INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

INTRODUCTION AND GENERAL FRAMEWORK

The protection of personal data is among the utmost priorities of ONVO Elektronik Anonim Şirketi ("ONVO", "Company", or "Data Controller"). Fully aware of its legal responsibility, our Company processes and protects personal data in full compliance with the Law No. 6698 on the Protection of Personal Data ("KVKK" or "Law") and relevant statutory provisions.

This Information Notice on the Processing of Personal Data ("Information Notice") has been prepared to ensure transparency regarding personal data processed in accordance with the KVKK as part of delivering our products and services to our customers. Detailed information on the processing of your personal data can be accessed via the "Personal Data Processing and Protection Policy" ("Policy") available on our official website.

PROCESSING OF YOUR PERSONAL DATA

Your personal data is processed by our Company within the framework of fundamental principles stipulated in the KVKK and under personal data processing conditions for the purposes outlined below:

1. DATA PROCESSING WITHIN E-COMMERCE AND SALES OPERATIONS

Processing of your personal data during product and service purchases executed via our e-commerce site, stores, dealers, or partner marketplaces:

• Processed Personal Data:

  • Identity Information: Full name, T.R. Identification Number (TCKN).

  • Contact Information: E-mail address, phone number, physical address.

  • Financial Information: Credit card or debit card details.

  • Customer Transaction Information: Purchased product details, order completion records, return/exchange logs, order history, billing and payment details, installation records, warranty details, authorized service records, dealer store details.

• Processing Purposes:

  • Executing sales transactions for products and services offered by our Company,

  • Receiving, evaluating, and contacting customers regarding pre-order applications,

  • Providing post-sales delivery, installation, maintenance, or repair services,

  • Managing warranty processes for purchased products,

  • Delivering authorized technical service support,

  • Storing and processing shared payment card details post-purchase upon consent.

• Legal Grounds:

  • Performance of Contract: Fulfilling statutory obligations arising from pre-order agreements and sales contracts.

  • Legal Obligation: Compliance with post-sales installation, warranty, and repair obligations under Law No. 6502 on Consumer Protection.

2. DATA PROCESSING WITHIN WEBSITE MEMBERSHIP

• Processed Personal Data:

  • Identity Information: Full name, date of birth.

  • Contact Information: E-mail address, phone number, address details.

  • Customer Transaction Information: Purchased products, order completions, returns/exchanges, order history, installation, warranty, authorized service logs, dealer information.

  • Transaction Security Information: Account membership password.

• Processing Purposes:

  • Executing account registration procedures on the website,

  • Processing account cancellation requests,

  • Updating user profile details,

  • Conducting e-mail or phone number verification processes.

• Legal Ground:

  • Performance of Contract: Processing required under the membership agreement to provide user benefits.

3. CUSTOMER RELATIONSHIP MANAGEMENT AND SUPPORT SERVICES

• Processed Personal Data:

  • Identity Information: Full name.

  • Contact Information: E-mail address, phone number, physical address.

  • Customer Transaction Information: Purchased items, order history, returns/exchanges, service logs, dealer data, customer requests and complaint records.

• Processing Purposes:

  • Receiving and evaluating customer requests via ONVO Assistant or messaging applications,

  • Managing customer relationship workflows, requests, and inquiries,

  • Conducting internal company reporting to improve operational processes,

  • Verifying identity when utilizing campaigns offered by business partners.

• Legal Ground:

  • Legitimate Interests: Enhancing customer satisfaction, preventing customer churn, and improving support services without prejudice to fundamental rights and freedoms.

4. LEGAL OBLIGATIONS AND COMMERCIAL OPERATIONS

• Processed Personal Data:

  • Identity Information: Full name.

  • Contact Information: E-mail address, phone number, physical address.

  • Customer Transaction Information: Purchase history, billing records, complaint data, technical support records.

• Processing Purposes:

  • Fulfilling statutory requirements under applicable tax and commercial laws,

  • Providing required information and documents to official government authorities,

  • Managing accounting, financial, and information security processes,

  • Verifying sales authenticity and measuring store foot traffic security,

  • Executing operational decisions within Group Companies.

• Legal Grounds:

  • Explicitly Stipulated by Laws: Tax obligations under the Tax Procedural Law.

  • Legal Obligation: Data security obligations pursuant to KVKK.

  • Establishment or Protection of Rights: Retaining data as legal evidence during disputes.

  • Legitimate Interests: Executing legitimate commercial and operational activities.

SHARING OF PERSONAL DATA

Your personal data may be transferred to third parties strictly under the rules set forth in KVKK for specific operational purposes:

• Dealers and Authorized Services: To execute product delivery, installation, and repair services.

• IT Service Providers: For software hosting, system maintenance, and cybersecurity support.

• Call Center Vendors: To manage customer service operations.

• Business Partners: To facilitate consumer loan options for purchases upon request.

• Logistics and Shipping Partners: To physically deliver purchased items.

• Legal Counsel & Advisory Firms: To manage legal disputes and corporate project strategies.

• Group Companies: To organize customer visits, resolve complaints, and conduct operational planning.

• Public Institutions: To comply with formal legal requests from authorized state agencies.

DATA PROCESSING BASED ON EXPLICIT CONSENT

Certain data processing activities strictly require your explicit consent:

• Marketing and Customization Activities: Presenting tailored offers, new product launches, targeted marketing campaigns, and surveys via electronic messaging.

• Live Store Experience & Video Technical Support: Transferring voice, video, and identification records abroad due to overseas server infrastructure when utilizing live video support. (Note: No video/audio logs are recorded during sessions; third parties must not attend).

• Payment Card Retention: Securely storing credit card details via PCI-DSS compliant payment gateways post-purchase to facilitate future transactions.

DATA COLLECTION METHODS

Your personal data is collected automatically or non-automatically via:

• Electronic Mediums: Websites, call centers, e-mail, live store, video technical support, ONVO Assistant, messaging channels.

• Physical Mediums: Authorized services, dealers, and corporate retail stores.

YOUR STATUTORY RIGHTS UNDER ARTICLE 11 OF KVKK

As a Data Subject, you hold the following rights:

1. To learn whether your personal data is processed,

2. To request detailed information if your data has been processed,

3. To learn the purpose of processing and whether data is used accordingly,

4. To know third parties to whom data is transferred domestically or abroad,

5. To request rectification of incomplete or inaccurate data,

6. To request deletion or destruction of data under statutory conditions,

7. To request notification of corrections/deletions to third-party recipients,

8. To object to results against you arising from automated analysis systems,

9. To claim compensation for damages incurred due to unlawful processing.

• Application Procedure: You may submit your formal request in writing to [ADDRESS] or electronically via [E-MAIL] using your registered e-mail address or secure digital signature. Requests will be finalized free of charge within 30 days.

INFORMATION NOTICE ON SECURITY CAMERAS (CCTV)

INTRODUCTION

Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data may be processed by ONVO Anonim Şirketi ("Company") as Data Controller within the framework detailed below.

PURPOSES AND LEGAL GROUNDS OF DATA PROCESSING

• Processed Personal Data:

  • Physical Space Security Information: CCTV camera video recordings.

• Processing Purposes:

  • Ensuring physical security across our stores, cafes, employees, and customers,

  • Providing necessary inspection and evidentiary support in case of legal disputes.

• Legal Grounds (Article 5/2 of KVKK):

  • Legal Obligation: Necessary for the Data Controller to fulfill statutory duties.

  • Establishment, Exercise, or Protection of Rights: Essential for establishing or defending legal claims.

  • Legitimate Interests: Mandatory for legitimate security interests without harming fundamental rights.

TRANSFER OF CCTV DATA

Your video recordings may be shared strictly for security and legal reasons with:

• Authorized public authorities,

• Legally empowered private institutions,

• Legal advisors and suppliers in case of legal disputes.

RETENTION PERIOD

Our Company retains CCTV footage for the period mandated by applicable security legislation or required for processing purposes. In case of legal disputes, data is retained for the duration of statutory limitation periods solely for defense purposes.

DATA SECURITY MEASURES AND COMMITMENTS

Our Company undertakes technical and administrative precautions to:

• Prevent unlawful processing of personal data,

• Prevent unauthorized access to data,

• Ensure safe data retention.

CCTV records will not be disclosed to third parties or used outside stated security purposes in violation of applicable laws.

DATA COLLECTION METHOD

Personal data is collected automatically through closed-circuit television (CCTV) camera systems installed in physical premises.

STATUTORY RIGHTS AND APPLICATIONS

As a Data Subject under Article 11 of KVKK, you possess the rights to request access, rectification, deletion, or objection regarding your video data.

• Application Procedure: You may submit your requests in writing to [ADDRESS] or via e-mail to [E-MAIL]. Applications will be reviewed and responded to within 30 (thirty) days.