KVKK Privacy Notice

This Privacy Notice sets out, within the scope of Law no. 6698 on the Protection of Personal Data (“KVKK”), the principles governing the processing of your personal data by the Relax by Espeki brand, which provides its services through the www.espeki.com.tr website (the “Site”).

1. Data Controller

Data Controller: ESRA PERUZE KIZILTUĞ TİNER, ESPEKİ

Address: Yakacık Yeni Mah. Samandıra Cad. No:49/A Kartal / İstanbul

Telephone: +90 540 010 24 34

E-mail: merhaba@espeki.com.tr

Web: www.espeki.com.tr

2. Personal Data Processed and Methods of Collection

Your personal data is collected by automated or partly automated means through the order, membership and contact forms on the Site, through cookies, and through the e-mail and WhatsApp Business communication channels. The categories of data processed:

• Identity details: first name, surname

• Contact details: e-mail address, telephone number, delivery and billing address

• Customer transaction details: order number, product, quantity, amount, invoice/delivery preference

• Payment details: payment method, transaction reference number (the card number is not stored by us; it is processed on the payment institution’s infrastructure)

• Transaction security details: IP address, browser and device information

• Communication content: the content of messages you send us through WhatsApp, e-mail or the contact form (limited to the matter you have raised)

• Marketing details: cookie data, on-site behavioural data (only with explicit consent)

• Return and exchange request details: the items you select on the request form, the reason and your description, any product photos you choose to upload and, for orders paid by bank transfer, the IBAN and account holder’s name you enter for the refund

Bot protection data. Cloudflare Turnstile security verification is used in order to prevent the forms on the Site (newsletter sign-up, contact, membership) from being abused by automated software. Within this scope your IP address, technical signals belonging to your browser and device (TLS fingerprint, User-Agent header) and the relevant site key are processed automatically. This data is used only to determine whether the request was sent by a human or by automated software; it is not used for marketing, profiling or measurement purposes.

3. Data Minimisation and Accuracy

Your personal data is processed under KVKK art. 4 only to the extent required by the purpose of processing, and in a manner connected with and limited to that purpose. Data that is not essential for achieving the purpose is neither requested nor processed. Our form fields have been designed in accordance with this principle; optional and mandatory fields are marked on the form.

Under KVKK art. 4(2)(d), the necessary processes are operated to keep personal data accurate and, where necessary, up to date. If you are a member you may correct or update your details from the account settings page; if you are not a member, by applying to merhaba@espeki.com.tr. Notifications of incorrect or out-of-date data are concluded within a reasonable period.

4. Purposes of Processing and Legal Bases

Your personal data is processed on the basis of the following purposes and legal bases. All processing activities based on legitimate interest (art. 5/2-f) are carried out with a balancing test, provided that they do not harm the fundamental rights and freedoms of the data subject.

Processing for marketing purposes is based solely on your explicit consent; you may withdraw your consent at any time from the My Communication Preferences page or by applying to merhaba@espeki.com.tr.

Bot protection / abuse prevention. Purpose: protecting the form and membership infrastructure against automated attacks, fake registrations and unwanted content submissions. Legal basis: KVKK art. 5/2-f, the legitimate interest of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed. No separate explicit consent is sought for this processing; the operation is essential for the service to be provided securely.

5. Domestic Transfer: Data Controller / Data Processor Roles

Your personal data may be transferred to the following parties, limited to the relevant purpose and in accordance with the data minimisation principle. The role of each party under KVKK is stated below in the light of the contracts signed with us and the guidance and decisions of the Personal Data Protection Board:

• PayTR Ödeme ve Elektronik Para Hizmetleri A.Ş.: Data Processor. Under article 9.5 of the Framework Payment Services Agreement signed with PayTR, PAYTR holds the role of “Data Processor” in respect of the personal data we transfer to it while it provides payment services to us. Card data is processed on the PCI-DSS compliant PayTR infrastructure; it is not stored by us.

• Geliver Bilişim Yazılım Lojistik Tic. Pazarlama AR-GE A.Ş. (Geliver.io): Independent Data Controller. Under article 4.23.1 of the Platform Agreement signed with Geliver, Geliver acts in the role of “data controller” in respect of the personal data it processes within the scope of the shipping integration, and transfers data to the courier companies in line with the purpose and legal basis it determines itself. Scope of transfer: recipient’s first name and surname, delivery address, telephone and order details.

• Courier companies (Yurtiçi Kargo, Aras Kargo, Sürat Kargo, Hepsijet): Independent Data Controller. The courier companies process data on the basis of the purpose and legal basis they determine themselves, within the framework of the contract of carriage, shipment tracking and their obligations under the Postal Services Law and the relevant legislation. The practice of the Personal Data Protection Board is that courier companies are regarded as independent data controllers because of their own legally based obligations. The transfer is made by us to the courier company selected through the Geliver platform.

• DHL Worldwide Express Taşımacılık ve Ticaret A.Ş. (DHL Express Türkiye): Independent Data Controller. For orders shipped abroad, DHL processes data on the basis of the purpose and legal basis it determines itself, within the framework of the contract of carriage, shipment tracking and customs procedures. Scope of transfer: recipient’s first name and surname, delivery address, telephone, e-mail and the order details required for the customs declaration (product description, quantity, value).

• Financial adviser and legal adviser: Independent Data Controller. Within the scope of their own professional obligations (Law no. 3568, the Attorneyship Law and similar), for the purpose of carrying out contractual and legal processes.

• Competent public institutions and organisations, as Recipient, solely within the framework of lawful requests and legislation.

6. Transfer Abroad and Security Measures

Because of Google Analytics 4, Google Ads and the Meta (Facebook/Instagram) Pixel used on the Site, together with the WhatsApp Business service we use for customer communication, some personal data may be processed on the relevant providers’ servers located abroad:

• Google LLC (USA): analytics and advertising cookie data, IP address (anonymised), device/browser information

• Meta Platforms Ireland Ltd. (Ireland) and affiliated provider infrastructure: Meta Pixel cookie data, conversion data, the content of messages you send through WhatsApp Business and your telephone number

• Cloudflare, Inc. (USA): technical signals such as the IP address, TLS fingerprint and User-Agent header within the scope of form security verification (Turnstile). Cloudflare declares that these signals do not permit direct identification. That processing is subject to the provisions of Cloudflare’s Turnstile Privacy Addendum. This verification uses no cookies; under normal conditions no visual component is shown to the visitor, and an interactive verification box is displayed only where the request is found to be suspicious.

Those transfers abroad are made on the basis of the provisions of the Standard Contract (SCC) announced by the Personal Data Protection Board, under KVKK art. 9 and the “Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad” published in the Official Gazette dated 10.07.2024. The SCC is notified to the Authority within 5 (five) business days of the date on which it is signed.

Alongside the SCC, the following technical and administrative measures are applied under KVKK art. 12:

• A requirement for HTTPS/TLS 1.2 and above encryption in transfers; end-to-end SSL across the Site

• Authorisation-based access control (principle of least privilege) and log keeping

• Data minimisation: in transfers abroad, only data specific to the relevant purpose is shared; Google Analytics IP anonymisation

• Regular backup and disaster recovery: daily backups are taken and retained for 7 days; the restore procedure is tested

• Access authorisation revocation procedure: all system access of an authorised user is revoked within 24 hours of the end of their duty or contract, and passwords are renewed

• Event log scope: authorisation/login attempts, administrator actions, payment and order write calls and cookie preference changes are recorded

• Provider compliance checks: the supplier’s GDPR/SCC documentation, Data Processing Agreement (DPA), certifications (ISO 27001, SOC 2)

• Periodic risk assessment and annual review of the scope of transfer

For orders shipped abroad with DHL Express, the recipient’s first name and surname, delivery address, telephone number, e-mail address and the order details required for the customs declaration reach the destination country so that the delivery can be made, where they are processed by the local entities of the DHL group and by the customs authorities of the destination country. This transfer is directly related to the performance of the sales contract with delivery abroad and is made within the scope of KVKK art. 9/6-(b). DHL Express Türkiye processes those data within its own carriage network as an independent data controller.

You may withdraw your consent to consent-based transfers abroad at any time; in that case the cookies and tracking within the relevant channel are disabled for you. Transfers based on other legal grounds, such as the performance of the contract or a legal obligation, continue for as long as the relevant purpose and legal basis continue.

7. Retention Periods and Their Bases

Your personal data is retained for the period required by the purpose of processing and limited to the legal/operational bases set out below. When the period expires the data is deleted, destroyed or anonymised.

Photos you attach to a return or exchange request are kept in an area that only authorised staff can access and are deleted 90 days after the request is closed. The IBAN and the account holder’s name are stored encrypted and are deleted by staff once the refund has been paid.

8. Data Security and Internal Policy Framework

Appropriate technical and administrative measures are applied under KVKK art. 12 in order to prevent the unlawful processing of and access to your data, and the written documentation process is being completed. Our current security measures include SSL/TLS encryption, server/plugin update management, the keeping of access and change records, the carrying out of payment transactions over the PCI-DSS compliant PayTR infrastructure, regular backup and disaster recovery processes, revocation of access when authorisation ends, and event log practices.

9. Data Breach Notification

In the event that your personal data is obtained without authorisation, leaked or subjected to unlawful access, notification is made to the Personal Data Protection Authority within 72 hours at the latest of our becoming aware of the breach, under KVKK art. 12/5 and the Board’s decision no. 2019/10. The data subjects affected by the breach are also informed by appropriate means. The notification covers the nature of the breach, the number/category of persons affected, its likely consequences and the measures taken or proposed.

10. Profiling and Automated Processing

If you give explicit consent, limited profiling is carried out using cookies and on-site behavioural data. That profiling is limited to the purposes of personalising advertising according to your interests, conversion measurement and improving the user experience.

No decision capable of producing an adverse effect on you, such as pricing, access to a product or account restriction, is taken through automated processing. Under KVKK art. 11(g) you have the right to object to an adverse result arising from the analysis of your personal data exclusively by automated systems. You may withdraw your marketing communication consent from the My Communication Preferences page, your cookie/profiling consent through the “Cookie Settings” link in the Site footer, and your other consents through the merhaba@espeki.com.tr application channel, at any time.

Return and exchange count: a total is calculated from the return and exchange records of your orders, using your order e-mail address and telephone number. No new data is stored for this count, and only staff can see it.

11. Rights of the Data Subject

Under KVKK art. 11 you have the following rights:

• To learn whether your personal data is being processed

• To request information about it if it has been processed

• To learn the purpose of processing and whether the data is used in accordance with that purpose

• To know the parties to whom the data is transferred domestically and abroad

• To request its correction if it has been processed incompletely or incorrectly

• To request its deletion or destruction

• To request that correction/deletion/destruction operations be notified to the third parties to whom the data has been transferred

• To object to an adverse result arising exclusively through automated processing

• To claim compensation for loss suffered because of unlawful processing

12. Right of Application and Complaint

To exercise your rights you may send your request, together with documents evidencing your identity, in writing to Yakacık Yeni Mah. Samandıra Cad. No:49/A Kartal / İstanbul, or to the e-mail address merhaba@espeki.com.tr. So that your application can be classified quickly and correctly, we recommend that the words “KVKK Application” be written in the subject line of the e-mail or written petition.

Your application is concluded within 30 (thirty) days at the latest, under the Communiqué on the Procedures and Principles of Application to the Data Controller.

If your application is refused, if you find our response inadequate or if no response is given within 30 days, you have the right under KVKK art. 14 to complain to the Personal Data Protection Authority within 30 days of the date of the response and in any event within 60 days of the date of the application (kvkk.gov.tr).

13. VERBİS Registration Status

Our business has fewer than 50 annual employees and an annual financial balance sheet total of less than 100 million TL, and its main field of activity is not the processing of special categories of personal data. On that basis, in the light of the criteria in KVKK art. 16, the Regulation on the Registry of Data Controllers and Board decision no. 2017/62, it has been assessed that we are exempt from the obligation to register with VERBİS under the current thresholds.

This assessment is reviewed annually; if the thresholds are exceeded, the field of activity changes or the legislation is updated, VERBİS registration is carried out and this text is updated.

14. Updates

This Privacy Notice may be amended because of changes in legislation or updates to processing procedures. Effective date: 29.09.2026. The current version is published on the Site. The version history can be followed in the Version History table at the beginning of the document.