Privacy Notice Regarding the Processing and Protection of Personal Data

Corporate

Last Revision Date: 2023 Country: Turkey Sector: Fireplace and Outdoor Kitchen

Nun Metal Industry and Trade Limited Company ("Company"), as the data controller, places great importance on the processing and preservation of personal data belonging to all individuals associated with the Company, including our valued customers, members, and visitors, in accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK" or "Law"). In our capacity as the data controller, we aim to inform you about our data processing activities through this Privacy Notice in accordance with the law, and to notify you of your rights in this context.

A) Which Personal Data is Processed? Our company processes your personal data for specific purposes based on the legal grounds provided below. Ensuring your satisfaction and gaining your preference is the fundamental mission of our company in providing and delivering our products and services. The processed personal data and classifications, taking all necessary measures for the realization of these and other specified purposes, are as follows:

For Registered Customers:

• Identity: Name-Surname

• Contact: Email Address

• Transaction Security: IP Address, Website Entry-Exit Information, Password Information

• Marketing: Cookie Records, Information Obtained through Campaigns

For Customers Creating Orders:

• Identity: Name-Surname, T.C. Identification Number

• Contact: Phone Number, Email Address, Address

• Finance: Payment and Payment Method Records

• Customer Transaction: Order Information

• Transaction Security: IP Address, Website Entry-Exit Information, Password Information

• Marketing: Cookie Records, Information Obtained through Campaigns, Purchase History Information

For Visitors:

• Transaction Security: IP Address, Website Entry-Exit Information

• Marketing: Cookie Records

The personal data collected by our company and the purposes of collection may vary depending on the services provided and the contracts established. You can access detailed information about the processing of your personal data, including purposes and legal reasons, in our Personal Data Processing and Protection Policy on our website.

B) For What Purposes and How are Your Personal Data Collected and Processed? Our company processes your personal data for the following purposes in accordance with the Law and principles of honesty:

• Confirming the identity information of customers who perform product, service purchase, and similar transactions either directly or through a representative,

• Establishing communication with relevant individuals through electronic or physical means,

• Fulfilling obligations arising from legislation and contracts entered into,

• Ensuring the conduct of activities in compliance with regulations,

• Providing information to authorized public institutions and organizations,

• Registering membership,

• Informing our customers, website/mobile application members, and visitors about our products and campaigns that may interest them according to their expectations and requests,

• Recognizing customers who shop on the website/mobile applications and other platforms, using them in customer environment analysis, various marketing and advertising activities, and conducting surveys electronically or physically through contracted organizations to ensure customer satisfaction,

• Ensuring the security of the website/mobile applications to provide a safer shopping environment,

• Managing and executing processes related to orders placed on the website/mobile applications, providing updated information to customers about their orders, sending SMS and Email about delivery status,

• Carrying out post-sales support services,

• Conducting finance and accounting operations,

• Following up legal matters, requests, and complaints.

The personal data collected by our company and the purposes of collection may vary depending on the services provided and the contracts established. You can access detailed information about the processing of your personal data, including purposes and legal reasons, in our Personal Data Processing and Protection Policy on our website.

C) To Whom and for What Purposes Your Personal Data is Shared? The sharing of personal data with third parties is carried out with the consent of the relevant individuals in accordance with Articles 8 and 9 of the Law, and, as a rule, personal data is not transferred to third parties without the consent of the relevant person. However, in some cases specified in the Law, it is envisaged that personal data can be shared without the consent of the relevant person. In this context, personal data is shared with contractual suppliers, legal advisors, and certified e-commerce service providers located abroad for the purpose of fulfilling legal obligations, tracking and auditing services, resolving legal disputes, conducting finance and accounting operations, ensuring the security of our website-mobile applications, and creating a high-level shopping experience.

D) How are Your Personal Data Collected? Your personal data is collected through our call center, corporate websites, mobile sites, mobile applications, or by email, SMS, or other means, and information you provide to us during the signing of commercial contracts or during the commercial relationship process. Various channels, such as technical communication files called "cookies" (small files placed on your hard drive) that allow our servers to recognize you automatically when you visit our website, physical forms, are used to collect and store your personal data either completely or partially through automatic or non-automatic methods as part of the data recording system.

E) On What Legal Grounds is Your Personal Data Processed? As a general rule, your personal data requires explicit consent for processing. Explicit consent can be defined as the permission granted by the relevant individual, who is accurately informed about a specific matter, to process their personal data. However, Article 5/2 of the Law specifies cases where data can be processed without explicit consent. In the presence of at least one of these cases, data processing activities can be carried out without seeking the consent of the relevant individual. Your personal data, as specified above, is processed based on the legal grounds outlined in Article 5/2 of the Law, which include:

• Explicit provision in the laws (e.g., retention of cookie records and IP addresses under Law No. 5651),

• Necessity for the data controller to fulfill its legal obligations (e.g., the need for your name-surname information to issue an invoice for the order you have created),

• Necessity for the processing of personal data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (e.g., presenting information obtained through a campaign for your preferences),

• Necessity for the processing of personal data for the establishment or performance of a contract, directly related to the parties to the contract (e.g., processing address information for the delivery of your order),

• Necessity for data processing for the establishment, exercise, or protection of a right (e.g., tracking legal and financial matters).

F) What Rights do Data Subjects Have under the Law? According to Article 11 of the Law, data subjects have the following rights:

• To learn whether their personal data is being processed,

• To request information if their personal data has been processed,

• To learn the purpose of the processing of personal data and whether it is used in accordance with its purpose,

• To know the third parties to whom personal data is transferred domestically or abroad,

• To request the correction of personal data if it is incomplete or incorrectly processed and to request that the transaction be notified to third parties to whom the personal data has been transferred,

• To request the deletion or destruction of personal data if the reasons requiring its processing cease to exist, despite being processed in accordance with the law and other relevant laws, and to request that the transaction be notified to third parties to whom the personal data has been transferred,

• To object to the occurrence of a result against the individual by exclusively analyzing the processed data through automatic systems,

• In case of damage due to the unlawful processing of personal data, to request the compensation of the damage.

You can submit your applications regarding these rights by filling out the Application Form on our website accurately and correctly, delivering a signed copy of the form in person with identity documents to Mimarsinan Osb. 13. Cad. No:15 Melikgazi Kayseri, sending it via a notary or other methods specified in the Law, or by securely electronically signing and sending the relevant form to the address [email protected]. Depending on the nature of your request, your applications will be concluded as soon as possible and within a maximum of thirty days free of charge; however, the Company reserves the right to charge a fee by the tariff determined by the Personal Data Protection Board in case of any cost. Additionally, for any questions or opinions regarding your personal data, you can contact our company at [email protected].