Personal Data Processing Notice (KVKK)

This notice is given under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform people who visit, register on, order from or contact us through the website https://www.herbaltox.com (the "Site") about the processing of their personal data. The Site's general data practices are described in the Privacy Policy and its use of cookies in the Cookie Policy. 1. Data Controller Your personal data are processed by the following business as data controller: Trade name: Herbaltox Gıda Limited Şirketi MERSIS No: 0461118064300001 Address: Atatürk Mahallesi İrfan Sokak No:10/A, 34764 Ümraniye, İstanbul, TR Email: info@herbaltox.com Phone: +90 216 606 18 79 Registered electronic mail (KEP): herbaltoxgida@hs01.kep.tr 2. Categories of Personal Data Depending on how you use the Site, we may process personal data in the following categories: - Identity: first and last name; Turkish ID number where the law requires it for an invoice; company name for business purchases. - Contact: email address, phone number, delivery and billing address. - Customer transaction: order number and contents, order date, amounts, basket, return, exchange and withdrawal requests, invoice details, tax office and tax number. - Financial: payment method, payment result and transaction number, the masked part of the card, IBAN given for a refund. We do not store the full card number or security code; they are processed by the payment institution. - Transaction security: IP address, session and sign-in records, an irreversible hash of your password, device and browser information, security and error logs. - Marketing: consent to commercial electronic messages and its record, contact preferences and, if you consent, usage data collected through non-essential cookies. - Request and complaint management: the content of questions, requests and complaints you send us and our replies. - Legal transactions: correspondence with authorities and information on disputes and applications. We do not process special categories of personal data (health, religion, biometric data and the like); please do not share such data with us in order notes or messages. 3. Purposes and Legal Grounds Your personal data are processed for the purposes below, on the legal grounds of KVKK Art. 5 and Art. 6 stated against each: - Creating and managing your account: necessity for concluding or performing a contract (Art. 5(2)(c)). - Taking orders, collecting payment, delivering products and handling returns, exchanges and withdrawals: concluding or performing a contract (Art. 5(2)(c)). - Issuing invoices, keeping accounting records, keeping the records required by consumer and e-commerce law, answering competent authorities: being expressly provided for by law and compliance with our legal obligations (Art. 5(2)(a) and Art. 5(2)(ç)). - Sending informational messages about your orders and account: performing a contract (Art. 5(2)(c)). - Customer service and answering requests and complaints: performing a contract (Art. 5(2)(c)) and our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5(2)(f)). - Keeping the Site and transactions secure, preventing fraud and abuse, monitoring errors and performance: legal obligation (Art. 5(2)(ç)) and legitimate interest (Art. 5(2)(f)). - Establishing, exercising or defending rights in legal disputes: necessity for establishing, exercising or protecting a right (Art. 5(2)(e)). - Sending commercial electronic messages such as campaigns, discounts and newsletters, personalising content to your preferences, and using non-essential analytics and marketing cookies: your explicit consent (Art. 5(1)). As no special categories of data are processed, no processing relies on the conditions of Art. 6; should such processing become necessary, it will be carried out only under the conditions of Art. 6 and this notice will be updated. You may withdraw consent given for consent-based processing at any time; withdrawal does not affect the lawfulness of earlier processing. 4. Method of Collection Your personal data are collected by automated or partly automated means through the Site's registration, order, payment, contact and newsletter forms and through cookies and similar technologies, and verbally, in writing or electronically when you contact us by email, phone or customer service channels. Payment results are received electronically from payment institutions and delivery status from carriers. Your data are collected on the legal grounds stated in section 3. 5. Transfers of Personal Data To the extent required by the purposes in section 3 and in line with KVKK Art. 8, your personal data may be transferred to the following groups of recipients: - Payment institutions and banks: to take and refund payments and prevent fraud. - Carriers and logistics companies: to deliver and return products. - E-invoice / e-archive service providers and the Turkish Revenue Administration: to issue invoices and comply with tax law. - Email and SMS service providers and the Message Management System (İYS): to send informational and consented commercial messages and keep consent records. - Hosting, infrastructure, backup and software providers: to operate and protect the Site and data. - Legal, accounting and audit advisers: to meet legal and financial obligations. - Competent public authorities and courts: under legal requests and obligations. Your personal data are not sold and are not shared with third parties beyond the purposes above. Our service providers are bound by contracts requiring them to process your data only on our instructions and with appropriate security measures. 6. Transfers Abroad Some of our providers of email delivery, hosting, analytics or payment infrastructure may have servers outside Türkiye. Personal data are transferred abroad only under the conditions of KVKK Art. 9: an adequacy decision for the country, sector or international organisation; where there is none, one of the appropriate safeguards such as standard contractual clauses announced by the Personal Data Protection Board or binding corporate rules; or, where neither exists and only occasionally, your explicit consent after being informed of the possible risks or one of the other exceptional cases listed in the law. Transfers based on standard contractual clauses are notified to the Personal Data Protection Authority within the period set by law. 7. Commercial Electronic Messages Commercial electronic messages (email, SMS, calls) containing campaigns, discounts, new products and newsletters are sent only with your consent under Turkish Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. Your consent and any opt-out are recorded in the Message Management System (İYS). You may withdraw your consent at any time, without giving a reason and free of charge, through the opt-out link in each message, through İYS's own channels or by writing to info@herbaltox.com. Informational messages about orders, delivery and account security are not commercial electronic messages and may be sent regardless of your consent. 8. Retention Your personal data are kept for as long as the purpose of processing requires and until the end of the retention periods set by law (for example the periods for keeping books and records under tax and commercial law, the record-keeping periods under consumer and e-commerce law, and limitation periods). When the period ends, your data are deleted, destroyed or anonymised. If you close your account, your data are deleted except for the records the law requires us to keep. 9. Your Rights Under KVKK Art. 11 you have the right, by applying to the data controller, to: a) learn whether your personal data are processed, b) request information if they have been processed, c) learn the purpose of processing and whether the data are used accordingly, d) know the third parties in Türkiye or abroad to whom your data are transferred, e) request correction of incomplete or inaccurate data, f) request deletion or destruction of your data under the conditions of KVKK Art. 7, g) request that corrections, deletions or destructions be notified to the third parties to whom your data were transferred, h) object to a result against you arising from analysis of your data exclusively by automated systems, i) claim compensation if you suffer damage from unlawful processing of your data. 10. How to Apply 10.1 Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send requests concerning your rights: - in person or through a notary with a wet-signed letter to Atatürk Mahallesi İrfan Sokak No:10/A, 34764 Ümraniye, İstanbul, TR, - to the KEP address herbaltoxgida@hs01.kep.tr with a secure electronic or mobile signature, - from the email address you have previously given us and which is registered in our system, to info@herbaltox.com. 10.2 Your application must state your name and surname and, if written, bear your signature; your Turkish ID number or, for foreign nationals, your nationality and passport or ID number; your residential or business address for notification; your email address for notification, if any; your phone number; and the subject of your request. We may ask for additional information to verify your identity. 10.3 Your application is concluded free of charge as soon as possible according to its nature and within thirty days at the latest. If the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. 10.4 If your application is rejected, you find the answer insufficient or no answer is given in time, you may complain to the Personal Data Protection Board under KVKK Art. 14 within thirty days of learning the answer and in any case within sixty days of your application. 11. Changes This notice may be updated to reflect changes in our processing activities or in the law. The current text is always published on the Site; its version number and date appear below. Herbaltox Gıda Limited Şirketi Document version: 1 — Date: 2026-11-01