[VALIEL COSMETICS / SOLASTA] Personal Data Policy

General Information on Personal Data Protection Law

The Law on Protection of Personal Data numbered 6698 (hereinafter referred to as the "PDPL") was adopted on March 24, 2016, and published in the Official Gazette dated April 7, 2016, with the issue number 29677. Some provisions of the PDPL were published on the date of publication, while others came into force on October 7, 2016.

Information as Data Controller

In accordance with the PDPL numbered 6698 and as a Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties in cases permitted by legislation, classified, and processed in the manners specified on this page.

Processing Methods of Your Personal Data

In accordance with the PDPL numbered 6698, your personal data shared with our company may be processed by us entirely or partially, automatically or non-automatically, as part of any data recording system, obtained, recorded, stored, changed, rearranged, and, in short, processed in any way stipulated by the legislation. Any process conducted on data is considered "processing of personal data" within the scope of the PDPL.

Purposes and Legal Reasons for Processing Your Personal Data

Your shared personal data will be processed by us:

• To perform the requirements of the services provided to our customers, in accordance with the contract and technological requirements, and to improve the products and services offered,

• To determine the information of the data subject in accordance with the regulations based on Law No. 6563 on Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette dated 26.08.2015 with the issue number 29457, the Distance Contracts Regulation published in the Official Gazette dated 27.11.2014 with the issue number 29188, and other relevant legislation,

• To organize all records and documents related to payment systems, electronic contracts, or paper-based transactions based on the mandatory requirements in banking and electronic payment areas, and to comply with information storage, reporting, and information obligations stipulated by legislation and other authorities,

• To provide information to public prosecutors, courts, and relevant public officials regarding matters related to public security and legal disputes, upon request and in accordance with the legislation, and will be processed in compliance with Law No. 6698 on the Protection of Personal Data and related secondary regulations. Information about third parties or organizations to which your personal data may be transferred

For the purposes stated above, your personal data shared with our company may be transferred to individuals / organizations such as IdeaSoft Yazılım San. ve Tic. A.Ş., which mainly provides our company's e-commerce infrastructure, suppliers, service providers related to the services such as cargo companies, domestic / international organizations, program partner organizations with which we collaborate, as well as other third parties.

Method of Collecting Your Personal Data

Your personal data is collected:

o Through forms on our company's website and mobile applications, including information such as name, surname, ID number, address, phone number, business or private e-mail address; data obtained through preferences on pages accessed using usernames and passwords, IP records of transactions, cookie data collected by the browser, and browsing time and details; location data,

o Verbally, in writing, or electronically through channels such as our sales and marketing department employees, our branches, our suppliers, other sales channels, paper-based forms, business cards, digital marketing, and call centers,

o Physically or virtually, face-to-face or remotely, verbally or in writing or electronically from individuals who share their personal data with our company for purposes such as establishing a commercial relationship with our company, applying for a job, submitting a bid, sharing personal data through business cards, resumes (CV), submitting bids, and other means; data obtained indirectly through various channels, such as websites, blogs, competitions, surveys, games, campaigns, and similar (micro) websites used for purposes like reading or clicking e-newsletters, data provided by public databases, open profiles, and data from social media platforms; and can be processed and collected.

Your Personal Data Obtained Before the PDPL Came into Force

Before the effective date of the PDPL on April 7, 2016, your personal data obtained in compliance with the law, such as membership, electronic communication permission, product / service purchase, and other methods, is processed and stored in accordance with the terms and conditions specified in this document.

Transferring Your Personal Data Abroad

Your personal data collected through any of the above methods may be transferred abroad for processing in Turkey or abroad, as long as it remains within the scope of the PDPL and in accordance with the contractual purposes, to service providers located abroad (to countries accredited by the Personal Data Protection Board and where adequate protection is provided for personal data). Storing and Protecting Personal Data

Your personal data will be kept confidentially in the database and systems of our company in accordance with Article 12 of the PDPL; and except for legal obligations and regulations stated in this document, they will not be shared with any third parties. Our company is obliged to take software measures such as preventing the unlawful processing of personal data, preventing unauthorized access, and access management, as well as physical security measures to protect the systems and databases where your personal data is located in accordance with Article 12 of the PDPL. If it is learned that personal data is obtained by others through illegal means, the situation will be immediately reported to the Personal Data Protection Board in accordance with the legal regulations and in writing. Keeping Your Personal Data Accurate and Up-to-Date

Under Article 4 of the PDPL, our company has an obligation to keep your personal data accurate and up-to-date. In this context, for our company to fulfill its obligations arising from the current legislation, our customers must share or update their correct and up-to-date data through the website / mobile application.

Rights of the Data Subject under Law No. 6698

Under Article 11 of Law No. 6698, which came into force on October 7, 2016, the rights of the Data Subject are as follows: The Data Subject may apply to our company (data controller) to learn whether personal data is processed; if personal data has been processed, to request information regarding this, to learn the purpose of processing personal data and whether they are used appropriately for their purpose, to learn the third parties to whom personal data is transferred at home or abroad, to request correction of personal data if it is incomplete or incorrectly processed, within the framework of the conditions specified in Article 7 of the PDPL, to request the deletion or destruction of personal data, to request the notification of these processes to third parties to whom the personal data is transferred, to object to the emergence of a result against the person by analyzing the processed data exclusively through automated systems, to demand compensation if personal data is processed illegally and causes damage.

[VALIEL COSMETICS ANONYMOUS COMPANY], registered with the Istanbul Chamber of Commerce under registration number 470220-5, with the MERSIS number [0922144145800001], located at [61 A SARAYARDI STREET, HASANPASA NEIGHBORHOOD, KADIKÖY/ISTANBUL], is the Data Controller within the scope of the Law on the Protection of Personal Data (KVKK). The Data Protection Officer to be appointed by our company will be announced in the Data Controllers Registry and on the internet address where this document is located when the legal infrastructure is provided. Data Subjects can direct their questions, opinions, or requests to any of the following communication channels:

Email: [info@solastabeautylabs.com.tr]

Phone: [+90 533 395 73 11]