KVKK Contract

CLARIFICATION TEXT REGARDING THE PROCESSING OF PERSONAL DATA

In accordance with Article 10 of the Law No. 6698 on the Protection of Personal Data (KVKK), titled "Obligation of the Data Controller to Inform," it is regulated that the data controller must provide the address and information, the purposes for which personal data will be processed, the recipients to whom the processed personal data may be transferred and for what purposes, the method and legal basis for collecting personal data, and the rights of the data subject as set out in Article 11 of the Law. This Clarification Text has been prepared to inform and enlighten data subjects in accordance with the Personal Data Protection Law and relevant legislation.

DATA CONTROLLER: Av. N.D. Uysaloğlu  
ADDRESS: Şehitmustafa Mahallesi 3504 sokak No:6 Tarsus/ MERSİN  
WEBSITE: [https://www.barobirlik.org.tr](https://www.barobirlik.org.tr)  
E-MAIL: uysaloglud@gmail.com  

DATA REPRESENTATIVE: Av. N.D. Uysaloğlu  
DATA REPRESENTATIVE KEP ADDRESS: -

Scope of the Clarification Text

a. Methods and Legal Grounds for Collecting Personal Data,  
b. Categorization of Data Subject Groups and Processed Personal Data,  
c. In Which Business Processes and for What Purposes Personal Data is Used,  
d. Administrative and Technical Measures Taken to Ensure the Security of Personal Data,  
e. Transfer of Personal Data,  
f. Retention Periods and Destruction Methods of Personal Data,  
g. Rights of Relevant Persons.

a) Methods and Legal Grounds for Collecting Personal Data

Your Personal Data; in any verbal, written, or electronic medium; through technical and other methods, are collected to fulfill legal obligations and to carry out commercial activities, as specified in this Clarification Text. Your personal data is processed by our company or by data processors appointed on behalf of our company. Your personal data is processed under the conditions defined in Articles 5 and 6 of Law No. 6698:

- When it is explicitly prescribed by law,
- When it is directly related to the establishment or execution of a contract,
- When it is necessary for the data controller to fulfill its legal obligations,
- When you have made the data public,
- When processing is necessary for the establishment, exercise, or protection of a right,
- When processing is necessary for the legitimate interests of the data controller, provided that it does not violate the fundamental rights and freedoms of the data subject.

Your personal data may be collected during your visits to our website, during membership/account creation and account update processes, when you fill out a form on our website, when you purchase or sell products and services, during customer support processes (call center), in communications where you act as a buyer/seller, through Cookies created by our site, through site usage measurement systems (e.g., Google Analytics), through notifications from administrative and judicial authorities, through contracts, documents related to commercial activities, and other documents declared by the relevant person, in any verbal, written, and electronic environment; through technical and other methods. Your personal data may be collected by automatic or non-automatic methods.

b) Categorization of Data Subject Groups and Processed Personal Data

- Potential Product or Service Buyers,
- Product or Service Recipients and Employees,
- Employees of Our Suppliers,
- Authorized Representatives of Our Suppliers,
- Members of the Board of Directors,
- Our Shareholders

c) In Which Business Processes and for What Purposes Personal Data is Used

POTENTIAL PRODUCT AND SERVICE BUYERS (WEBSITE VISITORS):
- Conducting Information Security Processes
- Management of Access Authorities
- Following and Conducting Legal Affairs
- Conducting Product/Service Sales Processes
- Conducting After-Sales Support Services
- Conducting Communication Activities
- Responding to Information Requests
- Conducting Marketing and Analysis Studies
- Conducting Product and Service Marketing Processes
- Managing Customer Relationship and Satisfaction Processes
- Conducting Strategic Marketing Activities
- Conducting Retention and Archiving Activities
- Conducting Risk Management Processes
- Following Requests and Complaints
- Ensuring Operational Security of the Data Controller
- Conducting Product and Service Marketing Processes

PRODUCT OR SERVICE RECIPIENTS AND GUARDIANS/REPRESENTATIVES (REGISTERED MEMBERS):
- Conducting Information Security Processes
- Management of Access Authorities
- Conducting Activities in Accordance with the Legislation
- Conducting Finance and Accounting Processes
- Following and Conducting Legal Affairs
- Conducting Communication Activities
- Conducting Product/Service Purchasing Processes
- Conducting Product/Service Sales Processes
- Conducting After-Sales Support Services
- Conducting Product, Service, Production, and Operation Processes
- Managing Customer Relationship Processes
- Conducting Customer Satisfaction Activities
- Conducting Marketing and Analysis Studies
- Conducting Advertising Campaigns and Promotion Processes
- Conducting Risk Management Processes
- Conducting Retention and Archiving Activities
- Conducting Contract Processes
- Following Requests and Complaints
- Conducting Product and Service Marketing Processes
- Ensuring Operational Security of the Data Controller
- Providing Information to Authorized Persons, Institutions, and Organizations
- Conducting Management Activities

SUPPLIER EMPLOYEES:
- Conducting Finance, Accounting, and Purchasing Activities
- Management of Access Authorities
- Conducting Information Security Processes
- Conducting Activities in Accordance with the Legislation
- Conducting Retention and Archiving Activities
- Following and Conducting Legal Affairs
- Conducting Business Activities/Monitoring
- Conducting Product/Service Purchasing Processes
- Conducting Product/Service Sales Processes
- Conducting After-Sales Support Services
- Conducting Product, Service, Production, and Operation Processes
- Conducting Supply Chain Management Processes
- Conducting Communication Activities
- Conducting Contract Processes
- Conducting Information Security Processes
- Providing Information to Authorized Persons, Institutions, and Organizations

SUPPLIER REPRESENTATIVES:
- Conducting Finance, Accounting, and Purchasing Activities
- Management of Access Authorities
- Conducting Information Security Processes
- Conducting Activities in Accordance with the Legislation
- Conducting Retention and Archiving Activities
- Following and Conducting Legal Affairs
- Conducting Business Activities/Monitoring
- Conducting Product/Service Purchasing Processes
- Conducting Product/Service Sales Processes
- Conducting After-Sales Support Services
- Conducting Product, Service, Production, and Operation Processes
- Conducting Supply Chain Management Processes
- Conducting Communication Activities
- Conducting Contract Processes
- Conducting Information Security Processes
- Providing Information to Authorized Persons, Institutions, and Organizations

SHAREHOLDER/PARTNER:
- Conducting Information Security Processes
- Management of Access Authorities
- Conducting Finance, Accounting, and Purchasing Activities
- Conducting Business Activities/Monitoring
- Conducting Product/Service Purchasing Processes
- Conducting Product, Service, Production, and Operation Processes
- Conducting Organization and Event Management
- Conducting Contract Processes
- Conducting Supply Chain Management Processes
- Providing Information to Authorized Persons, Institutions, and Organizations

d) Administrative and Technical Measures Taken Regarding the Security of Personal Data

As KOPAZAR.COM, we attach the utmost importance to taking the administrative and technical measures determined within the framework of the relevant legislation, the decisions of the Personal Data Protection Board, and the Law No. 6698 in the processes of processing your personal data.

KOPAZAR.COM, by taking the necessary administrative and technical measures, prevents unauthorized access to personal data, illegal processing, disclosure, alteration, or destruction of personal data from internal or external sources. KOPAZAR.COM takes the following administrative and technical measures while processing personal data.

Administrative Measures Implemented:
- Preparation of Personal Data Inventory
- Corporate Policies (Access, Information Security, Usage, Retention, Destruction, etc.)
- Contracts (between Data Controller and Data Controller, Data Controller - Data Processor)
- Confidentiality Commitments
- Internal Periodic and/or Random Audits
- Employment Contracts, Disciplinary Regulations (Adding Lawful Provisions)
- Corporate Communication (Crisis Management, Board and Relevant Person Information Processes, Reputation Management, etc.)
- Training and Awareness Activities (Information Security and Law)
- Notification to the Data Controllers Registry Information System (VERBİS)

Technical Measures Implemented:
- Authority Matrix
- Authority Control
- Access Logs
- User Account Management
- Network Security
- Application Security
- Penetration Testing
- Attack Detection and Prevention Systems
- Log Records
- Data Loss Prevention Software
- Backup
- Firewall
- Up-to-Date Anti-Virus Systems
- Deletion, Destruction, or Anonymization

Despite the administrative and technical measures listed above, in the event of possible attacks on our servers resulting in damage to personal data or access by unauthorized third parties, KOPAZAR.COM will immediately notify you and the Personal Data Protection Board and take the necessary precautions.

e) Transfer of Personal Data

Our company may transfer your personal data collected for the purposes mentioned above to relevant parties within the scope of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK, as well as for the same purposes and legal obligations. Additionally, our company uses cloud technology, and all processed personal data is transferred to secure cloud systems of third-party companies. Our company may share your personal data with our domestic and international partners or joint ventures, public institutions and organizations authorized by law to request such data, our domestic or international institutions, suppliers, authorized dealers, and business partners with whom we have contractual agreements, ensuring adequate confidentiality and security measures. The nature of these transfers and the parties to whom the data is shared may vary depending on the nature of the relationship between the data subject and KOPAZAR.COM, the purpose of the transfer, and the relevant legal basis. Generally, these parties include:

• Business Units within KOPAZAR for Coordination, Collaboration, and Efficiency
• Research Firms for Customer Satisfaction, etc.
• Firms Providing Services for Conducting Marketing Activities
• Banks and Payment Institutions for Conducting Financial Transactions
• Real Persons or Private Legal Entities
• Domestic/International Companies Providing Cloud Technology Services
• Legal Entities Such as Law Firms and Institutions Providing Support in Legal Activities
• Our Business Partners
• Authorized Public Institutions and Organizations
• Our Suppliers

f) Retention Periods and Destruction Methods of Personal Data

The principles regarding the retention period of your personal data are as follows:

• If a period is determined in the applicable legislation to which the company activities are subject, the data is retained for at least the specified period.
• If a period is not specified in the applicable legislation, the data is retained for the period determined by the purposes of the data processing activity while adhering to the principles of Law No. 6698.

Your personal data is destroyed using deletion, destruction, and anonymization methods at the end of the specified periods.

g) Rights of Relevant Persons

As natural persons whose data is processed under Article 11 of the Law No. 6698, you may exercise your rights at any time by applying to us, including the following:

• Learning whether your personal data is processed,
• Requesting information if your personal data has been processed,
• Learning the purpose of processing personal data and whether it is used in accordance with its purpose,
• Knowing the third parties to whom personal data is transferred in the country or abroad,
• Requesting correction of personal data in case of incomplete or incorrect processing,
• Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
• Requesting notification of the actions taken under subparagraphs (d) and (e) of Article 11 of the Law to third parties to whom the personal data has been transferred,
• Objecting to the emergence of a result against the person by analyzing the processed data exclusively through automated systems,
• Requesting compensation in case of damage due to unlawful processing of personal data.

You can submit your requests regarding your personal data as listed above, as well as your requests related to the application of the Law, to us via support@kopazar.com using the electronic mail address you previously provided and registered in our system. Our company will resolve your requests, depending on their nature, as soon as possible and within thirty days at the latest, free of charge. However, if the request requires additional cost, a fee may be charged as determined by the Board.

Kind regards,