PERSONAL DATA PROTECTION POLICY AND PRIVACY NOTICE

This Policy has been prepared by Franny, acting as the data controller as defined under the Turkish Personal Data Protection Law No. 6698 (“KVKK” or the “Law”), in order to explain the purposes and methods of processing personal data provided directly or indirectly by you and/or collected by us, and how such data is used.

1. WHO ARE WE?

Franny is an online shopping website operating under the name Fatma Leyla Kalkan, with its address at Tatar Beyi Sokak, No: 17/3, Beyoğlu, Istanbul, Turkey. Hereinafter, it shall be referred to as “Franny” or “we”.

2. WHAT DATA DO WE COLLECT?

Personal Data means any information relating to an identified or identifiable natural person. Depending on your interactions with our website at www.franny.com.tr, such as visiting the website, creating an account or making a purchase, we may collect and use the following personal data:

Identity Data: Identifying information limited to your first and last name.

Contact Data: Your contact details, including your e-mail address, telephone number and address.

Technical Data: Your Internet Protocol (IP) address, login and user access information (such as session times or device identifiers), browser type and version, device operating system and general platform information, device identifiers (such as cookie IDs), and IP-based location information.

Marketing and Communication Data: Your preferences regarding receiving promotional, advertising and similar marketing communications from us and third parties, as well as your communication preferences.

Special Categories of Personal Data: Sensitive data such as your race or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health data, genetic and biometric data, and criminal record information. Franny does not request or process special categories of personal data from visitors or members.

3. HOW DO WE COLLECT PERSONAL DATA?

We use different methods to collect data, including:

Directly: Where you complete membership forms or contact us by telephone, e-mail or through our customer service channels, your personal data may be recorded and processed to the extent necessary.

Automatically: When you visit our website and/or application, Technical Data relating to your device and browsing activities may be collected automatically. For further information regarding automatically collected data, please refer to our Cookie Policy.

Indirectly: Personal data may be collected from third parties such as payment service providers.

4. FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA AND WHAT ARE OUR LEGAL BASES?

The personal data listed above is processed for the following purposes and on the following legal bases:

Identity Data: Identity data consisting of your first and last name is processed for the purposes of enabling you to create an account on the website and make purchases, delivering purchased products to you, responding to your post-order requests, conducting activities in compliance with applicable legislation, carrying out finance and accounting operations, conducting communication activities, following up and conducting legal matters, carrying out product and service sales processes, following up requests and complaints, and providing information to authorized persons, institutions and organizations where necessary.

Such data is processed through automated or non-automated means on the legal bases that processing is expressly provided for by law (Article 5/2(a) of the Law); processing is necessary for the establishment or performance of a contract, provided that it is directly related to the personal data of the parties to the contract (Article 5/2(c)); processing is necessary for the data controller to fulfill its legal obligations (Article 5/2(ç)); and processing is necessary for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject (Article 5/2(f)).

No identity information other than first and last name is requested.

Contact Data: Your e-mail address, telephone number and address information are processed for the purposes of enabling you to make purchases through the website, communicating with you regarding your order, delivering purchased products to you, carrying out sales and after-sales processes, responding to requests and complaints, carrying out finance and accounting operations, conducting activities in compliance with applicable legislation, and providing information to authorized persons, institutions and organizations where necessary.

Electronic communications for marketing, advertising, campaign and promotional purposes are carried out where the permissions required under applicable legislation have been obtained and in accordance with your communication preferences.

Technical Data: Technical data obtained through your IP address, device and browser information, session and access information, device identifiers, cookies and similar technologies may be processed for the purposes of ensuring the secure and proper operation of the website, carrying out information security processes, conducting activities in compliance with applicable legislation, following up requests and complaints, and providing information to authorized persons, institutions and organizations where necessary.

To the extent applicable, such data is processed on the basis of the personal data processing conditions set out in Article 5 of the Law. With respect to cookies and similar technologies used for non-essential purposes such as analytics, personalization and marketing, data is processed in accordance with your preferences where required under applicable legislation.

Online Visitors: When you visit our website, technical data including your IP address, device and browser information and data obtained through cookies and similar technologies may be processed.

Cookies that are strictly necessary for the operation of the website are used for the purpose of providing the relevant services. You can manage your preferences regarding cookies used for non-essential purposes such as analytics, personalization and marketing through the cookie preference panel available on our website.

For further information regarding the use of cookies, please refer to our Cookie Policy.

5. TRANSFER OF PERSONAL DATA

Your collected personal data may be transferred, in accordance with the conditions set out in Articles 8 and 9 of the Turkish Personal Data Protection Law No. 6698 and other applicable legislation, only to the extent necessary for the relevant purposes and subject to appropriate technical and administrative measures, to:

public authorities and institutions legally authorized to request information and documents;

legal advisers and competent authorities for the conduct of legal proceedings;

shipping and logistics service providers for the delivery of orders;

payment service providers for the processing of payments;

infrastructure and technology service providers for the operation of the website and provision of its technical infrastructure; and

where the necessary permissions have been obtained, relevant service providers for the delivery of marketing communications.

Transfers of personal data are carried out in accordance with the personal data processing and transfer conditions prescribed by the Law and applicable legislation, depending on the nature of the transfer.

INTERNATIONAL TRANSFER OF PERSONAL DATA

Our website operates using Shopify infrastructure. Personal data processed through Shopify and other service providers located outside Turkey that are used in connection with the operation of our website may be transferred abroad due to the location of servers or relevant service providers outside Turkey.

International transfers of personal data are carried out in accordance with the conditions set out in Article 9 of the Turkish Personal Data Protection Law No. 6698 and applicable personal data protection legislation.

Franny’s website may contain links and/or integrations with third-party websites or services that you may choose to access, such as social media platforms and payment service providers.

When you use such links or services, the relevant third parties may process personal data in accordance with their own privacy policies. Such third parties are responsible for their own personal data processing activities and privacy practices.

THIRD-PARTY MARKETING

We will obtain your explicit consent before sharing your personal data with any third party for marketing purposes where such consent is required under applicable legislation.

For the avoidance of doubt, we do not directly disclose your personal data to advertisers. We may use personal data collected from you for audience targeting and website optimization, subject to applicable law and your preferences.

You may manage and change your preferences regarding non-essential cookies used for targeted advertising and marketing purposes at any time through the cookie preference panel available on our website.

We use cookies and similar technologies on our website to ensure that the website operates securely and properly, improve the user experience, analyze website usage and remember your preferences.

Cookies that are strictly necessary for the operation of the website are used for the purpose of providing the relevant services. Cookies used for non-essential purposes such as analytics, personalization and marketing are subject to your preferences.

When you first visit our website, you can accept or decline non-essential cookies or manage your preferences through the cookie preference panel presented to you. You can change your cookie preferences at a later time.

Our website operates using Shopify infrastructure. Shopify and other service providers we use may use cookies and similar technologies depending on the nature of the services they provide.

For further information about data processing activities carried out through these technologies, please refer to our Privacy Policy.

6. LEGAL BASIS FOR THE COLLECTION OF YOUR PERSONAL DATA

The legal framework applicable to the processing of your personal data includes:

Turkish Personal Data Protection Law No. 6698

Law No. 6563 on the Regulation of Electronic Commerce

Turkish Code of Obligations No. 6098

Tax Procedure Law No. 213

Turkish Commercial Code No. 6102

7. RETENTION PERIOD FOR PERSONAL DATA

Personal data collected and processed by Franny is retained for as long as required for the relevant processing purposes and within the statutory retention periods prescribed under applicable legislation, subject to the necessary administrative and technical safeguards.

Once the applicable retention period has expired and the reasons requiring the processing of personal data no longer exist, the personal data shall be deleted, destroyed or anonymized in accordance with applicable legislation.

8. DATA SECURITY MEASURES AND COMMITMENTS

Franny undertakes to take the necessary technical and administrative measures and carry out the necessary audits in order to ensure an appropriate level of security for:

• preventing the unlawful processing of personal data;

• preventing unlawful access to personal data; and

• ensuring the secure storage of personal data.

Access to your personal data is limited to the data controller and personnel assigned to carry out the purposes for which such data is processed, within the scope of their duties.

Necessary technical measures are taken to prevent access to your personal data by unauthorized third parties. Relevant personnel are provided with appropriate information and training regarding the processing and storage of personal data.

9. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?

Under Article 11 of the Law, individuals whose personal data is processed have the right to apply to the data controller and:

• learn whether their personal data is being processed;

• request information if their personal data has been processed;

• learn the purpose of processing their personal data and whether such data is being used in accordance with that purpose;

• know the third parties to whom their personal data has been transferred within Turkey or abroad;

• request correction of their personal data if it has been processed incompletely or inaccurately;

• request the deletion or destruction of their personal data within the framework of the conditions set out in Article 7 of the Law;

• request that third parties to whom their personal data has been transferred be notified of any correction, deletion or destruction of their personal data;

• object to any result arising against them through the analysis of processed data exclusively by automated systems; and

• claim compensation for damages suffered as a result of the unlawful processing of their personal data.

You may submit requests under the Law, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to:

Tatar Beyi Sokak, No: 17/3, Beyoğlu, Istanbul, Turkey

by means of a notary public or registered mail with return receipt requested.

You may also submit your request to hello@franny.com.tr using an e-mail address that you have previously provided to Franny and that is registered in our systems.

Your application must contain the information necessary to verify your identity and enable us to assess your request. Where necessary, additional information or documentation may be requested in order to process your application.

Applications will be processed free of charge as soon as possible and no later than 30 days, depending on the nature of the request. Where processing the request requires an additional cost, a fee may be charged in accordance with the tariff determined by the Turkish Personal Data Protection Board.

Your application may be accepted or rejected with an explanation of the reasons. The response will be communicated to you in writing or electronically. If your application is accepted, the necessary action will be taken.

Language