PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

As SOHO Retail Investment and Trade Inc. (“the Company”), we take the utmost care to ensure the protection and security of your personal data. With this in mind, we place great importance on ensuring that all personal data belonging to individuals associated with the Company—including those who use our products and services—is processed and stored in compliance with the Personal Data Protection Law No. 6698 (“PDPA”) and the European Union General Data Protection Regulation (GDPR), which entered into force on May 25, 2018. Fully aware of this responsibility, we process your personal data in the manner described below and within the limits prescribed by law, acting in the capacity of “Data Controller” as defined by the Law.

1. Data Controller, Data Processor, and Data Protection Officer

In accordance with the Personal Data Protection Law No. 6698 (“PDPA”) and as the data controller and data processor; and in accordance with the GDPR as the data processor, your personal data may be processed by the Company within the scope described below.

2. Collection, Processing, and Purpose of Processing of Personal Data

Your personal data is collected to enable our business units to carry out the necessary work to provide you with the products and services offered by our Company; to customize and recommend the products and services offered by our Company based on your preferences, usage habits, and needs; and to provide information about campaigns; to ensure the implementation of our Company’s human resources policies; to ensure the legal and commercial security of our Company and individuals with whom our Company has a business relationship; and to conduct our commercial activities within the framework of determining and implementing our Company’s commercial and business strategies, in accordance with the personal data processing conditions, principles, and purposes specified in Articles 5 and 6 of the Personal Data Protection Law and in Chapter II of the GDPR (Articles 5–11) of the GDPR.

In addition, your personal data may be processed when you use our call centers or website to access the services of the Company or our Group Companies, when you visit the Company or our website, when you participate in training sessions, seminars, or events organized by the Company, or when you apply for a job with the Company.

3. To Whom and for What Purposes Personal Data May Be Disclosed

Your personal data is collected to enable our business units to carry out the necessary work to provide you with the products and services offered by our Company; to customize and recommend the products and services offered by our Company based on your preferences, usage habits, and needs; and to ensure the legal and commercial security of our Company and individuals with whom our Company has a business relationship (administrative operations related to communication conducted by our Company, ensuring the physical security and oversight of Company locations, evaluation processes for business partners/customers/suppliers (authorized representatives or employees), reputation research processes, legal compliance processes, audits, financial affairs, etc.), For the purposes of determining and implementing our Company’s commercial and business strategies and ensuring the execution of our Company’s human resources policies, personal data may be transferred to our business partners, suppliers, Company officials, shareholders, legally authorized public institutions, and private individuals, in accordance with the personal data processing conditions and purposes specified in Articles 8 and 9 of the Personal Data Protection Law and in Chapter II of the GDPR (Articles 5–11) of the GDPR.

Customers who request electronic commercial communications in order to take advantage of special offers while shopping at our company’s stores are deemed to have consented to the sending of promotional information via electronic commercial communications by providing the verification code sent to them upon their request to the cashier. These data processing activities are based on the data subject’s explicit consent.

4. Method of Personal Data Collection and Legal Basis

Your personal data is collected in any form—whether oral, written, or electronic—for the purposes stated above, so that the products and services we offer can be provided within the established legal framework, and to enable our Company to fully and accurately fulfill its contractual and legal obligations in this regard. Your personal data collected for this legal basis may also be processed and transferred for the purposes specified in paragraphs (2) and (3) of this text, in accordance with the conditions and purposes of personal data processing set forth in Articles 5 and 6 of the KVK Law and in Chapter II of the GDPR (Articles 5–11).

5. Rights of the Data Subject Under Article 11 of Law No. 6698

As data subjects, if you submit requests regarding your rights to our Company using the methods outlined below in this Privacy Notice, our Company will process the request free of charge within thirty days at the latest, depending on the nature of the request. However, if the Personal Data Protection Board establishes a fee, the fee set forth in the tariff determined by our Company will be charged. In this context, data subjects have the right to:

• The right to inquire whether personal data has been processed,
• Request information regarding the processing of personal data if it has been processed,
• The purpose of the processing of personal data and whether such data is being used in accordance with that purpose,
• The right to know the third parties to whom personal data has been transferred, whether within the country or abroad,
• The right to request the correction of personal data if it has been processed inaccurately or incompletely, and to request that the third parties to whom the personal data has been transferred be notified of such correction,
• To request the erasure or destruction of personal data if the reasons necessitating its processing no longer exist, even if it was processed in accordance with the provisions of the Personal Data Protection Law and other relevant laws, and to request that this action be notified to third parties to whom the personal data has been transferred,
• The right to object to a decision made solely through the automated processing of personal data that adversely affects the individual,
• The right to request compensation for damages incurred as a result of the unlawful processing of personal data.

Pursuant to Article 13(1) of the Personal Data Protection Law, you may submit your request to exercise the rights listed above to our Company in writing or through other methods determined by the Personal Data Protection Board. Since the Personal Data Protection Board has not yet designated any such methods at this stage, you are required to submit your request to our Company in writing, as required by the Personal Data Protection Law. In this context, the channels and procedures for submitting your written requests to our Company under Article 11 of the Personal Data Protection Law are outlined below.

To exercise the rights listed above, please submit your request—which must include the necessary information to verify your identity and a statement specifying which of the rights outlined in Article 11 of the Personal Data Protection Law you wish to exercise—by filling out the APPLICATION FORM available at soho-application-form, and submit a signed copy of the form along with documents verifying your identity in person to the address ………………………………., via a notary public, or through other methods specified in Law No. 6698, with a secure electronic signature.