Privacy Notice Under Turkish Law No. 6698 on the Protection of Personal Data

As EBA Garaj Anonim Şirketi ("EBA" or the "Company"), the privacy and security of your personal data is one of our top priorities. In this context, in order to fulfil the disclosure obligation arising from Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK" or the "Law"), we would like to inform you about your personal data. Below you will find the personal data processed by EBA, the purposes of processing, the categories of recipients your data may be transferred to, the collection method, the legal basis, and your rights regarding your personal data.

The Company's registered address is Yenişehir Mah. Ulubatlı Sk. Teknopark Blok No: 3, Yahşihan / Kırıkkale, Türkiye, Tax No: 3231127099. Under the KVKK, the Company acts as the "Data Controller".

For What Purposes Do We Collect Your Personal Data?

Your collected personal data may be processed by the Company, in accordance with the fundamental principles set out in the Law and within the personal data processing conditions and purposes listed in Articles 5 and 6 of the Law, for the purposes set out below:

• To promote the goods and services offered by our Company, to get to know members and increase communication, to enhance our image, to develop our products, services and communications, to prepare and send members special promotions/campaigns and announcements, to notify changes to product/service usage and/or payment terms, to conduct customer surveys, customer satisfaction practices and notifications, and to use the data for audit, data analysis, research, statistical study, understanding trends, marketing and advertising services,
• To carry out the necessary work by our relevant business units for the Company's commercial activities and to execute the related business processes,
• To plan and execute the Company's commercial and/or business strategies,
• To ensure the legal, technical and commercial-business security of the Company and of the individuals it has a business relationship with,
• To fulfil obligations undertaken under agreements executed pursuant to applicable legislation, to fulfil legal obligations, and to exercise rights arising from applicable legislation,
• To provide information to public officials upon request and as required by legislation on matters relating to public security,
• To use as evidence in any disputes that may arise.

What Personal Data Does the Company Process?

• Contact Data: your email address.

What Personal Data Do We Collect and How?

Your personal data is collected via the member registration form, online registration/application forms, or through the Company's official email address info@kidolog.com or any other Company email address, whenever you send personal data through those channels. In this context, the Company may request documents such as a copy of your ID, proof of address (residence certificate, electricity bill, etc.), bank account/IBAN details, and social media account/website links during the registration process.

Personal data is also collected through physically submitted documents, physically completed forms provided by the Company, and calls made to the number 08508401139 or other Company extension lines.

Your personal data is additionally collected through automated means, via cookies used on our Kidolog brand website at https://kidolog.com and its subpages. These cookies are only the cookies necessary for visitors to use the site at full efficiency, used to remember visitor preferences, and do not collect any other personal data.

Legal Basis for Processing Personal Data

The KVKK lists the conditions for processing personal data in the second paragraph of Article 5. If the purposes for which a data controller processes personal data can be assessed within the personal data processing conditions listed in the KVKK, that data controller may lawfully process personal data. Accordingly, the Company carries out personal data processing activities only where its processing purposes can be assessed within the processing conditions set out in the KVKK. The Company does not engage in any personal data processing activity that falls outside the scope of these processing conditions.

The personal data processing conditions set out in the KVKK are as follows:

• Explicit consent of the data subject,
• Explicit provision in the laws,
• Necessity for the protection of the life or physical integrity of the data subject or of another person, where the data subject is physically incapable of giving consent or their consent is not legally valid,
• Necessity for the establishment or performance of a contract, provided that it is directly related to the personal data of the parties to the contract,
• Necessity for the data controller to fulfil its legal obligation,
• The data having been made public by the data subject themselves,
• Necessity for the establishment, exercise or protection of a right,
• Necessity for the data controller's legitimate interests, provided this does not harm the fundamental rights and freedoms of the data subject.

Who Do We Share Your Personal Data With?

Your personal data is shared, for the purposes set out in this Privacy Notice and through the means described here, with authorised public institutions and organisations, judicial authorities, enforcement authorities, law enforcement units, as well as contracted suppliers, business partners and consultants from whom products or services are procured.

Data may be shared with consultant organisations the Company collaborates with for complementary services, limited to the purposes of the activities they carry out together.

The Company does not transfer any data unrelated to its purposes. For example, even where obtained with your consent, information relating to your vehicle license plate is not shared with any third party, including the persons and institutions listed above. The only exception to this is where such a transfer is required by legislation, is mandatory for a criminal investigation, or is requested by an official authority based on legislation and with justification stated.

What Are Your Rights?

It is important that the personal data we hold about you is accurate and up to date. Please notify us whenever your personal data changes. Otherwise, we will not be responsible for inaccuracies in the data we hold in our systems. Subject to the exceptions set out in Article 28 ("Exceptions") of the KVKK, under Article 11 of the Law you have the right to apply to our Company to:

• learn whether your personal data is being processed,
• request information about it if your personal data has been processed,
• learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• know the third parties to whom your personal data is transferred, domestically or abroad,
• request correction of your personal data if it has been processed incompletely or incorrectly,
• request the erasure or destruction of your personal data within the conditions set out in Article 7 of the Law,
• request that the third parties to whom your personal data has been transferred, domestically or abroad, be notified of the actions taken under items (d) and (e) above,
• object to a result that is to your detriment arising solely from analysis of your personal data through automated systems, and
• claim compensation for damages suffered as a result of the unlawful processing of your personal data.

You hold the rights listed above.

How Can You Exercise Your Rights?

You can fill in an application form in line with your request/complaint and send it to us via info@kidolog.com, or fill it in physically and send it to Yenişehir Mah. Ulubatlı Sk. Teknopark Blok No: 3, Yahşihan / Kırıkkale, Türkiye by courier or post.

Where you submit your request to us using one of the methods above, pursuant to Article 13/2 of the KVKK, your request will be assessed within 30 days at the latest and you will be informed accordingly. If your request is accepted, the necessary actions will be carried out promptly by the Company as data controller.

Requests are handled free of charge as a rule; however, if fulfilling the request requires a cost, the Company may charge a fee pursuant to Article 7 of the "Communiqué on Procedures and Principles Regarding Application to the Data Controller", which provides: "If a written response is to be given to the data subject's application, no fee is charged for up to 10 pages. A processing fee of 1 TRY may be charged for each page beyond 10 pages. Where the response to the application is provided on a recording medium such as a CD or flash drive, the fee that may be requested by the data controller may not exceed the cost of the recording medium."

Data Controller and Contact Person

As stated in this Privacy Notice, the Company is the data controller under the KVKK.

Data Controller Information

• Full name: EBA Garaj Anonim Şirketi
• Short name: the Company or EBA
• Address: Yenişehir Mah. Ulubatlı Sk. Teknopark Blok No: 3, Yahşihan / Kırıkkale, Türkiye
• Website: https://kidolog.com

Contact Person

• First name: Eray
• Last name: Uğurelli
• Title: CEO
• Email: eray@kidolog.com
• Phone: +90 530 635 71 91

During a voice conversation started from the orb, your voice is transmitted — only to carry out the conversation and only for its duration — to a voice-processing service provider located abroad.

Kidolog does not store any voice recordings.

Please do not share personal data such as names or health information during the conversation.

Voice conversation is entirely optional; if you do not grant microphone permission, every other part of the site keeps working.

Questions: info@kidolog.com