PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

As Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi (the “Company”), we work to protect the privacy of our members who use our site in order to ensure that our users benefit from our services in a safe and complete manner.

This Privacy Notice (the “Privacy Notice”) has been prepared to inform you about your personal data processed through the website www.thevixi.com (the “Site”) operated by the Company and by the other methods specified below. We are extremely sensitive about the security of the personal data of our valued users (the “User”).

As the Company, we attach great importance to processing and preserving every kind of personal data belonging to our Users in the best and most careful manner possible. Being aware of this responsibility, we process your personal data within the framework set out below, in accordance with the Personal Data Protection Law No. 6698 (the “KVKK”) and the relevant legislation, with the aim of protecting fundamental rights and freedoms, in particular the privacy of private life.

1. Data Controller

The Company processes your personal data in the capacity of “Data Controller” as defined in Article 3 of the Law. Within the framework of the regulations introduced by the Personal Data Protection Law No. 6698 (the “KVKK”), we would like to inform you, our valued Users, in our capacity as Data Controller, about how personal data is recorded, processed, and the purpose of processing.

Data Controller:

Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi.

Address: Fenerbahçe Mahallesi İğrip Sokak Bina No:13 İç Kapı No:1 Kadıköy-İstanbul.

2. Personal Data Processed

The personal data processed by our Company are specified below:

Identity Information: First name, surname, date of birth, gender.

Contact Information: Information used to contact the individual; e-mail address, telephone number, mobile phone number, address.

Customer Information: Information belonging to customers who benefit from our products and services (e.g. customer number, occupation information, etc.).

Customer Transaction Information: Information regarding every kind of transaction carried out by customers who benefit from our products and services; requests and instructions, order and basket information, etc.

Transaction Security Information: Personal data processed to ensure the technical, administrative, legal, and commercial security of our Company and the relevant parties (e.g. information such as website passwords and credentials that match the data subject with the transaction associated with them and show that the person is authorized to perform that transaction); personal data processed to enable our Company to manage its commercial, technical, and administrative risks (e.g. your device information, IP address information, your passwords and credentials, your cookie information, platform access logs).

Financial Information: Where necessary, your bank account information so that refunds can be made to your bank account during return processes, and your invoice information; in addition, if you are a taxpayer, certain additional invoice information (national ID/tax number, sole proprietorship information).

3. Purposes, Legal Grounds, and Collection Methods of Processing Personal Data

Your personal data will be processed by the Company within the personal data processing conditions and purposes specified in Articles 4, 5, and 6 of the KVKK, in accordance with the law, morality, and the rule of good faith; in an accurate, up-to-date, and legitimate manner.

For the purposes specified below but not limited to them, and through automated or non-automated methods; via the Company's units, offices, the Site, the call center, social media channels, Applications, mobile applications, and similar means, verbally, in writing, or electronically; without exceeding the maximum statutory periods, your data may be subject to recording, storage, retention, preservation, processing, making available, use, updating, modification, merging, reorganization, classification, disclosure, sharing, transfer, and other processing operations provided for in personal data legislation in domestic or foreign written/magnetic archives for a period to be foreseen in accordance with the purpose of processing depending on the nature of the information. In this scope, we would like to explain in detail the data we process.

a- Membership and Account Creation Process

Personal data processed in this category: Your user account information, your customer transaction information, your transaction security information.

Purposes:

• Carrying out the processes for the establishment and performance of the membership agreement,

• Managing the processes of creating and closing the Platform member profile/account,

• Verifying contact information,

• Carrying out activities for the execution of your purchase transactions via the Platform,

• Conducting and auditing the Company's business activities,

• Ensuring the security of Platform operations,

• Fulfilling the obligations arising from the legislation to which our Company is subject, in particular Law No. 6563 on the Regulation of Electronic Commerce, the Turkish Commercial Code No. 6102, the Turkish Penal Code No. 5237, and the Law No. 6502 on Consumer Protection,

• Carrying out Platform activities in compliance with the legislation,

• Fulfilling our data sharing and retention obligations by our Company in accordance with our obligations arising from the legislation.

Legal Grounds: Being expressly provided for in laws, being mandatory for the fulfillment of our Company's legal obligations, being necessary for the performance of the membership agreement between us.

b- Order, Delivery, and Cancellation/Return Processes

Personal data processed in this category: Your user account information, your delivery information, your customer transaction information, your payment information, your transaction security information.

Purposes:

• Placing the order and creating the order,

• Establishing and ensuring the performance of the distance sales agreement,

• Carrying out delivery and logistics activities,

• Carrying out cancellation/return processes,

• Carrying out payment and invoicing processes,

• Fulfilling the legal obligations specified in the legislation to which our Company is subject and/or in the decisions, guides, and guidelines published by the competent authorities, in particular the Regulation on Distance Contracts and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce,

• Carrying out the purchase processes of the product/service groups on the Platform.

Legal Grounds: Being mandatory for the fulfillment of our Company's legal obligations, being necessary for the performance of the membership agreement between us.

c- Customer Experience Improvement Processes

Personal data processed in this category: Your user account information, your customer transaction information, your delivery information, your transaction security information, your legal transaction information,

• Developing and improving our user experience,

• Improving our service quality,

• Carrying out analysis and reporting work,

• Carrying out communication activities,

• Evaluating requests, complaints, and suggestions regarding our products and services,

• Carrying out after-sales support services for goods and services.

Legal Grounds: Being necessary for the performance of the membership agreement between us, being mandatory to process data for the legitimate interests of our Company.

d- The Company's Information Security, Risk, Audit, and Control Processes

Personal data processed in this category: Your user account information, your customer transaction information, your delivery information, your payment information, your transaction security information.

Purposes:

• Carrying out and auditing finance and accounting processes,

• Carrying out invoicing processes,

• Carrying out information security processes and conducting investigations into suspicious transactions,

• Ensuring the security of operations regarding the Platform,

• Controlling, developing, and improving the quality of the products and services offered by our Company,

• Conducting risk detection and analysis, carrying out complaint management,

• Preventing fraud,

• Carrying out our Company's legal and financial due diligence activities in possible company mergers, acquisitions, joint ventures, demergers, and other structural changes.

Legal Grounds: Being necessary for the performance of the membership agreement between us, being mandatory to process data for the legitimate interests of our Company.

e- Conduct of Legal Proceedings Process

Personal data processed in this category: Your user account information, your customer transaction information, your delivery information, your payment information, your transaction security information, your legal transaction information.

Purposes:

• Conducting legal and litigation matters, responding to your legal requests, examining and responding to your duly made applications as a data subject,

• Conducting activities in compliance with the legislation, fulfilling the obligations arising from the legislation to which our Company is subject,

• Carrying out legal consultancy processes,

• Sharing information with authorized persons, institutions, and organizations upon request,

• Exercising and protecting a right in the event of a legal dispute.

Legal Grounds: Being mandatory to process data for the establishment, exercise, or protection of a right, being mandatory for the fulfillment of our Company's legal obligations.

f- Processes Carried Out Based on Explicit Consent

Personal data processed in this category: Your user account information, your customer transaction information, your delivery information, your payment information.

Purposes:

f- Carrying out marketing, advertising, and promotion activities,

g- Carrying out financial offer processes,

h- Offering you advantageous, personalized offers, carrying out activities aimed at increasing your satisfaction by getting to know you better, and sending commercial electronic messages within this scope.

Legal Ground: The existence of your explicit consent.

4. Transfer of Personal Data

Our Company takes care to process your personal data in accordance with the principles of "need to know" and "need to use,"

by ensuring the necessary data minimization and taking the necessary technical and administrative security measures.

Your personal data is shared domestically with the recipient groups specified in detail below, by our Company pursuant to Article 8 of the KVKK, on the legal grounds of

“being expressly provided for in laws, being mandatory for the fulfillment of our Company's legal obligations,

being necessary for the establishment or performance of the agreement, being mandatory to process data for the establishment,

exercise, or protection of a right, and/or being mandatory for the legitimate interest of our Company.”

In cases where your personal data is transferred abroad by our Company, it is shared with the recipient groups specified in detail below, on the legal grounds of “the provision of appropriate safeguards through a standard contract, or, on an incidental basis, the existence of one of the situations regulated in paragraph 6 of Article 9 of the KVKK,” as regulated in Article 9 of the KVKK and in the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad.

i. Membership and Account Creation Process

• Your personal data is shared with our affiliates and group companies for the purposes of enabling you to benefit from the Platform Services within the scope of the services we receive regarding the Platform pursuant to our contractual relationship, and the establishment and performance of the membership agreement,

• It is shared with our service providers that provide our IT infrastructure and with our group companies located abroad for the purpose of carrying out Platform operations and obtaining IT, technology, and software services.

Legal Ground: Being necessary for the establishment or performance of the agreement, the provision of appropriate safeguards through a standard contract.

ii. Order, Delivery, and Cancellation/Return Processes

• Your data is shared with the seller of the product you wish to purchase or the service provider for the purposes of enabling you to benefit from the Platform Services, carrying out purchase and invoicing processes, and fulfilling the obligations arising from the legislation to which our Company and the seller from whom you purchase the product are subject,

• with the product seller, courier companies, and private couriers for the purpose of carrying out logistics activities and tracking delivery processes,

• with the banks we have agreements with and other payment institutions for the purpose of carrying out and tracking your payment processes,

• with our business partners from whom we receive bulk SMS / e-mail sending services for the purpose of informing you on matters such as the delivery of the product you purchased,

• In the event that you order a product from abroad, it is shared with cargo and logistics companies located abroad, the seller of the product you purchased, and customs consultancy companies for the purposes of carrying out order delivery and return processes, carrying out logistics and supply chain processes, carrying out customs processes, and carrying out Platform operations.

Legal Ground: Fulfillment of our Company's legal obligations, being necessary for the establishment or performance of the agreement, the provision of appropriate safeguards through a standard contract.

iii. Customer Experience Improvement Processes

• Your data is shared with service providers located abroad from whom services are received, and with our affiliates, group companies, business partners, and consultants that provide IT infrastructure, software, and technology services, in order to provide Platform services and carry out Platform operations, for the purposes of carrying out activities aimed at developing and improving the products and services offered by our Company.

Legal Ground: Being necessary for the establishment or performance of the agreement, the provision of appropriate safeguards through a standard contract, on an incidental basis the existence of one of the situations regulated in paragraph 6 of Article 9 of the KVKK.

iv. The Company's information security, risk, audit, and control processes

• Your data is shared with our business partners, consultants, and service providers, banks, e-invoice business partner, cargo and courier companies, private integrator, independent audit, customs, and our business partners providing certified public accountant/accounting services for the purposes of carrying out invoicing processes, sending the e-invoice electronically to the customer, delivering physical agreements or invoices, managing financial and accounting processes, detecting and assessing risks, and preventing fraud,

• with our business partners providing independent audit, customs, certified public accountant/accounting services, our community companies, affiliates, group companies, private integrators, technology companies, our business partners, and our service-providing suppliers for the purposes of ensuring the security of Company operations, controlling and improving the quality of the products and services offered by our Company, and conducting risk detection and analysis,

• with potential buyers, sellers, or other parties to the transaction and their employees, consultants under confidentiality obligations, and database service providers involved in the relevant process for the purpose of carrying out our Company's legal and financial due diligence activities in possible company mergers, acquisitions, joint ventures, demergers, and other structural changes.

Legal Grounds: Fulfillment of our Company's legal obligations, being necessary for the establishment or performance of the agreement, being mandatory for the legitimate interest of our Company.

v. Conduct of Legal Proceedings Process

• Your data is shared with regulatory and supervisory authorities and competent public institutions and organizations such as courts and enforcement offices, mediators, for the purposes of fulfilling the obligations arising from the legislation to which our Company is subject and carrying out Platform activities in compliance with the legislation, providing information to authorized persons, institutions, and organizations, following up and conducting legal matters, and exercising and protecting a right in the event of a legal dispute,

• with lawyers, auditors, tax advisors, forensic IT experts, cybersecurity consultants, tax advisors, our community companies, affiliates, and other third parties and business partners from whom we receive consultancy and services, for the purposes of carrying out our Company's audit activities, carrying out legal consultancy processes, ensuring the security of Company operations, and conducting investigations into suspicious transactions,

• with authorized public institutions and organizations for the purposes of providing information to authorized persons, institutions, and organizations abroad upon request, and exercising and protecting a right in the event of a legal dispute.

Legal Grounds: Being expressly provided for in laws, fulfillment of our Company's legal obligations, being processed for the establishment, exercise, or protection of a right, being necessary for the establishment or performance of the agreement, on an incidental basis the existence of one of the situations regulated in paragraph 6 of Article 9 of the KVKK.

vi. Processes Carried Out Based on Explicit Consent:

• Your data is shared with service providers and business partners for the purposes of carrying out marketing, advertising, and promotion activities, offering you advantageous, personalized offers, and carrying out activities aimed at increasing your satisfaction by getting to know you better.

Legal Ground: The existence of your explicit consent.

5. Your Rights Under the Law as a Personal Data Subject

In relation to your processed personal data, pursuant to the legislation, you have the right to:

• Learn whether your personal data is being processed,

• Request information if your personal data has been processed,

• Learn the purpose of the processing of your personal data and whether it is used in accordance with its purpose,

• Know the third parties to whom your personal data is transferred domestically or abroad,

• Request the correction of your personal data if it has been processed incompletely or incorrectly, and request that the operation carried out in this scope be notified to the third parties to whom the personal data has been transferred,

• Request the deletion or destruction of your personal data in the event that the reasons requiring its processing cease to exist, even though it has been processed in accordance with the KVKK and other relevant legal provisions, and request that the operation carried out in this scope be notified to the third parties to whom the personal data has been transferred,

• Object to the emergence of a result against the person themselves by analyzing the processed data exclusively through automated systems,

• Request the compensation of the damage in the event that you suffer damage due to the unlawful processing of your personal data.

Pursuant to paragraph 1 of Article 13 of the KVKK, in order to exercise your rights over your personal data, you can fill out the Personal Data Protection Law Data Subject Request Form located in the KVKK and Privacy section of the Vixi website, and you can submit your requests within the scope of the law and your request to exercise the rights specified above to us in writing or by the other methods determined by the Personal Data Protection Board, by using a registered electronic mail (“KEP”) address, secure electronic signature, mobile signature, or the e-mail address previously notified to our Company by the data subject and registered in the data controller's system, or via software or an application developed for the purpose of the application, or by the other methods determined by the Personal Data Protection Board.

If you wish to submit your application in writing; you can submit it to the address “Fenerbahçe Mahallesi İğrip Sokak Bina No:13 İç Kapı No:1, Kadıköy-İstanbul” of Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi, in person by presenting your identity or signed by mail, and you can also send your request by e-mail to [email protected].

We would like to remind you that your application must comply with the conditions set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. The Company responds within a maximum of thirty (30) days, as provided for in the Law, to data subjects who wish to exercise the said rights within the limits set out in the Law.

Where necessary to determine whether the applicant is the personal data subject, the Company may request information from the relevant person on their behalf and may pose questions to the personal data subject regarding their application in order to clarify the matters specified in the application.

PERSONAL DATA PROTECTION LAW DATA SUBJECT REQUEST FORM

This Personal Data Protection Law Data Subject Request Form (the ‘Form’) has been created by Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi for use in applications to be made by data subjects within the scope of the Personal Data Protection Law No. 6698 (the ‘KVKK’) to exercise their rights, which are also specified in the Personal Data Protection and Privacy Policy of Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi.

In the event that data subjects wish to apply to Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi to exercise these rights, this Form must be completed in full, then signed and delivered to Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi via one of the following methods:

i. The application must be made to the Company in person together with documents enabling identity verification (national ID card, driver's license, etc.), and the Form must be signed during this application.

ii. The Form must be sent via notary to the address “Fenerbahçe Mahallesi İğrip Sokak Bina No:13 İç Kapı No:1 Kadıköy/İSTANBUL.”

iii. The Form must be sent to [email protected] via the data subject's own KEP.

1. Information About the Data Subject

Please provide the requested information so that applications can be evaluated properly.

First and Last Name:

National ID Number:

Address:

Telephone Number:

E-mail:

Please mark the option below that best describes your relationship with the Company:

☐ Customer

☐ Employee

☐ Job Candidate

☐ Intern

☐ Supplier

☐ Visitor

☐ Other (…………………………………)

2. Information Regarding the Data Subject's Request

Please mark your request or requests related to personal data from the list below.

☐ I want to learn whether my personal data is being processed.

☐ If my personal data has been processed, I want to receive information about it.

☐ I want to learn the purpose of the processing of my personal data.

☐ I want to know the third parties to whom my personal data is transferred domestically or abroad.

☐ In the event that my personal data has been processed incompletely or incorrectly, I want it to be corrected.

☐ I want my personal data to be deleted in the event that the reasons requiring its processing cease to exist.

☐ I want the correction operation to be notified to third parties.

☐ I want the deletion operation to be notified to third parties.

☐ I think a result against me has emerged as a result of analysis through automated systems, and I object.

☐ I request the compensation of my damage due to the unlawful processing of my personal data.

3. Information Regarding the Conclusion of the Application

Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi will conclude your request within thirty days at the latest, and will respond by mail or through digital means based on the address and e-mail information you provided in Section 1. If you have a particular preference among these channels through which the response will be provided, please indicate it below.

☐ I want the response to be provided by mail.

☐ I want the response to be provided by e-mail.

In the event that additional information is needed within the scope of evaluating the request, Vixi Organik Kimyasallar Ve Biyoteknoloji Sanayi Ticaret Limited Şirketi may contact you. Your application will be concluded free of charge; however, in the event that it requires an additional cost, a fee in accordance with the legislation may be charged.

DECLARATION

I request that this application of mine, regarding my KVKK-specific requests stated in this Form, be evaluated and concluded.

Name and Surname of the Data Subject:

Signature of the Data Subject:

Date: