Privacy and Data Protection

Introduction and Data Controller

As BENDAİ TEKNOLOJİ ANONİM ŞİRKETİ (the “Company”), the privacy and security of your personal data are among our highest priorities. Our Company processes your personal data in full compliance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and the secondary regulations based on this Law.

“Personal data” means any information that makes your identity determined or determinable. In this respect, we would like to inform you about the personal data processed in the event that you become an “Applicant” or “Member” by completing the application form in order to benefit from all services offered through our Company's mobile application and/or website (collectively, the “Platform”). As BENDAİ TEKNOLOJİ ANONİM ŞİRKETİ, we hereby inform you that we process your personal data in our capacity as the data controller within the scope of the KVKK and other relevant legislation.

Identity of the Data Controller

• Data Controller: Bendai Teknoloji Anonim Şirketi
• Address: Esentepe Mah. Harman1 Sk. No:7-9 İç Kapı No: 60 Kat:20 Nida Kule Levent Şişli/İSTANBUL
• Contact Channel: info@obiy.com

Personal Data We Process

In the event that an OBİY membership/application is created, the following data of yours is processed:

• Application/User Account Information: your name, surname, customer number, membership e-mail address and, if you add them to your user information, your telephone number, gender, date of birth, as well as your Turkish ID Number (T.C. Kimlik Numarası) only for purchases where it is required by legislation.
• Your Company Information: information about the company official, the company's financial information, your tax identification number (VKN) information.
• Address Information: your telephone number and address information that you add for the application, your delivery transaction information.
• Payment Information: information regarding the payments you make and the payment methods, your saved card information.
• Transaction Security Information: your device information, IP address information, your password and passphrase information, your cookie information, platform access records, your login method.
• Legal Transaction Information: information contained in correspondence with authorized persons, institutions and organizations, information contained in litigation and enforcement files, your legal information request information.
• Audio Recording Information: your voice recording in the event that you speak with the call center.

Purposes and Legal Grounds for Processing Your Personal Data

Within the scope of the “Obligation to Inform” imposed on the data controller by Law No. 6698, your processed personal data is processed based on the following purposes and legal grounds:

KVKK m. 5/2-(c): Provided that it is directly related to the conclusion or performance of a contract, the processing of personal data belonging to the parties of the contract being necessary

• Carrying out service purchase and sale processes
• Creating membership and managing the account
• Carrying out activities aimed at customer satisfaction and customer relationship management processes
• Carrying out communication activities
• Receiving orders, product/service delivery
• Storing live support, chat and communication records
• The user making comments, asking questions, rating and reviewing
• Concluding and ensuring the performance of the distance sales agreement
• Carrying out delivery and logistics activities

KVKK m. 5/2-(ç): Being mandatory for the data controller to fulfill its legal obligation

• Carrying out activities in compliance with legislation
• Performing payment and invoicing transactions
• Fulfilling legal obligations
• Carrying out finance and accounting affairs
• Carrying out contract processes
• Carrying out storage and archiving activities
• Providing information to authorized persons, institutions and organizations

KVKK m. 5/2-(e): Data processing being mandatory for the establishment, exercise or protection of a right

• Following up on requests and complaints
• Carrying out legal processes, mounting a defense against lawsuits and complaints

To Whom and for What Purpose Personal Data May Be Transferred

It is our priority that your personal data is not transferred or disclosed. However, the personal data of our website and mobile application members/applicants may be transferred to the following groups of recipients for the specified purposes and legal grounds:

Shipping Companies and Distributors

• Transferred data: name-surname, customer username, gender, age, mobile phone, e-mail, address, order information, number of orders, invoice information, request/complaint information, location information, information regarding payments and payment methods.
• Purpose: to carry out communication between the distributor/courier and customers, to carry out customer order transactions, to inform couriers about the address to which the order will be delivered.
• Legal ground: the processing of personal data being necessary for the conclusion or performance of the contract to be made with Obiy (KVKK m. 5/2-c).

Lawyers, Auditors, Consultants, Affiliates and Business Partners

• Transferred data: name-surname, customer username, gender, age, mobile phone, e-mail, address, information regarding payments and payment methods, shopping history, order information, number of orders, application usage information, invoice information, request/complaint information, device operating system and version, device type, device identity (ID), hardware model, IP address, user transaction records, password information.
• Purpose: to receive support from suppliers regarding the products and services offered to customers, to carry out finance and accounting affairs, to manage business partner and supplier relationships; to carry out marketing, advertising and promotional activities, and to increase customer satisfaction.
• Recipient group: lawyers, auditors, tax consultants, forensic IT experts, cybersecurity consultants, our group companies, our affiliates, other third parties from whom we receive consultancy and services, and business partners.
• Legal ground: being necessary for the conclusion or performance of the contract (KVKK m. 5/2-c), being mandatory for our legitimate interests (KVKK m. 5/2-f), and your explicit consent being present for transfers abroad (KVKK m. 9/1).

Authorized Persons, Institutions and Organizations

• Transferred data: identity information, account information, contact information, customer transaction information, payment information, legal transaction information, transaction security information.
• Purpose: to provide information to authorized persons, institutions or organizations, to fulfill our legal obligations, to carry out legal processes, and to carry out our activities in compliance with legislation.
• Legal ground: being expressly stipulated in the laws (KVKK m. 5/2-a) and being mandatory in order for us to fulfill our legal obligations (KVKK m. 5/2-ç).

Method of Collecting Personal Data

Your personal data is collected and processed by Bendai Teknoloji Anonim Şirketi through electronic and physical environments, by fully or partially automated means or by non-automated means provided that it is part of a data recording system. Your data is collected through the following methods:

Information Provided Directly by the User (Together with Membership/Application)

• Information provided by the user during membership/application registration to the Platform (name, surname, e-mail address, telephone number, company information, date of birth, gender, etc.)
• Delivery address, payment preference, invoice information provided for the purpose of placing orders and completing shopping transactions
• Comments, reviews regarding products or services, and other content created by the user
• Information conveyed through requests, complaints or support applications

Data Collected by Automated Methods

• Technical data collected during the use of the website or mobile application: IP address, cookie information, device model, browser type, operating system, session information and connection time information
• In the event of logging in via third-party social media platforms such as Google and Facebook, information transferred from these platforms

Data Obtained Through Communication Channels

• Voice recordings of conversations made with the call center
• Contents of correspondence made through the live support (chat) service
• Information provided by the user via e-mail, SMS and other digital communication channels

Data Received from Service Providers and Business Partners

• Delivery data received from shipping and logistics companies
• Payment and transaction information received from payment system service providers
• Commercial information arising from transaction processes carried out with users within the scope of the marketplace
• Data obtained from third-party service providers used in marketing, analytics and advertising activities

Data Collected Within the Scope of Legislation

• The processes of placing and creating the order
• Concluding and ensuring the performance of the distance sales agreement
• Carrying out delivery and logistics activities
• Managing cancellation/return and right of withdrawal processes
• Fulfilling payment and invoicing processes
• The performance of legal obligations imposed by the Regulation on Distance Contracts, the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce, and similar secondary regulations

Rights of the Data Subject Under Article 11 of the KVKK

As a data subject, we would like to inform you that you have the following rights within the scope of Article 11 of Law No. 6698:

• To learn whether your personal data is processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request the correction of personal data in the event that it has been processed incompletely or incorrectly, and to request that the action taken in this respect be notified to the third parties to whom the personal data has been transferred,
• Despite having been processed in accordance with the provisions of the KVKK and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist, and to request that the action taken in this respect be notified to the third parties to whom the personal data has been transferred,
• To object to the emergence of a result against the person himself/herself by means of the analysis of the processed data exclusively through automated systems,
• To request the compensation of the damage in the event of suffering damage due to the unlawful processing of personal data.

Method of Application

Your rights within the scope of Article 11 of the KVKK are reserved; you may convey your requests regarding the said rights through the following methods:

• In order for us to verify your identity and to avoid providing information to the wrong persons, in writing through a notary or by registered mail with return receipt,
• By sending an e-mail to info@obiy.com using a secure electronic signature, mobile signature, or (if any) the e-mail address that you have previously notified to Bendai Teknoloji Anonim Şirketi and that is registered in our systems, or through other methods to be determined by the Board in the future.

Retention Period of Personal Data

Your personal data will, unless you make any update, be retained in our systems for 10 (ten) years from the date on which you convey your information to our Company.

Changes and Updates

The Company reserves the right to update this Disclosure (Privacy) Notice on the Protection of Personal Data at any time within the framework of changes that may be made to the legislation in force.