LELAS PERFUME KOZMETIK SANAYI VE TICARET ANONIM ŞIRKETI CUSTOMER CLARIFICATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

1. DEFINITION AND PURPOSE

LELAS PERFUME KOZMETIK SANAYI VE TICARET A.Ş. (“LELAS A.Ş.” or “Company”) aims to process the personal data of real person customers in accordance with the provisions of the Personal Data Protection Law No. 6698 (“PDPL”) and other relevant legislation.

Personal data refers to any information relating to an identified or identifiable natural person. The protection of your personal data is among the top priorities of LELAS A.Ş. The company does not collect or process sensitive personal data.

With this Clarification Text, it is adopted that the activities conducted by LELAS A.Ş. are carried out and improved in accordance with the principles stipulated in the PDPL and other relevant legislation. The Company takes administrative measures and carries out or ensures audits to provide the necessary security level in line with the guides published by the Personal Data Protection Authority. Additionally, LELAS A.Ş. ensures transparency by informing data subjects about its basic principles.

Due to your status as a real person customer of our Company, your personal data that you have provided/will provide to our Company or obtained by any other means by our Company will be processed by us in the capacity of “Data Controller”: • In accordance with the purpose requiring their processing and in a limited, proportionate manner, • By keeping the information accurate and up-to-date as provided or notified, • Will be recorded, stored, preserved, reorganized, shared with institutions legally authorized to request such personal data, and transferred domestically or abroad to third parties under the conditions set by PDPL. It may also be processed in other ways listed in PDPL.

2. COLLECTION OF PERSONAL DATA AND METHOD

Our Company will process your personal data for the purposes specified in this Clarification Text in accordance with the PDPL and our principles. In case of a change in the purpose of processing, additional consent will be obtained.

LELAS  A.Ş., in its capacity as “data controller,” processes personal data through forms completed on https://www.lelas.net/, cookies on the website, and in-store transactions such as purchases or complaints. The completion of relevant fields by the consumer leads to partial or full automation in data processing.

The types of personal data collected and used by our Company include: • Name, surname, address, purchased products, delivery method, transaction date, preferred payment type, payment channel information, bank account details, billing information, shopping experience, passport number, ID number, date of birth, gender (if provided), social media account details, email, phone number, CCTV footage for security purposes.

Your personal data is collected before, during, and after the contractual relationship using any documents you submit, from third parties or public institutions for legal reasons, either physically or electronically, or through security cameras placed in LELAS Parfumeur stores.

The technical and administrative measures taken for the protection of personal data are applied with particular care in relation to sensitive personal data, and necessary audits are conducted.

3. PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your personal data is processed using automatic or non-automatic methods in accordance with PDPL Articles 5 and 6 based on the following legal grounds:

• Cases explicitly stipulated by law,
• Necessity for the establishment or performance of a contract,
• Necessity for compliance with a legal obligation,
• Necessity for the establishment, exercise, or defense of a legal right,
• Legitimate interests of LELAS A.Ş., provided that fundamental rights and freedoms of the data subject are not harmed.

The primary purpose of processing is based on the explicit consent of the data subject.

Processing purposes may be updated based on legal obligations and company policies and may include: • Conducting legal procedures, • Performing electronic payment transactions, • Carrying out advertising and marketing activities, • Creating customer lists for marketing, • Organizing raffles for marketing purposes, • Classifying customers, • Tracking returned products, • Managing product delivery processes, • Running promotional campaigns via mobile app, • Conducting research for customer experience improvement, • Enhancing service quality, • Monitoring stores via CCTV for safety, • Corporate communication with customers, • Generating invoices, • Creating customer account statements, • Tracking after-sales services, • Managing website login operations, • Tracking online purchases, • Analyzing website cookies.

Your personal data will be retained in accordance with relevant legislation or, in the absence of such, for a reasonable period necessary for the purpose of processing or until legal retention periods expire.

4. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

The transfer of personal data to third parties is regulated under PDPL, and LELAS A.Ş. shares data only in accordance with legal requirements and after implementing necessary security measures.

Personal data may be transferred, with or without explicit consent (depending on the situation), to business partners, suppliers, service providers, affiliates, group companies, regulatory authorities, official institutions, or other necessary third parties both domestically and internationally.

Transfers may also occur in response to formal requests from courts or authorized administrative or judicial authorities to fulfill the data controller’s legal obligations or for legal claim purposes.

Your data may be transferred for the purposes of magazine publishing, managing e-payment processes, marketing activities, cargo delivery processes, campaign execution in mobile apps, analyzing customer experience, organizing raffles, classifying customers, sending promotional messages, managing memberships and purchases via the website, store surveillance, and cookie tracking—to suppliers, business partners, public institutions, and other relevant third parties as limited to the purposes stated in this clarification text.

5. CUSTOMER RIGHTS

Under Article 11 of the PDPL, you may apply to our Company and request: a) To learn whether your personal data is being processed, b) If processed, to request related information, c) To learn the processing purpose and whether it is used in line with this purpose, d) To know third parties to whom data is transferred domestically or internationally, e) To request correction of incomplete or inaccurate data, f) To request deletion, destruction, or anonymization of data if processing grounds no longer exist, g) To object to any negative outcome resulting from automatic data processing, h) To request compensation for damages caused by unlawful data processing.

Requests can be submitted using a secure electronic signature, mobile signature, or via your registered email address as per Article 13 of the PDPL and related regulations. Requests will be answered within 30 days at the latest. Requests concerning other individuals (e.g., family members) will not be accepted. LELAS A.Ş. reserves the right to verify your identity before responding.

Applications must include:

• Name, surname, and if in writing, signature,
• Turkish ID number (or passport number for foreigners),
• Residential or business address,
• Email address, phone, and fax number (if any),
• Request details.

If submitting in writing, include supporting documents and send them to: Göztepe Mahallesi İstoç 4. Cad. G Blok No:1 İç Kapı:81 Bağcılar/İSTANBUL. For email inquiries: info@lelas.net or contact our call center at +905537605745.

Please ensure all required information is complete to avoid delays in processing. LELAS A.Ş. reserves its legal rights.

This Clarification Text may be revised by the Company when necessary. Updates will be published on www.lelas.net. You will be notified upon request when revisions occur.