Turkticaret.Net Software Services Industry and Trade Joint Stock Company Lock&Key Individual Customer Clarification Text

This Clarification Text has been prepared in accordance with Article 10 of the Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) and the Communiqué on the Procedures and Principles to be Followed in Fulfillment of the Obligation to Inform.

As Turkticaret.Net Software Services Industry and Trade Joint Stock Company (“Data Controller” or “Turkticaret.Net”), we attach great importance to the protection and processing of your personal data and to ensuring its security. In this context, sensitivity is shown regarding the processing and preservation of all kinds of personal data collected in accordance with the KVKK and its secondary regulations.

Being aware of the responsibility borne as the “Data Controller” with respect to personal data being processed by the Data Controller or upon the Data Controller’s instructions as stated in the KVKK, your personal data is processed as described below and within the limits permitted by the legislation.

Data Controller

In accordance with the KVKK No. 6698, your personal data may be processed by Turkticaret.Net Software Services Industry and Trade Joint Stock Company as the “Data Controller” within the scope described below.

Detailed information regarding the processing of your personal data processed by Turkticaret.Net can be reached through the relevant policies located at the internet address https://www.turkticaret.net/kvkk-bilgilendirme.

Collection and Processing of Personal Data and Purposes of Processing

Data Processing Activity	Data Subject	Data Category	Purpose of Processing	Collection Method	Legal Ground
Carrying out the membership processes of users who wish to become a member of the Lock & Key mobile application	Service Recipient	Identity (Name and Surname, Title, Age Range) Contact (E-Mail Address)	Execution of Activities in Compliance with the Legislation Execution of Loyalty Processes towards the Company / Products / Services Execution of Communication Activities Execution / Supervision of Business Activities Execution of Goods / Services Sales Processes Execution of Customer Relationship Management Processes	Directly from the data subject, electronically	KVKK Art. 5/2 - c) Being necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of that contract.
Carrying out the service purchase transactions for the use of paid features through the Lock & Key mobile application	Service Recipient	Identity (Name and Surname) Contact (E-Mail Address, Telephone Number) Customer Transaction(Payment Information)	Execution of Activities in Compliance with the Legislation Execution of Loyalty Processes towards the Company / Products / Services Execution of Communication Activities Execution / Supervision of Business Activities Execution of Goods / Services Sales Processes Execution of Customer Relationship Management Processes	Directly from the data subject, electronically	KVKK Art. 5/2 - c) Being necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of that contract.
Collection and reporting of the mobile application and usage duration information carried out on the smartphone via the Lock & Key mobile application	Service Recipient	Device/Technical Information (Device Type) Application Usage Information (Active Usage Information of Applications, Background Running Durations of Applications, Device Session Durations, Device Inactivity Durations)	Execution of Activities in Compliance with the Legislation Execution of Goods / Services Sales Processes Execution of Goods / Services Production and Operation Processes Execution of Customer Relationship Management Processes Execution of Contract Processes Execution of Information Security Processes Follow-up of Requests / Complaints	Directly from the data subject, electronically	KVKK Art. 5/2 - c) Being necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of that contract. KVKK Art. 5/2 - f) Being mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Keeping log records for the effective operation of the Lock & Key mobile application and for transaction and information security purposes	Service Recipient	System Information (Application Login-Logout Logs, Crash Records, Time Stamps)	Execution of Information Security Processes Execution / Supervision of Business Activities Ensuring the Security of Data Controller Operations Execution of Goods / Services Production and Operation Processes Execution of Activities in Compliance with the Legislation Execution of Storage and Archiving Activities	Directly from the data subject, electronically	KVKK Art. 5/2 - a) Being explicitly provided for by the laws. KVKK Art. 5/2 - f) Being mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Responding to complaints, suggestions, requests and questions	Service Recipient	Comment and Complaint Information	Execution of Loyalty Processes towards the Company / Products / Services Receiving and Evaluating Suggestions for the Improvement of Business Processes Execution of After-Sales Support Services for Goods / Services Execution of Customer Relationship Management Processes Execution of Activities for Customer Satisfaction Follow-up of Requests / Complaints	Directly from the data subject, electronically	KVKK Art. 5/2 - c) Being necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of that contract. KVKK Art. 5/2 - f) Being mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Sending commercial electronic messages	Service Recipient	Identity (Name and Surname) Contact (E-Mail Address, Telephone Number)	Execution of Advertising / Campaign / Promotion Processes Execution of Marketing Activities Execution of Marketing Processes for Products and Services	Directly from the data subject, electronically	KVKK Art. 5/1 - Explicit Consent (In the event that you have the status of a merchant/tradesman, message deliveries may be carried out based on the legitimate interest data processing condition, pursuant to the exception regarding the fact that consent is not sought prior to the sending of commercial electronic messages.)
Planning and execution of the marketing and targeting activities necessary for the products and services offered to be customized according to the preferences, usage habits and needs of the data subjects and to be recommended and promoted to the data subjects,	Service Recipient	Identity (Name and Surname) Contact (E-Mail Address, Telephone Number) Customer Transaction	Execution of Marketing Analysis Studies Execution of Customer Relationship Management Processes Execution of Marketing Activities Execution of Marketing Processes for Products and Services	Directly from the data subject, electronically	KVKK Art. 5/1 - Explicit Consent
Execution of legal proceedings and dispute processes	Service Recipient	Identity (Name and Surname) Contact (E-Mail Address, Telephone Number) Legal Proceeding (Enforcement Information, Litigation Information)	Execution of Audit / Ethics Activities Execution of Activities in Compliance with the Legislation Follow-up and Execution of Legal Affairs Execution of Internal Audit / Investigation / Intelligence Activities Provision of Information to Authorized Persons, Institutions and Organizations	Directly from the data subject, electronically	KVKK Art. 5/2 - e) Being mandatory to process data for the establishment, exercise or protection of a right.

Your collected personal data will be collected and processed by Turkticaret.Net only within the scope of the purposes specified above, and in the event of a change in these purposes, you will be separately informed with respect to the new processing activity concerned.

Your personal data is processed in compliance with the law and the rules of good faith, in an accurate and, where necessary, up-to-date manner, for specific, explicit and legitimate purposes, in a manner connected with and limited to those purposes, and is retained for the periods stipulated in the relevant legislation or for the period required for the purpose of processing.

Transfer of Personal Data to 3rd Parties and Purposes of Transfer

Your personal data collected in line with the fulfillment of the purposes set out in Article 2 above may be transferred to our business partners and to our suppliers from which we receive services, resident in Turkey and abroad, within the scope of our legitimate interests, and to legally authorized public institutions and legally authorized private persons within the scope of being explicitly provided for by the laws and the fulfillment of our legal obligations, within the framework of the data processing conditions set out in Article 5 of the Law and in compliance with the rules regarding the transfer of personal data specified in Articles 8 and 9 of the Law.

Your Rights as a Data Subject

As a data subject, in the event that you submit your requests within the scope of Article 11 of the KVKK regarding your personal data processed by us to the Data Controller, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by means of the Data Subject Application Form which you can reach at lockandkey.com.tr, the Data Controller will conclude your request within the shortest time and at the latest within thirty days, depending on its nature, without charging any fee. However, in the event that it is stipulated by the Personal Data Protection Board, a fee may be requested.