PERSONAL DATA PROTECTION INFORMATION NOTICE

Under the CECIA brand, Matador Deri ve Ayakkabı Malzemeleri Limited Şirketi acts as the Data Controller within the scope of the Law No. 6698 on the Protection of Personal Data ("KVKK" / "Law") and presents the following information to its members, customers, and third parties using our website in order to fulfill its obligation to inform. CECIA reserves the right to amend this Information Notice when necessary. Any amendments shall become effective upon publication. Matador Deri ve Ayakkabı Malzemeleri Limited Şirketi (operating under the CECIA brand) is the Data Controller.

The personal data you share with CECIA is processed under the supervision and control of CECIA. As the Data Controller, CECIA is responsible for establishing the necessary organizational structure and implementing and adapting appropriate technical measures to ensure the confidentiality and integrity of your personal data in accordance with the applicable legislation.

This Information Notice provides information regarding the procedures for the processing, transfer, storage, and destruction of the personal data you share with CECIA, as well as your rights concerning the use and protection of your personal data under the Law.

Legal Basis for the Collection of Personal Data and Categories of Personal Data Collected

Your personal data is processed, transferred, stored, and destroyed in accordance with the provisions of the Law.

Depending on the products and services you receive from CECIA and within the scope of our relationship with you, personal data may be processed in compliance with the principles set forth in the Law and CECIA's Personal Data Processing and Protection Policy. The categories of personal data processed vary according to the nature of the relationship between CECIA and the relevant individual, the history of that relationship, the method by which the data is obtained, and the purposes listed below.

Identity Information

• First name

• Last name

Contact Information

• Address

• Email address

• Mobile phone number

Purchase Information

• Information related to your purchases, including the date, time, quantity, content, payment method, and invoice details

Financial Information

• Credit card, debit card, or bank account information related to payment transactions

Marketing Information

• Subject to the consent provided by our customers, prospective customers, and other relevant individuals, this may include purchase history, survey responses, behavioral and digital footprint data collected through cookies when you use our websites, data obtained through marketing campaigns, and any other personal data you voluntarily provide through your requests, suggestions, or complaints.

Methods of Collecting Personal Data

Your personal data is collected by CECIA during the provision of our online shopping services. Such data may be obtained when you visit our website at https://www.ceciaofficial.com/ (for example, when creating an account or subscribing to our newsletter), as well as through email communications and social media channels.

Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• To identify and verify customers and confirm the accuracy of their identity information for transactions.

• To manage relationships with customers, support service providers, business partners, and suppliers; to maintain address and other necessary information for providing after-sales support services; to deliver orders to the specified addresses; and to carry out purchasing, sales, and after-sales support processes in fulfillment of contractual obligations.

• To process payments for products purchased by customers.

• To contact customers regarding the terms, current status, and updates of the distance sales agreements concluded under the relevant provisions of the Consumer Protection Law, to provide necessary notifications, and to fulfill the obligations arising from such agreements.

• To plan, audit, and execute information security processes; establish and manage information technology infrastructure; ensure that personal data is accurate and up to date; and maintain accounting records.

• To prepare and maintain all records and documents that serve as the legal basis for transactions conducted electronically (internet, mobile applications, etc.) or in physical form.

• To retain, report, and provide information requested by judicial or administrative authorities, or as required by applicable laws, particularly concerning public security or other legal reporting obligations.

• To provide users with a better shopping experience; to inform customers about products that may be of interest based on their preferences; to communicate campaigns and promotional offers; and, where consent has been provided, to plan and carry out personalized sales and marketing activities, promotions, and campaigns, as well as to send information regarding campaigns organized by our company.

• To improve customer satisfaction; to better understand customers who shop through our website and/or mobile applications; to conduct customer profiling and analysis; to carry out marketing and advertising activities; to organize electronic and/or physical promotional activities through our contracted business partners; and to perform planning and statistical analyses necessary for our business while determining our commercial and operational strategies.

• To enable our contracted institutions and solution partners to provide recommendations to our customers and to inform customers about our services.

• To evaluate customer complaints and suggestions regarding our services.

• To process your personal data for the purposes described above in accordance with the personal data processing conditions and purposes set out in Articles 5 and 6 of the Law, with the aim of providing you with better and more reliable services.

4. Third Parties to Whom Your Personal Data May Be Transferred

The sharing of our customers' personal data with third parties is carried out within the scope of the customer's consent, and, as a general rule, personal data is not transferred to third parties without the customer's approval. However, where required by our legal obligations, personal data may be shared with public authorities, governmental institutions, and judicial bodies that are legally authorized to request such information.

The information of the Registered Customer/Guest Customer, the recipient of the purchased product, and the person in whose name the invoice will be issued may be shared with the shipping company for the purpose of delivering the invoice and the purchased products.

The Registered Customer's/Guest Customer's telephone number and/or email address may be shared with commercial electronic communication service providers, based on the customer's consent to receive commercial electronic communications, in order to send promotional content, advertisements, benefits, and special offers tailored to their shopping preferences, interests, and habits.

Website usage preferences and browsing history may be shared with our domestic and/or international business partners providing cookie services or newsletter subscription services for segmentation purposes and to communicate with Registered Customers/Guest Customers in line with their preferences and interests. Cookies are used on our website to improve the efficiency of the website and to provide more relevant content and services.

To facilitate payment transactions for purchased products, personal data may be shared with electronic money institutions and/or payment service providers.

Personal data may also be shared with domestic and/or international public or private institutions and organizations, suppliers, consultants, shareholders, solution partners, affiliated group companies, and other third parties from whom our company receives services, support, consulting, or with whom we cooperate. Additionally, personal data may be shared with domestic and/or international service providers processing personal data on our behalf, including providers of storage, archiving, information technology support (servers, hosting, software, cloud computing, etc.).

Furthermore, personal data may be transferred to contracted third parties to enable us to provide the services we have undertaken and to perform quality control of those services. Your personal data may also be shared with CECIA's shareholders; program partners and organizations with whom we cooperate in carrying out our business activities; domestic and international cloud storage service providers; domestic and international organizations contracted to send commercial electronic communications; advertising agencies, marketing agencies, survey companies, and other domestic and international business partners and third parties involved in marketing activities, customer satisfaction initiatives, and the planning and execution of activities necessary to customize and promote CECIA's products and services according to users' preferences, usage habits, and needs.

Rights of Data Subjects Whose Personal Data Is Processed

Pursuant to Article 11 of the Law, you have the following rights regarding your personal data:

• To learn whether your personal data is being processed.

• To request information if your personal data has been processed.

• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose.

• To know the third parties to whom your personal data has been transferred, whether domestically or internationally.

• To request the correction of incomplete or inaccurate personal data.

• To request the deletion or destruction of your personal data.

• To request that any correction, deletion, or destruction of personal data be notified to third parties to whom the data has been transferred.

• To object to a result arising against you through the exclusive analysis of processed data by automated systems.

• To request compensation for damages incurred due to the unlawful processing of your personal data.

Contact Us Regarding Your Rights and Requests

In accordance with your legal rights under the applicable legislation, you may submit your requests by completing the KVKK Application Form and delivering it in person or through a notary public to the following address:

İkitelli O.S.B. Aymakoop San. Sit. Yeni Ticaret Merkezi No:14, Başakşehir, Istanbul, Türkiye

Alternatively, pursuant to Article 5 of the Communiqué on the Procedures and Principles for Applications to the Data Controller, you may submit your request via your registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the email address previously notified to our Company and registered in our systems by sending it to:

info@ceciaofficial.com

Your requests will be evaluated and responded to in writing or electronically as soon as possible and no later than 30 (thirty) days, depending on the nature of your request.

This Information Notice has been prepared in accordance with Article 10 of the Law No. 6698 on the Protection of Personal Data (KVKK) in order to fulfill the obligation to inform.

Annex

• KVKK Application Form