or protection of a right
• Necessity for legitimate interests of the data controller without harming the fundamental rights and freedoms of the data subject

Contact Data
This data includes:
• phone number
• e-mail address
• residential address
It is processed for purposes such as communication with customers, order and delivery processes, legal obligations, marketing analysis, customer satisfaction processes, service improvement and other operational activities of the Company.
The legal grounds for processing are the same as those specified above in accordance with Article 5 of the KVKK.

Financial Data
This data includes information related to payments and payment methods.
Processing Purposes:
• Managing order and payment processes
• Carrying out financial and accounting operations
• Fulfilling obligations arising from distance sales agreements
• Ensuring transaction security
• Preventing fraudulent or unlawful activities
• Providing information to public authorities when required by legislation
• Using data as evidence in potential legal disputes

Customer Transaction Data
This data includes:
• call center records
• invoices
• payment documents
• order information
• complaint and request management records
It is processed to manage orders, payments, contractual obligations, customer relations, legal obligations and transaction security processes.

Marketing Data
This data includes:
• shopping history
• cookies
• survey responses
• campaign participation data
Processing Purposes:
• Improving website functionality and performance
• Conducting marketing analysis
• Personalizing services offered through the website
• Ensuring legal and commercial security of the website
• Analyzing website usage habits and visitor behaviors

Legal Grounds:
• Legitimate interest
• Legal obligations
• Explicit consent where required

Transaction Security Data
This includes:
• IP address
• login and logout records
• password and authentication information
Processing Purposes:
• Ensuring information security
• Preventing fraudulent or unlawful activities
• Providing information to public authorities when required
• Improving user experience

Physical Security Data
This refers to camera recordings obtained from customers in physical locations such as company headquarters or stores.
Processing Purposes:
• Ensuring physical security of company premises
• Using records as evidence in disputes
• Providing information to authorities when required by law
Legal Grounds:
• Legal obligations
• Legitimate interests of the data controller

You are responsible for ensuring that all information, materials, or data you provide to us are accurate, complete, correct and not misleading.

2.3 Methods of Collecting Personal Data
Your personal data are collected through the following channels:
• Our websites
• Our mobile applications
• Our mobile websites
• Our physical stores
• Our call centers
• Field personnel
• Loyalty card programs
• Security systems and cameras used for store security and operational control

2.4 Transfer of Personal Data
Your personal data may be transferred abroad only within the scope of customer support services provided through platforms such as WhatsApp, whose servers may be located abroad, and only if customers explicitly consent and only regarding request and complaint data.
Your personal data may also be transferred to:
• business partners
• suppliers
• courier and logistics companies
• banks for virtual POS payments
• GSM operators
• legally authorized public institutions and organizations
Such transfers are carried out in accordance with Articles 5, 8 and 9 of the Law No. 6698.

3. Protection of Personal Data
The Company maintains appropriate physical, technical and administrative security measures in its workplaces and information systems in order to prevent loss, misuse, unauthorized access, disclosure or alteration of personal data.
We protect our website and other systems by implementing the necessary technical and organizational measures against loss, destruction or unauthorized access to personal data.
If links to other applications are provided through our website, the Company does not assume any responsibility for the privacy policies or content of those external applications.

4. Retention, Deletion and Anonymization of Personal Data
Your personal data are retained for the following periods:
• Identity, contact, financial and customer transaction data: 10 years
• Marketing data: 2 years
• Camera recordings for physical security: 3 months
You may access detailed information regarding the retention, deletion and anonymization processes through the Alpaya Data Retention and Destruction Policy available at:
https://www.biobalance.com.tr

5. Your Rights
Pursuant to Article 11 of the KVKK, you have the right to apply to our Company and request:
• to learn whether your personal data are processed
• to request information regarding processed personal data
• to withdraw previously given consent for the use of personal data
• to learn the purpose of processing personal data and whether they are used in accordance with that purpose
• to know the third parties to whom personal data are transferred
• to request correction of incomplete or inaccurate personal data
• to request deletion or destruction of personal data where appropriate
• to request notification of such corrections or deletions to third parties to whom personal data were transferred
• to object to automated decision-making resulting in a negative consequence
• to request compensation if you suffer damage due to unlawful processing of personal data
You may submit your requests regarding these rights:
• through our website https://www.biobalance.com.tr
• through the Alpaya mobile application
• or by using the methods listed below.

Application Methods
You may submit your request:
(i) By sending a signed written application by hand or through a notary to the following address:
AKÇABURGAZ MAHALLESİ 1573 SOKAK NO:1/27 Esenyurt / İstanbul / Türkiye
(ii) By sending an e-mail from the address previously registered in our system or via secure electronic signature or mobile signature.
E-mail: [email protected]
Please verify the current application methods and required content conditions in the relevant legislation before submitting your request.
Applications that do not comply with the conditions determined by the Personal Data Protection Authority will not be accepted.
The Company will respond to your request as soon as possible and within thirty (30) days at the latest, free of charge. If the fulfillment of the request requires additional costs, only the fees determined by the Personal Data Protection Board may be charged.