Personal Data Protection and Processing Policy

1.Purpose and Scope

As KRY Loyaltech Teknoloji Proje Geliştirme A.Ş. (“Loyexo” or the “Company”), we attach great importance to the security of your personal data within the scope of Law No. 6698 on the Protection of Personal Data (“KVKK”) and its secondary legislation.

This Policy sets out the general principles governing the processing of personal data of our customers, the end users of our corporate business partners, our suppliers, our visitors and our job applicants in connection with the services offered through the Loyexo ecosystem and its brands Loyexo Asistans, Digy, Probuddy Etik Hat, ModdoDay and KobiVerse. Process-specific details are separately provided through the relevant privacy notices and the cookie policy.

2.Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Special Categories of Personal Data: Data listed in Article 6 of the KVKK, such as health, biometric data, religion, memberships and criminal convictions.
• Data Subject: The natural person whose personal data is processed.
• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system — being KRY Loyaltech Teknoloji Proje Geliştirme A.Ş. under this document.
• Data Processor: The natural or legal person who processes personal data on behalf of the data controller upon its authorisation.
• Explicit Consent: Consent relating to a specific subject, based on information and given with free will.
• Destruction: The deletion, erasure or anonymisation of personal data.

3.General Principles for Processing Personal Data

We process your personal data in accordance with the following principles set out in Article 4 of the KVKK:

• Lawfulness and fairness,
• Being accurate and, where necessary, kept up to date,
• Being processed for specific, explicit and legitimate purposes,
• Being relevant, limited and proportionate to the purposes for which they are processed,
• Being retained only for the period stipulated by the relevant legislation or required for the purpose of processing.

4.Conditions for Processing and Special Categories of Personal Data

Your personal data is processed with your explicit consent or, within the scope of Article 5 of the KVKK, without seeking explicit consent where one of the following legal grounds exists:

• It is expressly provided for by law,
• It is directly related to the conclusion or performance of a contract,
• It is necessary for the Company to fulfil a legal obligation,
• The data has been made public by the data subject,
• It is mandatory for the establishment, exercise or protection of a right,
• It is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Special Categories of Personal Data

Your special categories of personal data are processed, pursuant to Article 6 of the KVKK, only with your explicit consent or in the cases prescribed by law, taking the adequate measures determined by the Board.

5.Purposes of Processing

Your personal data is processed mainly for the following purposes:

• Carrying out and improving the assistance, loyalty, ethics line, training and SME services offered,
• Managing membership, request and call centre processes,
• Establishing and performing the contractual and service relationship,
• Ensuring compliance with legal obligations and legislation,
• Information security, fraud prevention and audit activities,
• Promotion, campaign and newsletter activities, where you have given your explicit consent.

6.Transfer of Personal Data

Your personal data may be transferred to the following parties, in accordance with the conditions set out in Articles 8 and 9 of the KVKK and limited to the purposes above:

• Contracted suppliers and business partners cooperated with for the provision of the service,
• Our corporate customers (solely within the scope of the relevant service),
• Authorised public institutions and organisations and judicial authorities,
• Advisors and suppliers from whom legal, financial and technical services are received.

Transfer abroad: Your personal data may be transferred abroad, within the scope of Article 9 of the KVKK, to countries with adequate protection, or where appropriate safeguards (such as a written undertaking or binding corporate rules) are provided, or with your explicit consent.

7.Retention and Destruction

Your personal data is retained for the period necessary for the purpose for which it is processed and stipulated in the relevant legislation. Upon expiry of the period or where the reason for processing ceases to exist, your data is deleted, erased or anonymised within the periodic destruction periods set out in the Company's Personal Data Retention and Destruction Policy.

8.Data Security Measures

Within the scope of Article 12 of the KVKK, the Company takes the following technical and administrative measures to prevent unlawful access to, processing of and sharing of personal data:

Technical Measures

• End-to-end encryption and access authorisation,
• Firewalls, penetration tests and regular security audits,
• Backup and log record management.

Administrative Measures

• Restriction of access based on job descriptions and confidentiality undertakings,
• Regular awareness training for employees,
• Personal Data Processing Inventory and data protection impact assessment (DPIA) processes.

9.Rights of the Data Subject (Article 11 of the KVKK)

Pursuant to Article 11 of the KVKK, by applying to the data controller you have the right to:

• Learn whether your personal data is processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing and whether the data is used in accordance with such purpose,
• Know the third parties to whom the data is transferred domestically or abroad,
• Request rectification if the data is processed incompletely or inaccurately,
• Request erasure or destruction of the data within the scope of Article 7 of the KVKK,
• Request that rectification/erasure operations be notified to the third parties to whom the data has been transferred,
• Object to any result arising against you through analysis exclusively by automated systems,
• Claim compensation for damage arising from unlawful processing of your data.

10.How to Apply

You may submit requests regarding the rights above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by completing the KVKK Request Form available at /en/:

• In writing (wet-signed): to the address “Kavacık Mah. Muhtar Sk. No: 5 İç Kapı No: 4, Beykoz / İstanbul” via notary public, by registered mail with return receipt, or in person.
• By e-mail: from your e-mail address registered in our system, to info@loyexo.com.

Your application is concluded as soon as possible and within thirty (30) days at the latest, depending on the nature of the request; where the transaction additionally entails a cost, the fee set out in the Communiqué may be charged.

11.Effectiveness and Updates

This Policy enters into force on the date it is published on the website. The Company may unilaterally update this Policy in line with legislative changes and updates to its business processes; the current version is published on this page.