Personal Data Protection Notice

PERSONAL DATA PROTECTION NOTICE (KVKK) This is a courtesy translation. The binding version is the Turkish text at https://visnebebe.com/sayfa/kvkk-aydinlatma-metni. In case of discrepancy the Turkish version prevails. This notice is issued under article 10 of Turkish Personal Data Protection Law no. 6698 ("KVKK") and the related Communiqué. 1. DATA CONTROLLER Company: FATİHİM TEKSTİL KONFEKSİYON İNŞAAT GIDA SANAYİ VE TİCARET ANONİM ŞİRKETİ Brand: Vişne Bebe Address: Duaçınarı Mahallesi, Vişne Caddesi No: 144 İç Kapı No: Z1, 16270 Yıldırım / BURSA Phone: +90 224 223 22 66 — +90 224 361 21 57 E-mail: info@visnebebe.com MERSIS number: 0385067942600022 Registered e-mail (KEP): yok 2. DATA WE PROCESS Identity data: name, surname; tax identification or national ID number where an invoice requires it. Contact data: e-mail address, phone number, delivery and invoice address. Customer transaction data: order records, basket contents, order notes, requests and complaints, product reviews. Financial data: the reference or receipt number provided with a bank transfer notification. Card details are never collected or stored by the Seller; when card payment is enabled the transaction takes place on the payment institution's own secure page. Transaction security data: the IP address used for login requests, an irreversible digest of the one-time login code (the code itself is not stored), attempt counters and system logs. Professional/commercial data: company name, country and city provided in dealer and membership applications. Membership records transferred from the former website are also covered. 3. HOW WE COLLECT DATA AND ON WHAT LEGAL BASIS Data is collected wholly or partly by automated means through the membership, order, address, application and contact forms on the site, the live support / chat channel, e-mail and telephone conversations, and the data transfer from the former website. Legal bases (KVKK article 5/2): - necessity for the conclusion or performance of a contract: membership, order, delivery and payment processes; - compliance with a legal obligation: invoicing, retention of commercial books and records, tax obligations; - establishment, exercise or protection of a right: dispute and complaint records; - legitimate interests: order security, fraud and abuse prevention, system logging; - explicit consent: only for non-mandatory processing such as commercial electronic messages (campaign announcements); consent can be withdrawn at any time. 4. PURPOSES - creating memberships and verifying identity (one-time e-mail login code), - receiving, preparing, invoicing and delivering orders, - tracking payments and verifying bank transfer notifications, - handling requests, complaints and returns, - evaluating dealer and membership applications, - meeting statutory retention and reporting obligations, - ensuring system security and preventing abuse. 5. RECIPIENTS - Carrier (Yurtiçi Kargo): name, address and phone for delivery. - Banks: data required for payments and refunds. - Accountant / bookkeeping service provider: invoices and commercial records. - Hosting and infrastructure provider: the server service the system runs on. - Competent public authorities: where required by law. Data is not sold or transferred to third parties for marketing purposes. 6. RETENTION PERIODS - Membership and order records: for the duration of the commercial relationship and the retention periods required by law (as set out in the Tax Procedure Law and the Turkish Commercial Code for commercial books and records). - One-time login code records: 30 days. - Encrypted backups: 7 copies (about 7 days), then deleted. - Requests and complaints: for the applicable limitation period. When the period ends, data is deleted, destroyed or anonymised. 7. YOUR RIGHTS (KVKK ARTICLE 11) You may apply to the data controller to: - learn whether your personal data is processed, - request information if it has been processed, - learn the purpose of processing and whether the data is used accordingly, - know the third parties to whom data is transferred, in Türkiye or abroad, - request correction of incomplete or inaccurate data, - request erasure or destruction within the conditions of the law, - request that such correction, erasure or destruction be notified to third parties to whom the data was transferred, - object to a result arising solely from automated analysis, - claim compensation for damage caused by unlawful processing. 8. HOW TO APPLY Applications are made in writing, or through a registered electronic mail address or the e-mail address registered in our system, in line with the Communiqué on Application Procedures. Application address: Duaçınarı Mahallesi, Vişne Caddesi No: 144 İç Kapı No: Z1, 16270 Yıldırım / BURSA E-mail: info@visnebebe.com Please include your name and surname, signature (for written applications), Turkish ID number or passport number for foreign nationals, an address for notification, any e-mail or phone for correspondence, and the subject of the request. Applications are answered within 30 (thirty) days. Where the process requires a cost, the tariff set by the Personal Data Protection Board may be charged. If the application is rejected or unanswered, a complaint may be filed with the Board. 9. UPDATES This notice is updated when legislation or processing activities change. The current version is always published at https://visnebebe.com. Last updated: 2026-09-15