General Corporate Privacy Notice on the Processing of Personal Data

As Gezer Ayakkabı Deri Sanayi ve Ticaret Anonim Şirketi (“Gezer” or “the Company”), we have prepared this privacy notice in order to inform you, our Visitors, Online Visitors, Customers, Potential Customers, Supplier Employees and Supplier Representatives, regarding the processing, storage and transfer of your personal data within the framework of our activities arising from the Personal Data Protection Law No. 6698 (“KVKK”) and other relevant legislation and legal regulations.

1) What Are the Categories of Personal Data We Process and for What Purposes Do We Process Them?

Your personal information is processed by the Company in accordance with the principles set out in Article 4.2 of the KVKK, namely;

1. Being lawful and in accordance with the rules of good faith,
2. Being accurate and, where necessary, up to date,
3. Being processed for specific, explicit and legitimate purposes,
4. Being relevant to, limited to and proportionate with the purposes for which they are processed,
5. Being retained for the period stipulated by the relevant legislation or required for the purpose for which they are processed,

and, within the scope of the business relationships we have established and continue with our business partners (it is possible for a person to fall into more than one category), may be processed for the purposes set out below.

A. Our Visitors

The identity information (e.g. name and surname) and physical space security information (e.g. camera recordings) of our Visitors will be processed for the following purposes:

1. Creating and tracking visitor records,
2. Ensuring physical space security.

B. Our Customers

The identity information, contact information, customer transaction information (e.g. order information), physical space security information, financial information (e.g. balance sheet information), legal transaction information, and marketing information (e.g. shopping history information) of our customers who are real persons, or of the representatives and/or employees of our customers who are legal entities, will be processed for the following purposes:

1. Conducting activities in compliance with legislation,
2. Conducting finance and accounting operations,
3. Conducting/auditing business activities,
4. Conducting logistics activities,
5. Conducting after-sales support services for goods/services,
6. Conducting goods/services sales processes,
7. Conducting marketing analysis activities,
8. Conducting contract processes,
9. Providing information to authorized persons, institutions and organizations,
10. Ensuring physical space security,
11. Resolving legal disputes,
12. Conducting storage and archive activities,
13. Conducting risk management processes,
14. Conducting company/product/service loyalty processes,
15. Conducting communication activities.

C. Our Potential Customers

The identity information, contact information, customer transaction information, physical space security information, and marketing information of our customers who are real persons, or of the representatives and/or employees of our customers who are legal entities, will be processed for the following purposes:

1. Managing goods/services sales processes,
2. Conducting contract processes,
3. Ensuring physical space security,
4. Conducting marketing analysis activities.

D. Our Supplier Employee

The identity information and contact information of our supplier employee will be processed for the following purposes:

1. Conducting communication activities,
2. Conducting/auditing business activities,
3. Ensuring physical space security,
4. Conducting supply chain management processes,
5. Conducting logistics activities,
6. Conducting activities in compliance with legislation,
7. Conducting occupational health/safety activities.

E. Our Supplier Representative

The identity information, contact information, customer transaction information, financial information, and legal transaction information of our suppliers who are real persons, or of the representatives of our suppliers who are legal entities, will be processed for the following purposes:

1. Conducting/auditing business activities,
2. Conducting goods/services procurement processes,
3. Conducting finance and accounting operations,
4. Conducting contract processes,
5. Conducting investment processes,
6. Ensuring physical space security,
7. Following up and conducting legal affairs.

2) What Are the Methods of Collecting Your Personal Data?

Your personal data specified above under categories is collected through physical means such as order forms, contracts, and visitor forms, or through information systems and electronic devices (e.g. telecommunications infrastructure, computers and telephones), third parties (e.g. KKB and Findeks), our website, and other documents declared by the data subject, by automated or non-automated means.

3) What Is the Legal Basis for the Collection of Your Personal Data?

Your personal data is processed by Gezer, in line with the purposes explained above, on the following legal grounds set out in Article 5 of the KVKK;

1. Being expressly provided for by law,
2. Being necessary for the processing of personal data belonging to the parties to a contract, provided that it is directly related to the establishment or performance of a contract,
3. Being mandatory for the data controller to fulfil its legal obligation,
4. Being mandatory for the establishment, exercise or protection of a right,
5. Being mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject

legal grounds.

4) Do We Transfer Your Personal Data to a Third Party?

1. The personal data of our Visitors may be shared with law enforcement and judicial authorities for the purpose of resolving legal disputes and when requested pursuant to the relevant legislation.
2. The personal data of our Online Visitors may be shared with judicial authorities and competent public institutions and organizations for the purpose of resolving legal disputes and when requested pursuant to the relevant legislation.
3. The personal data of our Customers is transferred, to the extent required by the relevant legislation, to competent public institutions and organizations for the purposes of conducting activities in compliance with legislation, following up and conducting legal affairs, and providing information to authorized persons, institutions and organizations; and, to the extent necessary for conducting/auditing business activities, conducting risk management processes, and duly performing our services, to our group companies, our IT company, suppliers, cargo companies, insurance companies, banks and our financial advisor. In addition, such personal data may be transferred to the law firm from which we receive services and to judicial authorities for use as evidence in any legal disputes that may arise in the future.
4. The personal data of our Potential Customers may be transferred to the law firm from which we receive services and to judicial authorities for use as evidence in any legal disputes that may arise in the future.
5. The personal data of our supplier employee is transferred, to the extent required by the relevant legislation, to competent public institutions and organizations for the purposes of conducting activities in compliance with legislation, following up and conducting legal affairs, providing information to authorized persons, institutions and organizations, and conducting/auditing business activities; and, to the extent necessary for duly performing the service, to our group companies, our IT company, suppliers, cargo companies, banks and our financial advisor. In addition, such personal data may be transferred to the law firm from which we receive services and to judicial authorities for use as evidence in any legal disputes that may arise in the future.
6. The personal data of our supplier representative is transferred, to the extent required by the relevant legislation, to competent public institutions and organizations for the purposes of conducting activities in compliance with legislation, following up and conducting legal affairs, providing information to authorized persons, institutions and organizations, and conducting/auditing business activities; and, to the extent necessary for duly performing the service, to our group companies, our IT company, suppliers, cargo companies, banks and our financial advisor. In addition, such personal data may be transferred to the law firm from which we receive services and to judicial authorities for use as evidence in any legal disputes that may arise in the future.

5) Do We Transfer Your Personal Data Abroad?

The processes regarding the transfer of your personal data abroad are being evaluated within the framework of the scope of the transfer and the conditions set out in Article 9 of the KVKK, and this section will be updated once the transfer processes are clarified.