ArastaLink Privacy Notice (KVKK)

Data Controller: DERELİ TEKSTİL DIŞ TİCARET LİMİTED ŞİRKETİ

Registered address: GÜNDOĞU MAH. ZÜBEYDE HANIM CAD. NO: 4 A AHMETBEY BELDESİ/ LÜLEBURGAZ/ KIRKLARELİ

Tax ID / MERSİS / Trade Registry: 2921261989

Email (general): info@arastalink.com

Email (KVKK requests): privacy@arastalink.com

This Notice applies to personal data processed in connection with:

• visits to the Site and use of its features;
• submitting inquiries and order requests (including product links and specifications);
• using our assisted purchasing, consolidation, packaging, fulfillment, and shipping services;
• our "For Business" (B2B) inquiries and contract onboarding;
• communications with us via email, phone, messaging apps (e.g., Telegram), or similar channels;
• compliance and security activities.

This Notice does not replace the privacy terms that may be included in a specific signed contract or service terms. Where a conflict exists, the specific contract/service terms prevail for the relevant processing.

Depending on how you interact with us, we may process the following categories of personal data:

3.1 Identity and contact data

• Name and surname; contact person name (for B2B);
• Email address; phone number; Telegram/other messaging handles;
• Delivery/recipient address and contact details (when shipping).

3.2 Order and service data

• Product links and product details (product name, size, color, quantity, price, "maximum price increase");
• Quotes, invoices, shipment tracking numbers, delivery preferences;
• Photos taken for quality control and pre-shipment reporting (where applicable);
• Customer support records related to your order/service.

3.3 Payment and financial data

• Payment confirmations, transaction references, billing details, invoice data;
• We do not aim to store full card numbers. Card payments, where used, are typically processed by banks or payment service providers.

3.4 Business (B2B) onboarding and compliance data

• Company identifiers (company name, registration details, tax information);
• Authorized signatory/representative details;
• Where required for compliance: beneficial ownership information and verification documents.

3.5 Technical and usage data

• IP address, device identifiers (where available), browser type, language settings;
• Log records, timestamps, pages visited, and interaction events;
• Cookies and similar technologies (see our Cookie Policy when published/available).

3.6 Special categories of personal data

We do not intentionally request or require "special categories of personal data" as defined by KVKK (e.g., health, biometric data). If such data is exceptionally provided or required (rare), we apply enhanced safeguards and process it only where permitted by law and/or with explicit consent, as applicable.

We process personal data for the following purposes:

• To operate the Site and provide requested features, including account creation (if applicable), responding to inquiries, and maintaining functionality and security.
• To provide our services, including checking availability/pricing, assisted purchasing, quality checks, packaging, consolidation, fulfillment, shipping, and delivery coordination.
• To manage transactions and payments, including invoicing, accounting, refund processing, and financial reconciliation.
• To communicate with you, including service updates, confirmations, customer support, and handling complaints.
• To conduct B2B relationship management, including quotes, contract preparation, onboarding, and account management.
• To ensure compliance, including meeting obligations under tax, accounting, trade, customs, anti-fraud, sanctions, and other applicable rules, and responding to lawful requests from competent authorities.
• To prevent fraud and protect our rights, including security monitoring, abuse prevention, dispute management, and enforcement of our Terms and service policies.
• To improve our services, including performance analytics, troubleshooting, and quality assurance.
• Marketing and communications (where permitted), such as sending updates about our services, only where you have provided consent or where permitted by applicable law (and subject to opt-out where applicable).

We process personal data based on one or more legal grounds permitted under KVKK, including:

• Explicit consent (where required), e.g., for certain marketing activities and certain cookie categories.
• Necessity for the establishment or performance of a contract, e.g., to process orders, provide services, manage shipments, and handle payments.
• Compliance with a legal obligation, e.g., accounting/tax recordkeeping, responding to lawful authority requests.
• Legitimate interests of ArastaLink, provided that your fundamental rights and freedoms are not harmed, e.g., ensuring Site security, fraud prevention, and service improvement.
• Establishment, exercise, or protection of a right, e.g., handling disputes, legal claims, and enforcement.

Where special categories of personal data are processed (rare), we rely on the additional conditions required by KVKK and implement the safeguards required by the Personal Data Protection Board.

We collect personal data through:

• forms on the Site (e.g., "Place an Order", "For Business / Get a Quote");
• email communications and messaging apps (e.g., Telegram) initiated by you or for service delivery;
• phone calls and customer support interactions;
• documents you provide during service delivery or B2B onboarding;
• automated technologies (e.g., logs, cookies) when you browse the Site.

We may transfer personal data, on a need-to-know basis, to the following categories of recipients for the purposes described in this Notice:

• Suppliers, stores, and marketplaces (to purchase items and resolve order issues);
• Logistics providers, carriers, fulfillment and warehouse partners (to store, pack, ship, deliver, and track orders);
• Banks and payment service providers (to process payments, refunds, and fraud checks);
• IT and infrastructure providers (hosting, email delivery, analytics, security, and support tools);
• Professional advisors (lawyers, accountants, auditors) where necessary for legal/compliance or business operations;
• Competent authorities (courts, law enforcement, tax/customs authorities, regulators) where required by law or to protect our rights.

We do not sell your personal data.

Because our services involve international shipping and we may use global technology providers, your personal data may be transferred outside Türkiye (e.g., to carriers or service providers abroad, or to customs authorities in destination countries).

Where a cross-border transfer is required, we will ensure compliance with KVKK's cross-border transfer rules, including using (where applicable) one or more of the following mechanisms:

• an adequacy decision issued by the Personal Data Protection Board;
• appropriate safeguards recognized under KVKK (e.g., standard contractual mechanisms, binding corporate rules, or undertakings, as applicable); and/or
• a permitted exception under KVKK where conditions are met.

We retain personal data only for as long as necessary for the purposes described in this Notice, including:

• the duration of our relationship with you and the period necessary to provide services;
• periods required by applicable laws (e.g., accounting/tax/commercial recordkeeping);
• limitation periods for potential legal claims and dispute resolution.

When retention is no longer necessary, we delete, destroy, or anonymize personal data in accordance with KVKK and our internal retention procedures.

You have the right to apply to ArastaLink and request:

• to learn whether your personal data is processed;
• to request information if your personal data has been processed;
• to learn the purpose of processing and whether data is used in line with that purpose;
• to know the third parties to whom your personal data is transferred in Türkiye or abroad;
• to request correction of incomplete or inaccurate personal data;
• to request deletion or destruction of personal data where the reasons for processing no longer exist;
• to request notification of correction/deletion/destruction to third parties to whom data was transferred;
• to object to the emergence of a result against you by analysis exclusively through automated systems;
• to request compensation if you suffer damage due to unlawful processing of your personal data.

To exercise your KVKK rights, you may submit a request to us:

• by email to: privacy@arastalink.com (preferably from the email address associated with your account/requests); and/or
• by written application to our registered address: GÜNDOĞU MAH. ZÜBEYDE HANIM CAD. NO: 4 A AHMETBEY BELDESİ/ LÜLEBURGAZ/ KIRKLARELİ.

Your request should include sufficient information to verify your identity and specify which right you seek to exercise. We may request additional information solely to confirm identity or clarify the request.

We will respond within the time limits required by KVKK. If the request involves a cost, we may charge the fee permitted under applicable regulations.

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, disclosure, alteration, or destruction. However, no system can be guaranteed 100% secure.

We may update this Notice from time to time. The latest version will be published on the Site with an updated "Last updated" date. Changes become effective upon publication unless stated otherwise.

If you have questions about this Notice or our personal data processing practices, contact:

Email: privacy@arastalink.com

General inquiries: info@arastalink.com