Ahel Personal Data Protection Law (KVKK) Clarification Text

Dear Customers and Visitors,

As Ahel Giyim Sanayi ve Ticaret Limited Şirketi (“Ahel” or “Company”), we show the utmost sensitivity regarding the processing and protection of your personal data within the scope of the Personal Data Protection Law No. 6698 (“KVKK” or “Law”). In this clarification text, we inform you about the methods by which your personal data obtained through the website with the domain name www.aheltasarim.com.tr (“Site”) and other channels belonging to Ahel are collected, for what purposes and legal reasons they are processed, with whom they can be shared (including domestic and international transfers), and your rights arising from the KVKK.

Data Controller and Contact Information

In accordance with the KVKK, the “Data Controller” is the person who determines the purposes and means of processing personal data and is responsible for the management of the data recording system. In this context, the data controller is Ahel Giyim San. ve Tic. Ltd. Şti., and the company headquarters is located at Mehmet Nesih Özmen Mah. Şimşir Sok. No:15 Güngören/Istanbul. You may submit your requests regarding your rights under the KVKK to our Company using the methods specified below (contact information is also provided at the end of this text).

Personal Data Collected and Collection Methods

Ahel collects personal data through various channels in order to provide better service to its valued customers. These channels and methods are as follows:

•Website membership and shopping transactions: Your identity and contact information such as name, surname, e-mail, phone number, address, and payment information, and your customer transaction information such as order history, preferences, and shopping habits are collected directly from you when you become a member or place an order via the Site. This information can be obtained through automatic means such as membership forms, order forms, and payment pages, or through semi-automatic/oral means such as call centers or e-mail if you contact us.

•Site usage and cookies: When you visit our Site, some online usage data such as IP address, browsing information, device information, and preferred pages can be collected via Cookies, which are small files placed on your browser. Details regarding cookie usage are explained in the following sections of this text.

•Customer service and communication channels: When you reach us through channels such as the contact form, e-mail, phone, or WhatsApp line, the name, contact information, and conversation content you share are collected. Additionally, if you interact with us through our social media accounts, your username, etc., shared there may reach us as you have publicly posted them.

•Physical store and other sources: If Ahel has physical stores, visual data may be collected via in-store camera recordings (CCTV), or information may be provided during transactions at the checkout. Furthermore, in case you participate in campaigns or sweepstakes in cooperation with Ahel, data transfers concerning you may occur from the relevant partners.

Your personal data is collected orally, in writing, or electronically; via tools such as our website, mobile application, e-mail, phone, SMS, cookies, and similar technologies. Ahel collects data in accordance with the conditions specified in Article 5 of the KVKK and within the framework of the legal reasons explained below.

Purposes of Processing Personal Data and Legal Reasons

Your collected personal data is processed by Ahel for the following purposes and based on the legal processing conditions specified in Articles 5 and 6 of the KVKK:

•Execution of order and contract processes: Your personal data is processed for activities necessary for the establishment and performance of the sales contract, such as receiving orders for the products you have purchased, carrying out payments, ensuring delivery via cargo, and invoicing. For example, your address information is used for delivery, and your identity information is used for invoicing. These processes are based on the legal ground of being directly related to the establishment or performance of a contract in accordance with Article 5/2(c) of the KVKK.

•Creation and management of membership account: If you become a member of the Site, your data is processed for purposes such as creating your account, enabling login, benefiting from membership advantages, viewing your past orders, and implementing points/discount programs. In this context, your contact and identity information is processed because it is necessary for the performance of the membership agreement. Additionally, data regarding your in-site preferences may be analyzed within the scope of our legitimate interest to improve your membership experience (KVKK Art. 5/2(f)).

•Customer support and communication: Your personal data is processed to receive and evaluate your questions, requests, complaints, and suggestions regarding our products and services, to provide customer support services, and to perform return and exchange transactions. In this context, your name-surname, contact information, and request contents are evaluated by our relevant units. This process may be based on the legal grounds of the necessity of data processing for the establishment or exercise of a right (KVKK Art. 5/2(ç)) or legitimate interest.

•Fulfillment of legal obligations: Your personal data may be processed and shared with relevant authorities in cases required by legal obligations such as tax legislation, consumer legislation, financial audits, court decisions, or official institution requests. For example, processes such as keeping invoices and payment records for the legal periods and providing information to authorized institutions upon official request are carried out based on the legal ground of being stipulated by law (KVKK Art. 5/2(ç)).

•Marketing and personalization activities: With your explicit consent, Ahel processes some of your data to inform you about special campaigns and innovations, to conduct marketing analyses, and to personalize your shopping experience. For example, if you provide consent for electronic communication, e-mails/SMS may be sent to you using your name-surname and contact information; products suitable for your interests may be shown based on your website usage behavior. Data processing activities carried out within this scope are based on the legal ground of explicit consent (KVKK Art. 5/1). You have the right to withdraw your explicit consent at any time.

In addition to the above purposes, your data may also be processed for activities that can be considered within the scope of legitimate interest, such as internal reporting, auditing, risk management, fraud prevention, and security operations – provided that it does not harm your fundamental rights and freedoms. In any case, Ahel processes your personal data within the limits specified in the KVKK and relevant legislation and for the intended purposes.

Sharing Personal Data with Third Parties

As a rule, Ahel does not share the personal data it processes with third parties without your permission. However, to the extent required by our business processes and within the scope of the conditions specified in Articles 8 and 9 of the KVKK, your personal data may be shared with the following recipient groups:

•Group companies and business partners: Your data may be shared within the scope of collaborations where joint marketing activities are carried out with group companies to which Ahel is affiliated. For example, due to a jointly organized campaign, the information about the discount you are entitled to may be shared with the campaign partner firm.

•Suppliers and service providers: We may need to share your data with our domestic or foreign service providers who support us in carrying out our e-commerce activities. Examples include cargo companies (sharing address and contact information for delivery), payment institutions and banks (transmitting card and transaction information necessary for the execution of the payment transaction), software, information technologies, cloud service and technical support providers (hosting our website, data backup, maintenance and support services), and third parties providing marketing/analytical services (e-mail newsletter delivery services, digital advertising agencies, analysis tools). In these exchanges, data is transferred only for the purpose of providing the relevant service and by taking the necessary security measures.

•Legally authorized public institutions and organizations: Your personal data may be shared with administrative or judicial authorities such as courts, the information technologies authority, the personal data protection authority, and law enforcement agencies that are authorized to request personal data by legislation, upon a duly made request or in case of a legal obligation.

 

Apart from the above recipients, other third-party sharing may occur based on your explicit consent or other processing conditions in accordance with Article 8 of the KVKK. Ahel does not sell any of your personal data to third parties for commercial purposes and does not use it outside of its intended purpose.

Transfer of Data Abroad

In case the servers where your personal data is stored or the third parties from whom services are received are located abroad (for example, our cloud service providers' data centers may be abroad, or the tools we use for analysis may process data abroad), your data may be transferred abroad. Ahel will carry out data transfer abroad in accordance with Article 9 of the KVKK. In this context,

•Your data may be sent abroad if you have your explicit consent, or,

•In cases where explicit consent is not obtained, if there is adequate protection in the foreign country where the data will be transferred, or if adequate protection is committed in writing between the relevant foreign data controller and Ahel and the permission of the Personal Data Protection Board is obtained, transfer can be made in accordance with Article 9/2 of the KVKK.

In any case, Ahel takes all necessary technical and administrative measures to ensure the security of your data in cross-border transfers. For example, in data transfers to be made with international service providers, anonymous or aggregated data is used as much as possible, and data protection agreements are concluded with the relevant service providers.

Use of Cookies

We use cookies and similar tracking technologies to ensure you use our site most efficiently and to improve your user experience. A cookie is a small data file stored on your device via your browser when you visit a website. Cookies are used on Ahel's website for the following purposes:

•Mandatory Cookies: These are basic cookies necessary for the site to function. For example, cookies that recognize you when you log in and ensure your session continues.

•Functionality and Preference Cookies: Cookies that remember your preferences on the site (language selection, city information, etc.) and offer you a customized experience.

•Performance and Analytical Cookies: Cookies that allow us to obtain statistical data on issues such as which pages are more popular and browsing habits by analyzing your site usage. This data may be shared anonymously by Ahel with our business partners to provide our customers with a more special and effective shopping experience.

•Advertising and Marketing Cookies: These are cookies used to show content and advertisements suitable for your interests if you have given your explicit consent. For example, recommending products similar to the ones you have viewed or showing special campaign promotions are made possible through these types of cookies.

When you visit our Site for the first time, you will receive a notification regarding cookie usage. If you prefer not to use cookies, you can delete or block them through your browser settings. However, we would like to remind you that in this case, you may not be able to take full advantage of all the features of our site. Unless you change your cookie settings through your browser, we will assume that you accept the use of cookies if you continue to use our site. You can access detailed regulations regarding data processed through cookies and similar technologies in our "Cookie Policy" prepared separately (you will be directed to the relevant page on our site).

Commercial Communication and Marketing Consent

Electronic commercial message transmissions (e.g., e-mail, SMS, WhatsApp messages) and other marketing communications are only made to our users who have given their consent. In accordance with the Law on the Regulation of Electronic Commerce No. 6563 and relevant legislation, Ahel does not send you any promotional, campaign, or marketing-related commercial electronic messages without your explicit consent. If you provide commercial message consent while becoming a member on the Site or later via your profile settings; your contact data such as the name, surname, e-mail address, and mobile phone number you have shared will be used by Ahel or through third parties providing services on behalf of Ahel to inform you about campaigns and innovations.

Even if you have given consent, your right to opt out of receiving commercial messages sent by Ahel is always reserved. You can easily withdraw your communication consent by using the "unsubscribe" link at the bottom of the e-mails you receive or via the opt-out mechanism specified in the SMS. You can also update your marketing communication preferences by contacting us at any time. If you withdraw your commercial communication consent, we undertake that you will be removed from our contact lists within 3 business days at the latest from the moment your withdrawal notification reaches us and that no such messages will be sent to you.

In addition to commercial messages sent within the scope of explicit consent, personalized content such as product recommendations or banner displays that we think might interest you may be presented while browsing our site. Such content is carried out based on data collected through cookies and within the framework of the cookie policy mentioned above.

Data Security and Retention Periods

Ahel takes appropriate technical and administrative measures to ensure the confidentiality and security of your personal data. Personal data is protected against unauthorized access, loss, or disclosure through methods such as firewalls, encryption, access restrictions, and penetration tests. In accordance with our internal policies, our employees are also regularly trained on data security and confidentiality.

Regarding the security of payment information, we would like to emphasize that the credit card/bank card information you enter for purchases made through our site is never stored by Ahel or on the servers from which services are received. The card information entered on the payment page is securely transmitted directly to the relevant bank or payment institution, and the confirmation of the transaction is ensured. In this way, not keeping your card information in our systems provides additional protection against possible risks.

Ahel retains the personal data it processes for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed. For example, records related to e-commerce transactions are kept for 10 years as per the Tax Procedure Law; accounting financial documents are kept for 5 years; your basic membership information is kept as long as your membership account is active; and your contact data is used for this purpose as long as marketing communication consent is given or until the consent is withdrawn. At the end of the period or when the processing purpose disappears, the data is deleted, destroyed, or anonymized in accordance with our periodic destruction policies. Our retention processes are carried out in full compliance with the KVKK and relevant regulations.

Personal Data Owner's Rights Under KVKK

In accordance with Article 11 of the KVKK, as a personal data owner, you, our customers, have the following rights by applying to Ahel:

•To learn whether your personal data is processed, to request information if it has been processed,

•To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

•To know the third parties to whom your personal data is transferred domestically or abroad,

•To request the correction of your personal data if it is incomplete or incorrectly processed,

•To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK,

•To request that the correction, deletion, and destruction operations performed on your personal data be notified to third parties to whom the data was transferred,

•To object to the emergence of a result against you by analyzing the processed data exclusively through automated systems,

•To request the compensation of damages in case you suffer damage due to the illegal processing of your personal data.

Please note: While exercising the above rights, all your requests, including those regarding special categories of personal data, will be evaluated. However, each request may be evaluated within the scope of the exceptions specified in the Law under its own conditions (for example, your deletion request regarding anonymized data or data that must be kept for a certain period by law may not be fulfilled immediately).

Exercise of Rights and Application Method

You may submit your request regarding the exercise of the rights listed above to our company headquarters in writing via registered mail with return receipt, or in accordance with the relevant communiqués of the KVKK (e.g., via registered electronic mail-KEP address, secure electronic signature, mobile signature, or via your e-mail address previously notified to our Company and registered in our system) at [email protected]. We kindly request that you provide the details of your request and the information necessary for identity verification completely in your application. Ahel will conclude your applications free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, we reserve the right to charge the fee determined in the tariff determined by the Personal Data Protection Board. Upon your application, if your request is accepted, we will perform the necessary procedures; if a justified rejection exists, we will notify you in writing or in a digital environment.

For all your questions and requests regarding the protection and processing of your personal data, you can contact us at +90 505 024 01 40. Additionally, for more information about the KVKK (Personal Data Protection Law) and relevant legislation, you may visit the official website of the Personal Data Protection Authority (kvkk.gov.tr).

As Ahel, in line with the importance we place on the privacy of your personal data, we provide this Clarification Text to you in accordance with the applicable legislation. We may update this text in the future in accordance with changes that may occur in legislation or our company practices. The updated text will enter into force on the date it is published on the Site.

We wish you a pleasant and secure shopping experience and declare that we will fully comply with our legal obligations in all processes regarding your personal data.

Last Update Date: 14 November 2025

Effective Date: This text enters into force on the date of its publication.