HAFIZLAR GIDA İÇ VE DIŞ TİCARET A.Ş.

DISCLOSURE STATEMENT ON THE USE AND PROCESSING OF PERSONAL DATA

This Disclosure Statement contains information about the personal data processing activities carried out by Hafızlar Gıda İç ve Dış Ticaret A.Ş. (“Hafızlar Gıda”) as data controller pursuant to Law No. 6698 on the Protection of Personal Data (the “Law”), and constitutes the ‘Disclosure Statement’ required for the processing of personal data.

1. Purpose and Scope of the Statement

Within the scope of this Privacy Notice, Hafızlar Gıda İç ve Dış Ticaret Anonim Şirketi and the “Hacı İsmail Hakkızade Hafız Mustafa 1864” brand explain, in a simple and transparent manner, which personal data we collect and how, how it is recorded, stored and used, the legal grounds and purposes of processing, the parties to whom it is transferred and the purposes of such transfer, and the rights you have regarding your personal data under the Law.

This disclosure statement covers the employees of Hafızlar Gıda, job candidates who have submitted their CVs to Hafızlar Gıda for employment purposes, and natural persons who are customers of Hafızlar Gıda;

and natural persons who are not customers of Hafızlar Gıda but who visit our Hafızlar Gıda branches for various reasons, or who visit our website at "hafizmustafa.com".

1. Method and Legal Basis for the Collection of Personal Data

Law No. 6698 on the Protection of Personal Data constitutes the legal basis for the processing of the personal data collected and processed pursuant to this disclosure statement. In this context, the personal data collected will be processed in accordance with the criteria set out in Articles 5 and 6 of the Law.

The collection of data takes place as follows;

1. For Hafızlar Gıda employees, during their activities at the workplace, production facilities and branches,
2. For job candidates who have submitted their CVs to Hafızlar Gıda, through the CVs they have submitted,
3. For Hafızlar Gıda customers, during their purchases at the branches and through their purchases of products manufactured by Hafızlar Gıda from Hafızlar Gıda branches and authorized dealers,
4. Through the Hafızlar Gıda website, or during telephone conversations with Hafızlar Gıda,

data is collected. Furthermore, with respect to all data subjects, the data collected may also be transmitted by data controllers who are in a business partnership with Hafızlar Gıda and who operate branches on behalf of Hafızlar Gıda.

1. Purpose of Collecting Personal Data and Data Retention Period

The personal data collected from data subjects is collected in order to be processed for the purposes set out below;

1. Management and administration of employment,
2. Ensuring compliance with mandatory corporate procedures,
3. Establishment or performance of a contract/employment relationship,
4. Enabling our Company to fulfil its obligations under employment and applicable legislation,
5. Solely where you have given your explicit consent in this context, for promotional purposes (e.g. publishing your images/videos on the Company's social media account),
6. Where the processing of data is mandatory for the establishment of a right,
7. Where it is necessary to process your personal data to ensure the security of our Company or for the legitimate purposes of our Company,
8. Carrying out the procedures required for your employment with the Company, and preparing your personnel file,
9. Carrying out human resources and administrative operations,
10. Carrying out operations related to employee benefits and entitlements.
11. Product development, quality management and determining customers' product preferences,
12. Creating consumption statistics regarding customers,
13. Preparing statistics and data regarding the customer portfolio,
14. Developing branches, authorized dealers and the website and making them available to customers,
15. Transferring data that will be beneficial for our business partners' own activities, to the extent permitted by legislation,
16. Sharing data with our foreign business partners to the extent permitted by law,

Personal data collected for these purposes will be processed by us, as the data controller, for as long as it serves the purpose. Where the collected data no longer serves the purpose, it will be anonymized, irreversibly deleted or destroyed.

Data Retention Periods

The personal data collected is retained for the periods specified below. At the end of these periods, your data is securely deleted, destroyed or anonymized.

| Data Type | Retention Period | Legal Basis / Explanation |
| --- | --- | --- |
| Name, surname, contact information | Starting from the end of the service/membership relationship: 10 years | Turkish Code of Obligations, Turkish Commercial Code – statute of limitations period |
| Invoice and payment information | 5 years | Tax Procedure Law |
| Order and delivery information | 10 years | Commercial record-keeping obligation |
| Customer service correspondence and support records | 1 year | Burden of proof and customer satisfaction processes |
| Commercial electronic message consent (marketing permissions) | Until consent is withdrawn | Law No. 6563 |
| Cookie data | Up to 2 years | User preferences and site performance measurement |
| Membership account data | For as long as the membership continues; after termination, 3 months | KVKK Art. 7 – data minimization principle |
| Employee personnel file and payroll data | Starting from the termination of the employment relationship: 10 years | Labor Law, Social Security Legislation |

1. Nature of the Personal Data Collected

1. Identity data: Name-surname, date and place of birth, identification number, e-mail address, phone number, title, nationality, signature specimen, and tax number.
2. Visual data: Image/video data collected within our branches and workplaces for security and product development purposes.
3. Audio data: Call recordings and voice data from telephone communications established with Hafızlar Gıda and conversations conducted with call centers.
4. Data related to online behavior and preferences: The IP address of the mobile device or computer, and the pages visited on Hafızlar Gıda's websites and applications.
5. Financial data: Financial data such as payroll records and salary account information belonging to Hafızlar Gıda employees. Data relating to Hafızlar Gıda customers' payment instruments, payment instrument preferences, and payment behaviors.
6. Special categories of personal data: Special categories of personal data such as health data, fingerprints and ethnic origin, provided that your explicit consent is obtained or where expressly provided for by law.

1. Sharing and Transfer of Personal Data

The transfer of your personal data to our business partners, to persons who operate branches on behalf of Hafızlar Gıda and sell Hafızlar Gıda products, and to our business partners established abroad, is carried out in accordance with the provisions set out under Law No. 6698. Pursuant to these provisions, your data;

• May be transferred to Hafızlar Gıda's affiliates/business partners, limited to ensuring the fulfilment of our Company's founding purposes;
• May be transferred to Hafızlar Gıda and its Affiliates and suppliers, limited to ensuring that the services our Company outsources from suppliers and that are necessary for carrying out our Company's commercial activities are provided to our Company,
• May be transferred to Hafızlar Gıda and its Affiliates, limited to ensuring the conduct of our Company's commercial activities that require the involvement of its affiliates,
• May be transferred to our affiliates, consultants and service providers, limited to the purposes of designing strategies relating to our Company's commercial activities, risk management, financial consolidation, audit, and compliance with Hafızlar Gıda's corporate policies,
• May be transferred to the Shareholders of Hafızlar Gıda and its Affiliates, limited to the purposes of designing strategies relating to our Company's commercial activities and audit, in accordance with the relevant legislative provisions,
• May be transferred to legally authorized public institutions and organizations, limited to the purpose requested within the legal authority of the relevant public institutions and organizations,
• May be transferred to legally authorized private law entities, limited to the purpose requested within the legal authority of the relevant private law entities,

is processed by Hafızlar Gıda in a manner that allows it to be shared as set out above. Where the transfer of your personal data to any of the parties listed above constitutes a transfer of data abroad, such data transfer is carried out in accordance with the principles set out in Article 9 of the Law.

1. Protection of Personal Data

As Hafızlar Gıda, appropriate technical and organizational measures (policies and procedures, Information Technology Security, etc.) are taken while processing your personal data and to ensure the confidentiality and integrity of such personal data. In order for your personal data to be stored securely, a minimum internal framework relating to policies and minimum standards is applied throughout Hafızlar Gıda. Legislative and market developments are monitored, and in light of these developments, Hafızlar Gıda's policies and standards are also updated periodically.

1. Rights of Data Subjects and Methods of Exercising These Rights

You have certain rights where your personal data is processed. In this context, you have the following rights under Law No. 6698 on the Protection of Personal Data:

1. The right to learn whether your personal data is processed and to request further information about such processing;
2. The right to learn the reason for the processing of your data and whether it is used in accordance with its intended purposes;
3. The right to know to whom your data is transferred (third parties, domestic or abroad); the right to request the correction of your data that has been processed incompletely or incorrectly;
4. The right to request the deletion or destruction of your personal data;
5. The right to request that third parties to whom your personal data has been transferred be notified of the deletion or destruction of such data in the event it has been processed incompletely or incorrectly;
6. The right to object to any outcome that is unfavorable to you resulting from an analysis carried out exclusively through automated processes;
7. The right to request compensation for damages suffered due to the unlawful processing of your personal data.

To exercise your rights or to submit your complaints regarding the personal data processing policy, you may submit your requests by e-mail to "hafiz.mustafa@hs01.kep.tr", or in writing to the address "HOCAPAŞA MAH. MURADİYE CAD. SAF HAN NO.25 B FATİH/İSTANBUL". Your application will be concluded within the maximum period of 30 days specified in the Law, and a response will be provided to you.

Hafızlar Gıda İç ve Dış Ticaret A.Ş.

MERSIS No: 0454060410000001

Tax ID No: 4540604100 / Hocapaşa Tax Office

Trade Registry No: 760331-0 / Istanbul Trade Registry Directorate

Address: Hocapaşa Mah. Muradiye Cad. Saf Han No:25B Fatih / İstanbul