ER-BAL FOOD LTD. CO. GDPR INFORMATION TEXT AND PERSONAL DATA POLICY

Dear Customers, Potential Customers, and Website Visitors,

ER-BAL GIDA ARICILIK HAYVANCILIK ORGANİK TARIMSAL ÜRÜNLER ÜRETİM TİC. SAN. PAZ. LTD. ŞTİ. ("Erbal Gıda" or "the Company"), registered with the Erzurum Trade Registry Directorate under registration number 12909/18603 and MERSİS number 0338014842700001, located at Muratpaşa Mahallesi Saraybosna Caddesi No:32 Yakutiye / Erzurum, attaches great importance to the protection of your personal data as the "data controller" under the Law No. 6698 on the Protection of Personal Data ("KVKK"). We would like to inform you about the KVKK processes within our company, in accordance with the KVKK standards and legal regulations applied.

1. WHAT PERSONAL DATA IS PROCESSED UNDER THE KVKK (Turkish Personal Data Protection Law)?

A. As a General Visitor:

• Your contact information (basic communication records within the scope of the GDPR, such as address, email address, and phone number)

• Website usage details (Browsing activity on the site, preferences, pages visited, and products viewed)

• Identification and technical information (Cookie records, IP address, system access logs, GDPR technical process records)

B. Establishment of the Membership and Order Agreement:

• Your personal information (name, surname, date of birth, Turkish Republic Identity Number in accordance with KVKK - Personal Data Protection Law)

• Your contact information (Delivery address, billing address, email address, mobile and landline phone numbers)

• Your unique Username and Password

• Invoice and tax information (Turkish National ID Number, Tax ID Number, Tax Office, Company Name)

• Payment transaction data (Credit card data is transferred directly to the licensed payment processing institution in accordance with KVKK (Personal Data Protection Law) principles and is absolutely not stored within our Company; IBAN information in wire transfer/EFT transactions)

• Data regarding purchased products (Types of honey, pollen, propolis, fresh royal jelly, Pastdrops throat lozenges, functional herbal teas, extracts, food supplements, order price and date)

C. Within the Scope of Customer Relations:

• Service records provided by our company (Request, return, cargo damage inspection and GDPR request forms)

• Data from conversations, correspondence, and feedback received from our customer support teams.

D. Within the Scope of Electronic Commercial Communication Permission:

• Identity and contact information (Name, surname, telephone, email)

• Marketing essential information (shopping preferences, categories of interest, campaign and survey content subject to GDPR explicit consent)

2. PURPOSES OF PROCESSING YOUR PERSONAL DATA

Your personal data is processed in accordance with the applicable GDPR legislation for the following purposes:

General Objectives:

• When you contact our company, we will process your requests and complaints and contact you as necessary.

• To fully comply with our legal obligations, fulfilling all legal responsibilities, including data security under the Personal Data Protection Law (KVKK), towards judicial authorities and authorized public institutions.

• To be able to exercise our rights before consumer arbitration boards and courts in disputes arising from the contract,

• To ensure that system records can be distinguished from other customers and that you can easily benefit from after-sales service processes.

• Issuing invoices and fulfilling storage obligations under tax legislation and the Turkish Commercial Code,

• To ensure that payment and collection steps are carried out securely.

If you are a customer:

• Preparing, packaging (managing cold chain requirements such as royal jelly or fresh pollen), invoicing, and delivering orders placed through our website to the address via our contracted courier service.

• To ensure the improvement of our product quality and e-commerce services within the framework of the GDPR (Turkish Personal Data Protection Law).

If you consent to receive electronic messages:

• In accordance with KVKK (Personal Data Protection Law) regulations, general or personalized campaigns, promotions, benefits, and announcements may be communicated via SMS, email, or phone call.

3. METHOD AND LEGAL BASIS FOR COLLECTING PERSONAL DATA

Your data is collected by Erbal Gıda through automated or partially automated electronic methods via the website, membership forms, order processes, digital communication channels, and cookies.

The data collection processes are based on the following legal grounds included in the KVKK (Personal Data Protection Law) regulations:

• Data processing being necessary under the Personal Data Protection Law for the establishment or performance of the contract,

• The obligation to fulfill the legal and financial responsibilities to which our company is subject,

• Data processing is necessary under the Personal Data Protection Law (KVKK) for the establishment, exercise, or protection of a right,

• Protecting our legitimate interests without prejudice to your fundamental rights,

• Your explicit consent under the Personal Data Protection Law (KVKK) is required for commercial communication and marketing activities.

4. TRANSFER OF YOUR PERSONAL DATA

Your personal data will be processed only within the scope of corporate GDPR security standards;

• We contract with cargo and transportation companies to ensure the delivery of orders,

• To ensure secure payments, we use licensed payment institutions and banks.

• To IdeaSoft and our IT business partners from whom we receive e-commerce software and server infrastructure support,

• In accordance with legal notification obligations, data is transferred to authorized judicial and administrative public institutions in compliance with the principles of the Personal Data Protection Law (KVKK).

5. DATA SECURITY AND DESTRUCTION

Erbal Gıda takes the necessary technical and administrative measures in accordance with the Turkish Personal Data Protection Law (KVKK) to ensure data security. Your data is protected with SSL encryption. Once the legal retention periods expire, your data will be deleted, destroyed, or anonymized in accordance with KVKK data destruction policies.

6. YOUR RIGHTS UNDER THE LAW

You can apply to the data controller regarding your rights under Article 11 of the KVKK (Personal Data Protection Law);

• To find out whether your personal data is being processed,

• If your data has been processed, you have the right to request information regarding this processing in accordance with the KVKK (Personal Data Protection Law).

• To learn the purpose of data processing and whether it is being used appropriately for that purpose.

• Knowing the third parties to whom data is transferred, whether domestically or internationally.

• Requesting the correction of incomplete or incorrectly processed data,

• Requesting the deletion or destruction of data within the framework of the conditions stipulated in the relevant legislation,

• Requesting that correction and deletion operations be notified to third parties to whom the data has been transferred.

• Object to an unfavorable outcome resulting from analysis by automated systems.

• If you suffer damages due to an unlawful act, you have the right to claim compensation for those damages in accordance with the Personal Data Protection Law (KVKK).

APPLICATION AND DATA CONTROLLER CONTACT INFORMATION:

You can submit your requests in writing, in accordance with the relevant GDPR application procedures, or by sending an email to info@erbalgida.com from your registered email address in our system.

Company Name: ER-BAL FOOD BEEKEEPING LIVESTOCK ORGANIC AGRICULTURAL PRODUCTS PRODUCTION TRADE INDUSTRY MARKETING LTD.

MERSIS No: 0338014842700001

Trade Registry Number: 12909 / 18603

Address: Muratpaşa Mah. Saraybosna Cad. No:32 Yakutiye / Erzurum

Email: info@erbalgida.com

Phone: 0442 233 13 15 / 0532 608 43 20

Website: www.erbalgida.com