Privacy and Security

KVKK Information Notice

Personal Data Policy

Promise Athletic Personal Data Policy

General Information About the Personal Data Protection Law

The Personal Data Protection Law No. 6698 (hereinafter referred to as KVKK) was adopted on March 24, 2016, and published in the Official Gazette dated April 7, 2016, No. 29677. Part of the KVKK came into effect on the date of publication, and the remaining part on October 7, 2016.

Notification as the Data Controller

In accordance with the KVKK No. 6698, and in the capacity of Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties (in cases permitted by legislation), classified, and processed as outlined on this page and as defined in the KVKK.

How Your Personal Data May Be Processed

In accordance with the KVKK No. 6698, the personal data you share with our company may be fully or partially obtained, recorded, stored, modified, reorganized, and processed by us, through automatic or non-automatic methods, as part of any data recording system. Any operation performed on data within the scope of the KVKK is considered as “processing of personal data.”

Purposes and Legal Reasons for Processing Your Personal Data

Your personal data is processed for the following purposes:

• To fulfill the requirements of the services we provide to our customers and to develop our products and services in accordance with contractual and technological requirements;

• To comply with the Law on Regulation of Electronic Commerce No. 6563, the Consumer Protection Law No. 6502, and other related regulations, and to record identity, address, and other necessary information to identify the transaction owner within the scope of relevant regulations;

• To create all records and documents in electronic or paper format as a basis for processing in the field of banking and electronic payments;

• To comply with legal obligations for information storage, reporting, and disclosure;

• To provide information to prosecutors, courts, and relevant public officials when requested and as required by legislation in cases related to public security and legal disputes.

Your personal data will be processed in compliance with the KVKK No. 6698 and related secondary regulations.

Disclosure Regarding Third Parties or Organizations to Whom Your Personal Data May Be Transferred

For the purposes listed above, your personal data may be shared with third parties, such as our service providers, courier companies, business partners, and domestic and foreign organizations, including but not limited to Shopify, which provides our e-commerce infrastructure.

How Your Personal Data Is Collected

Your personal data may be collected:

• Through forms on our website and mobile applications, which include information such as name, surname, ID number, address, phone number, work or personal email address, as well as IP records of transactions conducted on pages accessed using username and password, cookie data collected by the browser, navigation times, and details, and location data;

• From our sales and marketing departments, branches, suppliers, other sales channels, written or electronic forms, business cards, digital marketing, and call center channels;

• Through physical or virtual media from individuals who establish a commercial relationship with our company, apply for a job, submit a proposal, or share personal data through various means such as business cards or resumes (CV);

• Indirectly through various channels, including our website, blog, microsites, social media, newsletter reading or clicking activities, publicly available databases, and social media profiles shared publicly.

Personal Data Collected Before the Enactment of KVKK

Personal data collected in compliance with the law before the effective date of KVKK on April 7, 2016, is processed and stored in accordance with the terms and conditions outlined in this document.

Transfer of Your Personal Data Abroad

Your personal data, collected through any of the methods mentioned above and processed in Turkey or stored abroad, may be transferred to foreign service providers accredited by the Personal Data Protection Board in countries with adequate data protection as per KVKK and in line with contractual purposes.

Storage and Protection of Personal Data

Your personal data will be kept confidential in the database and systems within our company in accordance with Article 12 of the KVKK and will not be shared with third parties except in cases of legal obligations and as stated in this document. Our company is responsible for taking software-based and physical security measures to prevent unauthorized access, as required by Article 12 of the KVKK. In case personal data is acquired by third parties unlawfully, the situation will be reported to the Personal Data Protection Board in accordance with legal regulations.

Keeping Personal Data Accurate and Up-to-Date

According to Article 4 of the KVKK, our company is responsible for keeping your personal data accurate and up-to-date. Therefore, to fulfill our legal obligations, we ask our customers to provide accurate and current data and to update their data via our website/mobile application.

Rights of Personal Data Owners Under the KVKK No. 6698

Article 11 of the KVKK, which came into effect on October 7, 2016, provides the following rights to data owners:

• To learn whether their personal data has been processed,

• To request information if their data has been processed,

• To learn the purpose of data processing and whether their data is used in accordance with that purpose,

• To know the third parties to whom personal data has been transferred domestically or abroad,

• To request the correction of incomplete or incorrect data,

• To request the deletion or destruction of data as per Article 7 of KVKK,

• To request notification of these actions to third parties to whom the data has been transferred,

• To object to any adverse outcome due to the analysis of processed data exclusively through automated systems,

• To request compensation for damages if they suffer any loss due to unlawful processing of personal data.

GARMIRA PAZARLAMA A.S

Mersis No: 0389 1930 2470 0001

Our company is the Data Controller under KVKK. Once the legal infrastructure is established, the appointed Data Controller Representative will be announced on the Data Controllers Registry and on this internet address.

Personal Data Owners can direct their questions, opinions, or requests to us via the following communication channels:

• Email: [email protected]

• Phone: +90 534 813 6191