PRIVACY POLICY

This Privacy Policy (the “Policy”) has been prepared to inform Members and visitors to the Platform about the personal data processing activities carried out through the two channels comprising the mobile application and website operated by PRIVON, [Yemap Teknoloji ve Gıda Sanayi ve Dış Ticaret A.Ş.] (“PRIVON”) (together, the “Platform”), pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilment of the Obligation to Inform. This Policy both fulfils the minimum statutory obligation to inform under Article 10 of the KVKK and provides more comprehensive, user-friendly information about PRIVON’s data processing practices. It is an annex to and integral part of the PRIVON Membership Agreement and Terms of Use.

The main body of this Policy is for information only and does not constitute a declaration of explicit consent. Processing activities requiring explicit consent (marketing communications, precise location data and exceptional transfers to countries without adequate protection) are addressed separately through the Explicit Consent Texts in ANNEX 4, which are presented in the Platform interface through separate, unticked checkboxes independently of approval of this Policy. Members may withdraw their explicit consent at any time; withdrawal does not affect the lawfulness of processing carried out before it. Upon withdrawal, the relevant processing activity (marketing communications, precise location data or exceptional transfer abroad) shall cease immediately, and the Member shall be informed of the consequences.

1. PURPOSE AND SCOPE

This Policy covers all personal data processing activities conducted through both the web (website) and mobile application versions of the Platform. Additional channel-specific matters are addressed in ANNEX 1 (Cookie Policy, web only) and ANNEX 2 (Mobile Application Permissions and SDK Notice, mobile application only).

2. DATA CONTROLLER

Trade Name: Yemap Teknoloji ve Gıda Sanayi ve Dış Ticaret A.Ş.

MERSİS Number: 0947108275800001 Address: HAMİDİYE MAH. CENDERE CAD. A BLOK NO:33A KAĞITHANE/İSTANBUL Email: [email protected]

Registered Electronic Mail (KEP): [email protected]

3. DEFINITIONS

4. CATEGORIES OF PERSONAL DATA PROCESSED

5. SPECIAL CATEGORIES OF PERSONAL DATA AND THEIR PROCESSING

5.1. Under Article 6 of the KVKK, special categories of personal data, including health data, may be processed only where expressly provided for by law or with the data subject’s explicit consent.

5.2. Notes on allergies, special diets or health conditions submitted by the Member on their own initiative during a reservation through the Platform may constitute special categories of personal data concerning health within the meaning of Article 6 of the KVKK. PRIVON processes such data solely on the basis of the Member’s explicit consent and for the purpose of securely transmitting the relevant reservation to the Partner Establishment. The data are not used for marketing, profiling or any other purpose and are erased or anonymized no later than thirty (30) days after completion of the reservation.

5.3. When processing special categories of personal data, PRIVON applies the measures specified in the Personal Data Protection Board’s decision on adequate measures to be taken in the processing of such data, including separate encryption, restricting and logging access by authorized personnel, and additional security protocols for transfers.

5.4. Product design recommendation: Completion of the allergy/dietary field in the reservation form should be optional, and the field should display the notice: “This information may constitute a special category of personal data. Sharing it is entirely optional.”

6. PURPOSES OF PROCESSING PERSONAL DATA, DATA CATEGORIES AND LEGAL BASES

Your personal data are processed for the purposes, in respect of the data categories, and on the legal bases set out in the following table:

7. METHOD OF COLLECTING PERSONAL DATA

Your personal data are collected electronically and in part by automated means through forms you complete on the Platform’s website and mobile application interfaces, your membership application, reservation transactions, cookies (web only; see ANNEX 1) and SDKs used in the mobile application (see ANNEX 2).

8. TRANSFERS OF PERSONAL DATA WITHIN TÜRKİYE

Transfers are made in accordance with Article 8 of the KVKK and are limited to data proportionate to the purpose of transfer. Of the recipient groups listed above, Partner Establishments, the Licensed Payment Institution, and authorized public institutions and authorities act as independent data controllers; Integration Providers and hosting, cloud and notification infrastructure providers act as data processors. Relationships with data processors are subject to the obligations set out in Article 10 of this Policy.

9. TRANSFERS OF PERSONAL DATA ABROAD

9.1. Under Article 9 of the KVKK, as amended by Law No. 7499, personal data may be transferred abroad under one of the following three mechanisms, in order of priority:

(a) Adequacy Decision: The Personal Data Protection Board has issued an adequacy decision concerning the relevant foreign country, sector or international organization;

(b) Appropriate Safeguards: In the absence of an adequacy decision, the data controller and recipient sign a Standard Contract published by the Board and notify the Board within the period specified by it from the signing date; Binding Corporate Rules approved by the Board apply (for transfers involving PRIVON’s foreign subsidiaries); or duly concluded agreements constituting international treaties between public institutions are in place;

(c) Exceptional Circumstances: Where none of the above mechanisms is available, the limited exceptions listed in Article 9(6) of the KVKK for transfers that are not regular or systematic (incidental transfers), including explicit consent given by the data subject after being informed of the possible risks of the transfer (see ANNEX 4/C).

9.2. Risk Assessment and PRIVON’s Preferred Approach: Transfers under PRIVON’s plans to expand abroad (Dubai, Paris, London, Madrid and elsewhere) would be regular and systematic rather than one-off. Relying solely on explicit consent under Article 9.1(c) for such transfers would therefore be a legally fragile basis: consent may be withdrawn at any time, and the Personal Data Protection Board may regard the use of explicit consent as the primary or sole mechanism for regular transfers as making an exceptional mechanism permanent. PRIVON is therefore advised to prioritize signing the Standard Contract published by the Board under Article 9.1(b) for regular data flows with Partner Establishments and/or local subsidiaries in the relevant countries, and to use explicit consent under ANNEX 4/C only as a supplementary mechanism during a transition period when that mechanism cannot be put in place or for individual transactions.

9.3. PRIVON maintains an up-to-date International Transfer Inventory identifying the transfer mechanism used for each country and monitors updates to the Board’s relevant decisions.

10. RELATIONSHIPS WITH DATA PROCESSORS AND THEIR OBLIGATIONS

10.1. PRIVON enters into written agreements, or data processing addenda to existing service agreements, with third parties that process personal data on its behalf (including integration providers, hosting/cloud service providers, notification infrastructure providers and analytics providers, each a “Data Processor”). At a minimum, these arrangements provide that the Data Processor shall process data only on PRIVON’s instructions; comply with the security measures specified in this Policy and the KVKK; obtain PRIVON’s prior written approval before using a subprocessor; return or destroy the data upon termination of processing; and notify PRIVON immediately, without delay, in the event of a data breach.

10.2. PRIVON may audit Data Processors’ compliance with the KVKK at least annually or at any time for good cause, within the scope of the audit rights in the relevant agreements. Audits shall be conducted on reasonable prior notice and without disrupting the Data Processor’s operations. Unless otherwise agreed, PRIVON bears the audit costs. PRIVON reserves the right to suspend or terminate its relationship with a Data Processor found to be noncompliant.

11. AUTOMATED DECISION-MAKING AND PROFILING

Membership applications are assessed under criteria set by PRIVON personnel, with a natural person making the final decision. Applications are not rejected entirely by automated systems without human intervention. Accordingly, the right under Article 11(1)(g) of the KVKK to object to an adverse outcome resulting from analysis exclusively by automated systems does not currently apply to the membership application process. If PRIVON makes this process fully automated in the future, it shall update this Policy before implementing the system and shall separately and clearly inform data subjects of their right to object under Article 11(1)(g) of the KVKK and the procedure for exercising that right.

12. RETENTION PERIODS

Your personal data are retained only for the period required by the purpose of processing and within the minimum and maximum retention periods prescribed by applicable law. At the end of those periods, they are erased, destroyed or anonymized. The retention periods stated below are minimum periods and are detailed and updated in PRIVON’s Personal Data Retention and Destruction Policy.

13. DATA SECURITY MEASURES

Under Article 12 of the KVKK, PRIVON takes administrative and technical measures, including those below, to prevent unlawful processing of and access to personal data and to safeguard such data:

Administrative Measures: Access authorization and an access rights matrix; confidentiality undertakings signed by personnel; regular KVKK awareness training; written agreements or data processing addenda with suppliers acting as data processors; and keeping the personal data processing inventory and retention and destruction policy up to date.

Technical Measures: Encryption of data in storage and transit; firewalls and intrusion detection systems; regular backups; access and transaction logs; periodic penetration tests and vulnerability scans; multifactor authentication against unauthorized access; and enhanced access restrictions and encryption for special categories of data.

14. PERSONAL DATA BREACH RESPONSE PROCEDURE

If personal data are obtained by others through unlawful means, PRIVON shall notify the Personal Data Protection Board as soon as possible and in any event within seventy-two (72) hours of becoming aware of the breach, pursuant to Article 12(5) of the KVKK. Where the breach poses a risk of harm to the affected individuals’ personal rights or privacy, PRIVON shall inform the affected Members of the nature and likely consequences of the breach by appropriate means, such as email or an in-Platform notice, as soon as possible and in any event within seventy-two (72) hours. PRIVON records all data breach incidents, impact assessments and actions taken and shall provide those records to the Board on request.

15. CHILDREN’S PERSONAL DATA

The Platform is not designed for persons under the age of 18 and does not knowingly collect personal data from them. If PRIVON discovers that it has processed the personal data of a person under 18, it shall erase or anonymize the data within a reasonable time.

16. INTERNATIONAL USERS

Under PRIVON’s plans to expand abroad (Dubai, Paris, London, Madrid and elsewhere), local data protection legislation in the relevant country may apply in addition to the KVKK when personal data of Members or Partner Establishments established there are processed. Examples include the GDPR in European Union member states and the applicable free-zone or federal data protection legislation in the United Arab Emirates. PRIVON shall separately prepare the additional arrangements needed to comply with local law in each market where it operates, including a privacy notice in the local language and the appointment of a local representative where required.

17. VERBİS REGISTRATION REQUIREMENT

Under Article 16 of Law No. 6698, data controllers may be required to register with the Data Controllers Registry (VERBİS) according to criteria set by the Personal Data Protection Board, including annual employee headcount, financial balance-sheet size and whether their principal activity involves processing special categories of personal data. PRIVON regularly assesses whether its current headcount and financial position bring it within the registration requirement. If the requirement arises, PRIVON shall complete registration within the period announced by the Board from the date the obligation begins and update and publish its VERBİS registration number in this Policy.

18. RIGHTS OF DATA SUBJECTS AND APPLICATION PROCEDURE

Under Article 11 of the KVKK, you have the right to learn whether your personal data are processed; request information if they have been processed; learn the purpose of processing and whether they are used in accordance with that purpose; know the third parties to whom they are transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure or destruction under the conditions in Article 7 of the KVKK; request that corrections or erasures be notified to third parties to whom the data have been transferred; object to an adverse outcome resulting from analysis exclusively by automated systems; and claim compensation for damage resulting from unlawful processing. You may exercise these rights by submitting the Application Form in ANNEX 3 of this Policy or using another method specified in the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request shall be resolved according to its nature within thirty (30) days at the latest, free of charge. If processing the request entails an additional cost, a fee under the tariff set by the Personal Data Protection Board may be charged.

19. RIGHT TO COMPLAIN TO THE PERSONAL DATA PROTECTION BOARD

If your application to PRIVON is rejected, you consider the response insufficient, or no response is given within the applicable period, you may lodge a complaint with the Personal Data Protection Board within thirty (30) days of learning of the response and, in any event, within sixty (60) days of your application. The complaint must comply with the procedures and principles prescribed by the Board. You must state the details of your application to PRIVON and its outcome, or the fact that no decision was made.

20. AMENDMENTS TO THE POLICY

PRIVON reserves the right to amend this Policy and its annexes. Amendments take effect when published on the Platform. Material changes to processing purposes, legal bases, transfer recipients or data categories shall also be notified to Members by email and/or Platform notification before they take effect.

21. EFFECTIVE DATE

This Policy takes effect after the user has been duly informed of the data processing activities and upon becoming a Member of, or visiting, the Platform.

ANNEX 1 COOKIE POLICY (WEB ONLY)

This Annex applies only to the website version of the Platform. The mobile application does not use cookies; data collection tools specific to the mobile application are addressed in ANNEX 2.

1. What Is a Cookie

Cookies are small text files placed on your browser or device by the website you visit.

2. Types of Cookies Used

Nonessential cookies are not activated before the visitor gives explicit consent through the cookie consent banner displayed on the first visit. The banner provides clear and understandable information about each type of cookie, its purpose and the data it processes. The visitor gives consent freely using unticked checkboxes and may change their preferences at any time through the cookie preference center on the website.

3. Managing Cookies

Visitors may block or delete cookies through their browser settings. Blocking strictly necessary cookies may, however, prevent some website functions from operating properly.

ANNEX 2 MOBILE APPLICATION PERMISSIONS AND SDK NOTICE (APP ONLY)

This Annex applies only to the mobile application version of the Platform. [The list of permissions and SDKs below must be verified and updated with the product/mobile development team before launch and made fully consistent with the Google Play Data Safety form and Apple App Privacy (Nutrition Label) disclosures.]

1. Device Permissions

2. Third-Party SDKs

The mobile application may use third-party software development kits (SDKs) for performance and error monitoring (crash reporting), usage analytics and, where applicable, push notification infrastructure. Device and usage data collected through these SDKs are transferred to the relevant SDK providers, acting as data processors, solely to ensure and improve the application’s operation. The current list of SDKs used and the scope of each provider’s data processing are separately published and kept up to date in the Google Play Data Safety form and Apple App Privacy disclosure.

3. Withdrawal of Permissions

The Member may withdraw permissions at any time through the device operating system settings. The Member acknowledges that functions dependent on the relevant permission, such as location-based recommendations, may then cease to work. Withdrawal of permissions does not prevent access to membership or the Platform’s core functions.

ANNEX 3 APPLICATION FORM TO THE DATA CONTROLLER

(Prepared in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller)

Full Name: [•] Turkish Identity Number: [•] Address: [•] Email: [•] Telephone: [•]

Your Relationship with PRIVON: [ ] Member [ ] Former Member [ ] Visitor [ ] Other: [•]

Subject of Request (under Article 11 of the KVKK): [•]

Detailed Description of Your Request: [•]

Application Method: [ ] Email [ ] KEP [ ] Written Application (Wet Signature) Identity Verification: The applicant’s identity is verified by comparing the information stated in the application form with the information held by PRIVON. Applications for which identity cannot be verified are treated as incomplete under Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, and the applicant is notified of the deficiency.

Date: [•] Signature (for written applications): [•]