CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA

As the Olivium Outlet Center Shopping Mall ("Mall"), in our capacity as data controller pursuant to the Law on the Protection of Personal Data No. 6698 ("KVKK"), we would like to inform you about the processing of your personal data. This Clarification Text has been prepared to clearly and comprehensibly explain how your personal data is collected, for what purposes it is processed, how it is protected, and what your rights are under the KVKK when you use the the OLIVIUM Mall website or interact with our services in any way.

1. Identity and Contact Details of the Data Controller

Data Controller: Olivium Outlet Center Shopping Mall (Mall)
Address: Prof. Dr. Muammer Aksoy Cad. No: 30/2 Zeytinburnu / Istanbul
E-mail: info@olivium.com.tr

Data Protection Contact Person: For all your questions, requests, and applications regarding your personal data, you may use the contact details above. The contact information of the data protection contact person designated by the Mall pursuant to the KVKK is provided below.

2. Why is This Notice Being Sent?

Within the scope of the Law on the Protection of Personal Data No. 6698 (KVKK), the Mall is obliged to notify all data subjects of the data collected about them.

3. What Topics Does This Notice Cover?

• What data is collected?
• For what purpose is the data used?
• With whom is the data shared?
• What is the legal basis for retaining your data?
• For how long will we retain your data?
• Your individual rights under the Law on the Protection of Personal Data No. 6698 (KVKK).

4. For What Purposes, On What Legal Basis, and What Personal Data Do We Process?

In the event that you contact Olivium Outlet Center through the communication channels, website, digital platforms, Mall service areas, and campaign processes specified below, your personal data may be processed in accordance with Articles 5 and 6 of the Law on the Protection of Personal Data No. 6698 for the purposes of: providing Mall services, managing store and event processes, enabling you to benefit from campaigns and loyalty programs, managing visitor relations processes, providing parking and customer services, handling suggestion, request, and complaint processes, conducting analyses of shopping and visit habits, enhancing customer satisfaction, improving service quality, carrying out information security processes, meeting requests from official institutions and organizations, fulfilling obligations arising from legislation, and establishing, exercising, or protecting rights in possible legal disputes.

In this context, your identity, contact, customer transaction, financial, transaction security, physical space security, visual and audio data, as well as behavioral data obtained through cookies — including IP address, device information, geographical location, website and mobile application usage movements, visit duration, page views, browsing information, campaign participation data, store and event preferences, and usage habits — may be processed.

Furthermore, where your explicit consent exists, your personal data may be processed for the purposes of: presenting campaign, store, and event recommendations suited to your interests, conducting personalized advertising and marketing activities, performing data analytics, statistical evaluations, and market research, carrying out analysis and profiling activities regarding your visit and shopping habits, and managing joint campaign processes with business partners and stores.

Image recordings obtained through closed-circuit camera systems (CCTV) located in common areas may be retained for a limited period in accordance with the relevant legislation for the purposes of conducting security processes, ensuring visitor safety, and fulfilling legal obligations. You acknowledge, declare, and undertake that you are aware that you have the right to withdraw your explicit consent at any time.

5. With Whom and For What Purpose Do We Share Your Personal Data?

Based on the provisions of the Law on the Protection of Personal Data No. 6698 ("KVKK"), your personal data is processed in a manner that is lawful and fair, accurate and up-to-date where necessary, for specific, explicit and legitimate purposes, and in a manner that is connected to, limited to, and proportionate to the purposes for which it is processed. It may be shared with the relevant public institutions and organizations for the purposes of resolving possible legal disputes, conducting investigation, judicial, and administrative oversight processes, fulfilling legal obligations, and meeting information and document requests from public institutions and organizations authorized to make such requests under the relevant legislation.

In addition, personal data may also be shared with commercial service providers and data processor suppliers who provide support in areas such as information technology, infrastructure, call center, security, marketing, data storage, and customer relationship management within the scope of conducting our activities. Such data processors act solely in accordance with instructions given by the data controller and undertake that they will not use your personal data for their own purposes, will maintain its confidentiality, and will ensure the necessary technical and administrative security measures. All data transfers specified above are carried out in accordance with the provisions regarding the transfer of personal data regulated under Article 8 of the KVKK and with the necessary data security measures in place.

6. Your Rights Under the Law on the Protection of Personal Data No. 6698 (KVKK)

• To learn whether your personal data has been processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is being used in accordance with that purpose,
• To know the third parties to whom personal data has been transferred, domestically or abroad,
• To request the correction of personal data if it has been processed incompletely or inaccurately,
• To request the deletion or destruction of personal data,
• To request that the transactions related to the correction, deletion, or destruction of personal data be notified to the third parties to whom the personal data has been transferred,
• To object to a result arising against oneself as a consequence of the analysis of processed data exclusively through automated systems,
• To demand compensation for damages in the event of suffering loss due to personal data being processed in violation of the law.

7. Measures for the Protection of Your Personal Data

The protection of personal data is an important matter for us. Our Company takes the necessary technical and administrative measures to protect personal data against unauthorized access, loss, misuse, disclosure, alteration, or destruction. Our Company undertakes to keep your personal data confidential, to take all necessary technical and administrative measures, and to exercise the necessary care to ensure confidentiality and security.

In this context, technical measures such as access control mechanisms, authorization systems, data encryption methods, log record keeping, penetration tests, network and system security measures, and regular audits and risk analyses are applied; additionally, administrative measures such as confidentiality obligations for employees, data security training, and the establishment and implementation of internal policies and procedures are also put into practice.

Notwithstanding the necessary information security measures taken by our Company, in the event that personal data is damaged or falls into the hands of third parties as a result of attacks on the website or system, our Company shall immediately notify you and the Personal Data Protection Board of such a situation.

Our Company shall also conduct the necessary investigations and audits to prevent recurrence of data breaches, review existing security systems to make necessary improvements, and continue its efforts to continuously improve the level of data security.

8. Deletion, Destruction, or Anonymization of Your Personal Data

Your personal data processed for the purposes specified in this notice shall be deleted, destroyed, or anonymized and continue to be used — automatically or upon your request — in accordance with our Company's Personal Data Retention and Disposal Policy, when the purpose requiring its processing ceases to exist and, where applicable, when the periods specified in the relevant laws expire.

Your personal data processed for the purposes specified in this Clarification Text shall be deleted, destroyed, or anonymized — automatically or upon your request — in accordance with our Company's Personal Data Retention and Disposal Policy, in the event that the relevant data processing purpose ceases to exist, the legal basis requiring its processing comes to an end, and/or the retention periods stipulated in the relevant legislation, primarily the Law on the Protection of Personal Data No. 6698 ("KVKK"), expire.

The deletion, destruction, or anonymization of personal data is carried out within the framework of periodic disposal processes determined by our Company, in accordance with the provisions of Article 7 of the KVKK and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data. In this process, the destruction of data in a manner that cannot be restored or reused is ensured, while anonymized data — rendered no longer associated with an identified or identifiable natural person — may be used for statistical and similar purposes.

Furthermore, within the framework of the rights you hold under Article 11 of the KVKK, should you request the deletion or destruction of your personal data, your request shall be evaluated by our Company in accordance with the legislation and shall be fulfilled if the legal requirements are met. However, if there is a legal obligation or a legitimate reason requiring the continued processing of the relevant data, such data may continue to be retained solely within that scope.

Our Company manages the processes of retaining and disposing of personal data in compliance with the KVKK and the relevant secondary legislation, and ensures that these processes are carried out in a transparent, auditable manner and in a way that guarantees data security.

You may submit your requests regarding your rights under Article 11 of the KVKK by: using a secure electronic signature or mobile signature via our registered electronic mail (KEP) address; sending an e-mail through your e-mail address registered in our systems; or delivering a written, wet-signed petition in person, through a notary, or to the contact addresses specified below. Furthermore, if you believe that your personal data has been processed unlawfully, that your requests have not been properly addressed, or that your applications have not been responded to within the required time, you also have the right to file a complaint with the Personal Data Protection Board. You may follow changes within the scope of the legislation on personal data and our practices at any time on the relevant page of our website.

Address: Prof. Dr. Muammer Aksoy Cad. No: 30/2 Zeytinburnu / Istanbul
Phone: +90 212 547 74 53
Email: info@ olivium.com.tr
Website: www.olivium.com.tr