Law on the Protection of Personal Data (KVKK)

Customer Information Notice

As Mithrapack Ambalaj İhracat İthalat Limited Şirketi (“Mithrapack”), we attach great importance to the processing and protection of your personal data. This Information Notice has been prepared in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“Law” or “KVKK”) and the Communiqué on the Principles and Procedures to Be Followed in Fulfilling the Obligation to Inform, in order to ensure that our customers are informed about the personal data processed and transferred during the provision of our services.

In addition, you may access detailed information regarding the processing of your personal data obtained automatically through cookies used on Mithrapack’s websites, the types of cookies used, and your preferences regarding the management of these cookies in the Cookie Information Notice.

Purposes, Legal Grounds, and Methods of Processing Your Personal Data

If you make purchases through Mithrapack stores, website, or mobile application, your personal data are processed in accordance with KVKK and relevant legislation within the scope of the purposes and legal grounds specified below:

Identity Information

Processed Personal Data: Name, Surname, Turkish ID Number, Gender, Date of Birth

Purposes of Personal Data Processing: Conducting Finance and Accounting Activities, Conducting Communication Activities, Conducting Processes for Loyalty to the Company / Products / Services, Conducting Activities in Compliance with Legislation, Monitoring and Conducting Legal Affairs, Ensuring Business Continuity, Conducting and Auditing Business Activities, Conducting Goods / Services Sales Processes, Conducting After-Sales Support Services, Conducting Customer Relationship Management Processes, Conducting Activities for Customer Satisfaction, Conducting Advertising, Campaign, and Promotion Processes, Conducting Storage and Archiving Activities, Conducting Contract Processes, Monitoring Requests / Complaints, Providing Information to Authorized Persons, Institutions, and Organizations, Conducting Audit / Ethics Activities, Conducting Internal Audit / Investigation / Intelligence Activities.

Legal Grounds for Processing Identity Information: Your identity information is processed by Mithrapack based on the following legal grounds specified primarily in Article 5 of KVKK and relevant legislation, for the realization of the purposes listed above:

• Explicitly stipulated by laws,

• Being necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract,Being necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract,

• Being mandatory for the data controller to fulfill its legal obligation,Being mandatory for the data controller to fulfill its legal obligation,

• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Methods of Collecting Identity Information: Your identity information is collected through call center communications, electronic forms, documents filled out within the scope of store transactions, information declared by you, emails, optional fields on our platform, contracts, third-party social media platforms, and third-party identity verification systems (e.g., Google Login, Facebook Login).

Contact Information

Processed Personal Data: Email Address, Delivery / Billing Address Information, Mobile Phone Number.

Purposes of Personal Data Processing: Conducting Finance and Accounting Activities, Conducting Communication Activities, Conducting Processes for Loyalty to the Company / Products / Services, Conducting Activities in Compliance with Legislation, Monitoring and Conducting Legal Affairs, Ensuring Business Continuity, Conducting and Auditing Business Activities, Conducting Goods / Services Sales Processes, Conducting After-Sales Support Services, Conducting Customer Relationship Management Processes, Conducting Activities for Customer Satisfaction, Conducting Advertising, Campaign, and Promotion Processes, Conducting Contract Processes, Monitoring Requests / Complaints, Providing Information to Authorized Persons, Institutions, and Organizations, Conducting Audit / Ethics Activities, Conducting Internal Audit / Investigation / Intelligence Activities.

Legal Grounds for Processing Contact Information: Your contact information is processed by Mithrapack based on the following legal grounds specified primarily in Article 5 of KVKK and relevant legislation:

• Being necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract,Being necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract,

• Being mandatory for the data controller to fulfill its legal obligation,Being mandatory for the data controller to fulfill its legal obligation,

• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Methods of Collecting Contact Information: Your contact information is collected through call center communications, electronic forms, documents filled out within the scope of store transactions, information declared by you, emails, optional fields on our platform, contracts, third-party social media platforms, and third-party identity verification systems (e.g., Google Login, Facebook Login).

Customer Transaction Information

Processed Personal Data: Billing Information, Payment Information, Order Information, Order Number, Customer Number, Mithrapack Membership Information, Return Information, Survey Responses, Request and Complaint Information, Shipping Information, Delivery Information, Product Information, Discount Code and Gift Voucher Information, Amount Information, Personal Data Arising Within the Scope of Investigations / Fraud Control Activities.

Purposes of Personal Data Processing: Conducting and Auditing Business Activities, Providing Information to Authorized Persons, Institutions, and Organizations; Conducting Audit / Ethics Activities, Conducting Internal Audit / Investigation / Intelligence Activities, Conducting Activities in Compliance with Legislation, Conducting Finance and Accounting Activities, Conducting Contract Processes, Conducting Goods / Services Sales Processes, Conducting After-Sales Support Services, Conducting Customer Relationship Management Processes, Conducting Activities for Customer Satisfaction, Conducting Advertising, Campaign, and Promotion Processes, Monitoring Requests / Complaints, Ensuring the Security of Data Controller Operations, Conducting Strategic Planning Activities, Conducting Marketing Analysis Activities.

Legal Grounds for Processing Customer Transaction Information: Your customer transaction information is processed by Mithrapack based on the following legal grounds specified primarily in Article 5 of KVKK and relevant legislation:

• Explicitly stipulated by laws,

• Being necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract,Being necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract,

• Being mandatory for the data controller to fulfill its legal obligation,Being mandatory for the data controller to fulfill its legal obligation,

• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Methods of Collecting Customer Transaction Information: Your customer transaction information is collected through call center communications, electronic forms, documents filled out within the scope of store transactions, information declared by you, emails, contracts, and third parties.

Transaction Security Information

Processed Personal Data: IP Address Information, Website Login and Logout Information, Password Information, Browser Information, User Device Operating System Information, Traffic Data.

Purposes of Personal Data Processing: Conducting Access Authorization Processes, Conducting Information Security Processes, Conducting Audit / Ethics Activities, Conducting and Auditing Business Activities, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions, and Organizations, Conducting Goods / Services Sales Processes, Conducting After-Sales Support Services, Conducting Storage and Archiving Activities, Conducting Activities in Compliance with Legislation.

Legal Grounds for Processing Transaction Security Information: Transaction security information is processed by Mithrapack based on the following legal grounds specified primarily in Article 5 of KVKK and relevant legislation:

• Explicitly stipulated by laws,

• Being mandatory for the data controller to fulfill its legal obligation,Being mandatory for the data controller to fulfill its legal obligation,

• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Methods of Collecting Transaction Security Information: Transaction security information is collected through information security systems and electronic devices.

Visual and Audio Record Information

Processed Personal Data: Call Center Voice Recordings, Photographs, and Video Recordings.

Purposes of Personal Data Processing: Providing an Effective Call Center Experience Related to the Services Provided, Conducting Necessary Research and Reviews to Fulfill Support Services Regarding the Subject of the Request, Conducting Communication Activities, Monitoring Requests and Complaints, Use as Evidence in Potential Future Disputes, Conducting Processes for Loyalty to the Company / Products / Services, Conducting Customer Relationship Management Processes, Conducting Activities for Customer Satisfaction, Organization and Event Management.

Legal Grounds for Processing Visual and Audio Record Information: Your visual and audio record information is processed by Mithrapack based on the following legal grounds specified primarily in Article 5 of KVKK and relevant legislation:

• Explicit Consent,

• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,

• Being mandatory for the establishment, exercise, or protection of a right,

• Being made public by the data subject themselves.

Methods of Collecting Visual and Audio Record Information: Your visual and audio record information is collected through call center communications, social media platforms, and photo and video recordings.

Legal Transaction Information

Processed Personal Data: In Case of Disputes; Information in Correspondence with Judicial and Administrative Authorities, Information in Litigation Files, Information within the Scope of Notices / Warnings.

Purposes of Personal Data Processing: Conducting Activities in Compliance with Legislation, Conducting Finance and Accounting Activities, Monitoring and Conducting Legal Affairs, Conducting and Auditing Business Activities, Conducting Contract Processes, Monitoring Requests and Complaints, Providing Information to Authorized Persons, Institutions, and Organizations.

Legal Grounds for Processing Legal Transaction Information: Your legal transaction information is processed by Mithrapack based on the following legal grounds specified primarily in Article 5 of KVKK and relevant legislation:

• Explicitly stipulated by laws,

• Being mandatory for the data controller to fulfill its legal obligation,Being mandatory for the data controller to fulfill its legal obligation,

• Being mandatory for the establishment, exercise, or protection of a right.

Methods of Collecting Legal Transaction Information: Your legal transaction information is collected through official correspondence and other printed and electronic documents.

Financial Information

Processed Personal Data: Encrypted Credit Card Information, Bank Account / IBAN Number Information.

Purposes of Personal Data Processing: Conducting Activities in Compliance with Legislation, Monitoring and Conducting Legal Affairs, Conducting Finance and Accounting Activities, Conducting Refund and Payment Processes, Conducting and Auditing Business Activities, Conducting Goods / Services Sales Processes, Conducting Storage and Archiving Activities, Conducting Contract Processes, Providing Information to Authorized Persons, Institutions, and Organizations.

Legal Grounds for Processing Financial Information: Your financial information is processed by Mithrapack based on the following legal grounds specified primarily in Article 5 of KVKK and relevant legislation:

• Being necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract,Being necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract,

• Being mandatory for the data controller to fulfill its legal obligation.

Methods of Collecting Financial Information: Your financial information is collected through information declared by you, electronic forms, emails, optional fields on our platform, and contracts.

Physical Premises Security Information

Processed Personal Data: CCTV Records.

Purposes of Personal Data Processing: Ensuring Physical Premises Security, Conducting and Auditing Business Activities, Ensuring the Security of Movable Property and Resources, Ensuring the Security of Data Controller Operations, Conducting Audit / Ethics Activities, Monitoring and Conducting Legal Affairs, Conducting Internal Audit / Investigation / Intelligence Activities.

Legal Grounds for Processing Physical Premises Security Information: Physical premises security information is processed by Mithrapack based on the following legal grounds specified primarily in Article 5 of KVKK and relevant legislation:

• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,

• Being mandatory for the establishment, exercise, or protection of a right.

Methods of Collecting Physical Premises Security Information: Physical premises security information is collected through closed-circuit camera systems (CCTV).

Transfer of Personal Data

Your personal data are transferred:

• To Authorized Public Institutions and Organizations for purposes such as conducting activities in compliance with legislation, providing information to authorized persons, institutions, and organizations, and monitoring and conducting legal affairs, within the scope prescribed by legal regulations;

• To Business Partners, Suppliers such as cargo companies providing shipment services, independent audit firms, financial consultancy firms, and intermediary service providers, Private Legal Entities such as banks and payment institutions, Affiliated Companies, and Subsidiaries, for purposes including conducting audit / ethics activities, access authorization processes, finance and accounting activities, communication activities, conducting and auditing business activities, logistics activities, after-sales support services, goods / services sales processes, customer relationship management processes, customer satisfaction activities, storage and archiving activities, contract processes, monitoring requests / complaints, and conducting marketing processes for products / services.

• Within the scope of social media activities conducted by Mithrapack, your photo and video records may be shared publicly on social media platforms managed by Mithrapack and on its website for purposes such as conducting communication activities, conducting and auditing business activities, organization and event management, and conducting advertising / campaign / promotion processes.

If you make purchases by creating a Mithrapack membership, your personal data are recorded in programs and/or systems provided by our technology infrastructure suppliers and business partners whose servers are located abroad, for purposes such as conducting storage and archiving activities and information security processes. In this context, your personal data will be processed by service providers with servers located abroad on behalf of Mithrapack, transferred abroad automatically for the purposes listed above based on your explicit consent (for detailed information, please review our Explicit Consent Text), with all necessary technical and administrative measures taken, and will not be shared with any third party other than those listed.

What Are Your Rights as a Data Subject?

Within the scope of KVKK and relevant legislation, you have the right to:

• Learn whether your personal data are processed,

• Request information if your personal data have been processed,

• Learn the purpose of processing your personal data and whether they are used in accordance with that purpose,

• Know the third parties to whom your personal data are transferred domestically or abroad,

• Request the correction of your personal data if they are incomplete or incorrectly processed,

• Request the deletion or destruction of your personal data within the framework of the conditions stipulated in KVKK,

• Request notification of correction, deletion, or destruction processes to third parties to whom your personal data have been transferred,

• Object to the occurrence of a result against you by analyzing processed data exclusively through automated systems, and

• Request compensation for damages in case you suffer damage due to unlawful processing of your personal data.

How Can You Exercise Your Rights?

You may submit your applications and requests regarding your personal data via the “KVK Application Form” by:

• Sending an email to magaza@mithrapack.com.tr from the email address previously notified to Mithrapack and registered in its system,

• Applying in person with a valid identity document,

• Sending a wet-signed application along with a copy of your ID to Orhan Gazi Mah. 1646. Sk. 3 Etap Kiptaş Başak Konutları C10 Blok No:7/29 Interior Door No:3 Esenyurt/İstanbul,

• Sending an email to magaza@mithrapack.com.tr signed with a mobile signature or secure electronic signature.

Mithrapack

Information Required in Your Application

Pursuant to the Communiqué on the Principles and Procedures for Application to the Data Controller, the following information must be included:

• Name and surname,

• Signature if the application is in writing,

• Turkish ID number (or nationality, passport number, or ID number if the applicant is a foreigner),

• Residential or business address for notification,

• If available, email address, telephone number, and fax number for notification,

• Subject of the request.

The Data Subject must clearly and understandably specify the request in the application, including explanations regarding the right they wish to exercise. Information and documents related to the application must be attached.

The subject of the request must be related to the applicant personally. If acting on behalf of another person, the applicant must be specifically authorized and document such authorization (power of attorney). The application must also include identity and address information, and identity verification documents must be attached.

Requests made by unauthorized third parties on behalf of others will not be taken into consideration.

How Long Does It Take to Respond to Your Requests Regarding the Processing of Your Personal Data?

Your requests regarding your personal data rights will be evaluated and responded to within a maximum of 30 days from the date they reach us. If your application is rejected, the reasoned grounds for rejection will be sent to the address you specified in your application via one of the methods you selected, primarily by email or postal mail.

Updating the Information Notice

The Information Notice may be updated in line with changing services and conditions within Mithrapack platforms and legal developments. You may access the most up-to-date Information Notice on our website and mobile application.