This privacy policy sets out how Vestel Ticaret A.Ş. (“Vestel” or the “Company”) uses and protects your personal data. This privacy policy is provided in a layered format so you can click through to the specific areas set out below.

1. IMPORTANT INFORMATION AND WHO WE ARE (paragraph 1)

2. TYPES OF PERSONAL DATA WE COLLECT ABOUT YOU (paragraph 2)

3. HOW IS YOUR PERSONAL DATA COLLECTED? (paragraph 3)

4. HOW WE USE YOUR PERSONAL DATA (paragraph 4)

5. DISCLOSURES OF YOUR PERSONAL DATA (paragraph 5)

6. INTERNATIONAL TRANSFERS (paragraph 6)

7. DATA SECURITY (paragraph 7)

8. DATA RETENTION (paragraph 8)

9. YOUR LEGAL RIGHTS (paragraph 9)

10. Change Of The Data Protection Notice (paragraph 10)

1. Important information and who we are

Privacy policy

The protection of personal data is one of the highest priorities of Vestel Ticaret A.Ş. (“Vestel” or the Company”). Acting with full awareness of this responsibility as a data ontroller, our Company processes and protects personal data in compliance with the General Data Protection Regulation (“GDPR”) and other relevant legislation (“Law”).

This Privacy Policy on the processing of personal data aims to inform you about the personal data processed in accordance with the Law as you use our products and services, thereby ensuring the necessary transparency.

Controller

Vestel Ticaret Anonim Şirketi;   is responsible for processing your data.

Our contact details are as follows:

Levent 199 Büyükdere Caddesi No:199 34394 Şişli/İSTANBUL

vestelticaret@hs03.kep.tr

kvk@vestel.com.tr

The protection of your personal data is considered a high priority for us. Detailed information is accessible at https://www.vestel.com.tr/content/kisiselverilerinislenmesi 

2. The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Technical Data
includes internet protocol (IP) address, browser type and version, time zone
setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to calculate
the percentage of visitors accessing a specific website feature in order to
analyse general trends in how visitors are interacting with our website to help
improve the website and our service offering.

3. How is your personal data collected?

We use different methods to collect data from and about you including through:

Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies. We may also receive Technica l Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.

4. How we use your personaldata

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Purpose/Use

Type of data

Legal basis

To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) 

Technical

(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)

(b) Necessary to comply with a legal obligation

To use data analytics to improve our website, products/services,

Technical Necessary for our legitimate interests (to keep our website updated and relevant, to develop our business).

Cookies

Further details of how we use cookies can be found on our cookie policy which may be found here: [cookie policy].

5. Disclosures of your personal data

We may share your personal data where necessary with the parties set out below for the purposes set out in the table Purposes for which we will use your personal data above.

• Our suppliers who provide software, maintenance, security, and data hosting services within the scope of information technologies.
• Our suppliers from whom we receive services for the purpose of carrying out our operational processes.
• Our business partners providing legal, accountancy and other professional support services.
• Our business partner consultancy companies providing services for business development and project management.
• Our professional advisers for example our lawyers, auditors and accountants.
• Where we are required to do so as a matter of law for example public bodies such as the courts, law enforcement authorities,and as part of legal proceedings .
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

6. International transfers

As part of the processing of your personal data, we may transfer your personal data to trustworthy service providers or affiliated companies in third countries. Third countries are countries outside of the European Union (EU) or the European Economic Area (EEA). We only work with service providers who provide us with the appropriate safeguards for the security of your personal data and can guarantee that your personal data will be processed strictly in accordance with European data protection standards. A copy of these appropriate safeguards can be examined at our premises. If we transfer personal data to third countries, we do so on the basis of a so-called “adequacy decision” of the European Commission or, in the absence of such a decision, on the basis of so-called “standard data protection clauses” which have also been adopted by the European Commission.

7. Data security

Our employees and the companies providing services on our behalf, are obliged to confidentiality and to compliance with the applicable data protection laws. We take all necessary technical and organizational measures to ensure an appropriate level of security and to protect your data that are administrated by us especially from the risks of unintended or unlawful destruction, manipulation, loss, change, or unauthorized disclosure or unauthorized access. Our security measures are, pursuant to technological progress, constantly being improved.

8. Data retention

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal,
regulatory or other requirements.

In some circumstances you can ask us to delete your data: see paragraph 9 below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely
without further notice to you.

9. Your legal rights

You have the following rights against us:

a. Right of access

You have the right to access as to whether or not and, if so, what your personal data of you are being processed by us. Is this the case, we will additionally give you access to the following:

(1)the purposes of the processing;

(2)the categories of personal data concerned;

(3)the recipients or categories of recipients of your personal data;

(4)the envisaged period of storage or the criteria used to determine the envisaged period of storage;

(5)any other rights you have;

(6)where we have not obtained the personal data from you: any available information as to their source;

(7)if available: the existence of automated decision-making and any information about the logic involved, as well as the significance and the envisaged consequences of the processing.

b. Right to rectification

You have the right to rectification and/or completion of the personal data that is being processed by us, if it is inaccurate or incomplete.

c. Right to restriction of processing

You have the right to restriction of processing of your personal data, provided that

(1)we verify the accuracy of your personal data being processed by us;

(2)the processing of your personal data is unlawful;

(3)you need the personal data being processed by us for the purpose of prosecution when we no longer need your personal data for the purpose of processing;

(4)you have objected to the processing of your personal data and we are in the process of verifying your objection.

d. Right to erasure

You have the right to erasure of your personal data, provided that

(1)we no longer need your personal data for its original purpose;

(2)you withdraw your consent and there is no other legal ground for processing your personal data;

(3)you object to the processing of your personal data and, unless it is about direct marketing, there are no overriding grounds for further processing;

(4)the processing of your personal data is unlawful;

(5)the erasure of your personal data is required by law;

(6)your personal data have been collected in relation to the offer of information society services when you were a minor.

e. Right to notification

If you have asserted your right to rectification, erasure of data or restriction of processing, we will communicate any rectification, erasure of data or restriction of processing to any recipients of your personal data.

f. Right to data portability

You have the right to receive your personal data processed by us on the basis of your consent or for the performance of a contract in a structured, commonly used and machine-readable format as well as to transmit them to another controller. If it is technically feasible, you have the right to have them directly transmitted from us to another controller.

g. Right to object

You have the right to object to the processing of your personal data on particular grounds. If this is the case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing.

If your personal data is being processed for the purpose of direct marketing, you have the right to object at any time.

h. Right to withdraw

You have the right to withdraw your consent given to us at any time. The withdrawal of the consent does not affect the lawfulness of the processing carried out based on the consent before your withdrawal.

i. Right to lodge a complaint with a supervisory authority

Regardless of any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority, if you believe that the processing of your personal data by us violates the provisions of the GDPR.

10. Change Of The Data Protection
Notice

We reserve the right to change our security and data protection measures. In such cases, we will amend our data protection notice accordingly. Please, therefore, notice the current version of our data protection notice, as this is subject to changes.

Date of last revision: 11.09.2025