In accordance with the Law on the Protection of Personal Data No. 6698 (hereinafter referred to as the "Law"), MOOD UP GIDA A.Ş. is the data controller for processing your personal data related to "www.kaimakk.com". According to Article 10 of the Law, which regulates the Obligation to Inform, data controllers are obliged to inform the real persons whose personal data they process on certain matters.

With this awareness, as the relevant person, we process your personal data in the manner explained below and within the limits prescribed by legislation. As the data controller, we would like to inform you in accordance with Article 10 titled "Obligation to Inform the Data Controller" of the Law.

1. About the Data Controller

In accordance with Law No. 6698, MOOD UP GIDA A.Ş. ("Kaimakk" hereinafter) acts as the data controller. We process your personal data as specified below within the scope of our stated purposes; in a manner that is lawful and in compliance with the principles of honesty, and as long as it is necessary for the purposes we foresee, we can process, record, store, classify, update, and, where permitted by the legislation and/or limited to the purpose of processing, disclose/transfer them to third parties domestically or abroad.

2. Processed Personal Data, Legal Grounds, and Processing Purposes

Your Personal Data subject to processing:

Communication Data:

Email address

Your collected personal data are processed in accordance with the principles set forth by Law No. 6698, such as being in compliance with a) legality and honesty, b) being accurate and up-to-date when necessary, c) being processed for specific, clear, and legitimate purposes, ç) being related, limited, and proportionate to the purpose for which they are processed, d) being retained for the period stipulated by the relevant legislation or the duration required for the purpose of processing.

In terms of legal grounds for processing:

Pursuant to Article 5/1 of the Law, based on obtaining the "Explicit consent" of the data subject,

Pursuant to Article 5/2 (f), based on the processing condition that "processing of data is compulsive for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject."

Your collected personal data are stipulated by GDPR a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency'); b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ('purpose limitation'); c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation'); d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy'); e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation'); f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures ('integrity and confidentiality') in accordance with the basic principles of preservation for the period required by the relevant legislation or for the purpose for which they are processed; GDPR;

 

Article 6/1 (b) “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;”

Article 6/1 (c) “processing is necessary for compliance with a legal obligation to which the controller is subject;”

Article 6/1 (d) “processing is necessary in order to protect the vital interests of the data subject or of another natural person;”

Article 6/1 (e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 6/1 (f) “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” and it will be processed for the following purposes:

Conducting Information Activities, Executing Mail Sending System Registration and Verification Processes, Executing Storage and Archiving Activities, Conducting e-newsletter, campaign, discount, promotion, and marketing activities.

3. Transfer of Your Personal Data

 

Your personal data can be transferred to public institutions specified in the laws, within the framework of the purposes and limitations prescribed by the laws, when requested explicitly. Your personal data are shared with third parties in the following cases:

Recipient / Recipient Groups	Transfer Reason	Transferred Data
Individuals or Private Legal Entities (Authorized Software Company / Implementer Communication Company)	Establishment of the Database and Execution of Communication Activities	Communication data (Email Address)
Group Companies	Execution of Company Processes, Execution of Audit Processes	Communication data (Email Address)

4. Methods of Obtaining Personal Data

- Your personal data are obtained from individuals who fill out the opportunity bulletin subscription form on the website.

5. Rights of the Data Subject as Stipulated in Article 11 of Law No. 6698

- The rights of individuals whose personal data are processed according to Article 11 of Law No. 6698 are as follows:

1. Learning whether personal data is processed,
2. Requesting information if personal data has been processed,

iii. Learning the purpose of processing personal data and whether they are used in accordance with their purpose,

1. Learning whether personal data are transferred domestically or abroad, and who the third parties are, if they are transferred,
2. Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made to third parties to whom personal data are transferred in this context,
3. Requesting the deletion or destruction of personal data in case the reasons requiring processing are eliminated, despite being processed in accordance with Law No. 6698 and other relevant laws, and requesting notification of the transaction made to third parties to whom personal data are transferred in this context,

vii. Objecting to the emergence of a result against the individual by analyzing the processed data exclusively through automated systems,

viii. Requesting the compensation of damages in case personal data are processed unlawfully and cause damage.

Additionally, if you have given explicit consent for the processing of personal data, you can withdraw your consent. However, if there are other legal grounds in accordance with Law No. 6698, the processing of your personal data will continue in accordance with these grounds even if you withdraw your consent. Therefore, if you withdraw your explicit consent, the processing of your data, which is processed solely based on your explicit consent, will be terminated immediately. However, both your explicit consent and your personal data processed based on other legal grounds stipulated in Law No. 6698 may continue to be processed within the framework of legal provisions. In case of withdrawal of your explicit consent, a detailed information text will be sent to you in accordance with

with the principles specified in Law No. 6698.

Your Rights as a Data Subject listed in related Articles of GDPR

Under certain circumstances, you have the following rights under data protection laws in relation to your personal data:

1. Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
2. Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you verified, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

1. Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
2. Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

• If you want us to establish the data's accuracy.
• Where our use of the data is unlawful but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

1. Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

If you wish to exercise any of the rights set out above, please contact the personal data supervisor.

You can submit your requests regarding the rights mentioned above, along with the necessary information to identify your identity, by filling out the Relevant Person Application Form on the website www.kaimakk.com, delivering the signed copy of the form in person with identity verification documents to Yeniköy Mah. Dr. Cevat Kerim İncedayı Sk. No:16, 34460 Sarıyer/Istanbul, sending it by notary or by other methods specified in Law No. 6698 and GDPR, or by sending the relevant form securely electronically signed to the address moodup@hs01.kep.tr.

Depending on the nature of the request, the request will be concluded as soon as possible, and at the latest within thirty (30) days, free of charge. However, if the transaction requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board will be charged.

Applications must be made in Turkish. In applications, it is mandatory to include the name, surname, and, if the application is in writing, the signature, the Republic of Turkey ID number for Turkish citizens, nationality for foreigners, passport number/ID number, residence or business address for notification, if any, the email address for notification, telephone or fax number, and the subject of the request.

In the application regarding the rights you want to use, which are stated in Article 11 of Law No. 6698 and the explanations related to the right you request, it must be clearly and comprehensively stated, the subject requested must be related to the person, or if acting on behalf of someone else, it must be specifically authorized in this regard and document this authorization , the application must include identity and address information, and identity documents proving the identity must be attached to the application.

We hereby declare as the "Data Controller" within the scope of Law No. 6698 and GDPR.

Sincerely,

MOOD UP FOOD INC. "www.kaimakk.com"

CRS: 0622-0778-1180-0013

Address: Yeniköy Mah. Dr. Cevat Kerim Incedayı Street No:16, 34460 Sariyer/Istanbul

Phone: 05367427544