Data Protection Notice

Pursuant to Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by ARFIKEDA in its capacity as data controller within the scope explained below. Data Controller: Legal name: [Company Legal Name] (ARFIKEDA) Address: [Full Address] Trade Registry / Mersis No: [Mersis No] Email: contact@arfikeda.com Phone: +90 544 419 55 57

The following categories of personal data may be processed within the scope of our services: • Identity data: First name, last name • Contact data: Email address, phone number • Customer/transaction data: Account details, subscription and order records, billing information • Payment data: Payment transactions are carried out via Stripe; card details are not stored by us • Transaction security data: IP address, session records, logs • Usage data: Service usage statistics, cookie data

Your personal data is processed for the following purposes: • Providing the services and creating and managing your account • Carrying out subscription, billing and payment processes • Responding to customer support requests • Ensuring service security and preventing fraud • Fulfilling legal obligations • Marketing and informational communications, where you have given consent • Measuring and improving service quality

Your personal data is processed on the following legal grounds set out in Articles 5 and 6 of the KVKK: • Processing being necessary for the establishment or performance of a contract • The data controller fulfilling its legal obligation • Being mandatory for the establishment, exercise or protection of a right • Legitimate interests of the data controller, provided that they do not harm the fundamental rights and freedoms of the data subject • Your explicit consent where required (e.g. commercial electronic messages)

Your personal data may be shared, to the extent necessary to provide the service and in compliance with the KVKK, with the following parties: • Payment service providers (Stripe) • Cloud infrastructure and hosting providers • AI/language model service providers (to the extent required by the service) • Authorized public institutions (upon legal request) Where transfer abroad is involved, the conditions required under Article 9 of the KVKK are observed. Your data is not sold to third parties for marketing purposes.

Your personal data is collected electronically by automated and partially automated means through our website, registration and order forms, account transactions, customer support channels, cookies and similar technologies.

Your personal data is retained for the period required by the processing purpose and the legal periods set out in the relevant legislation: • Account data: For as long as your account is active • Invoices and financial records: 10 years (legal requirement) • Logs: For the period required by applicable legislation Data whose retention period has expired is deleted, destroyed or anonymized.

Pursuant to Article 11 of the KVKK, by applying to the data controller you have the right to: • Learn whether your personal data is processed • Request information if it has been processed • Learn the purpose of processing and whether it is used in accordance with that purpose • Know the third parties to whom it is transferred domestically or abroad • Request correction if processed incompletely or inaccurately • Request deletion or destruction • Request that correction/deletion be notified to third parties to whom the data was transferred • Object to a result against you arising from analysis exclusively by automated systems • Request compensation for damage due to unlawful processing

You may submit your requests regarding the above rights, together with information verifying your identity, through the following channels: Email: contact@arfikeda.com Phone: +90 544 419 55 57 Your requests will be concluded free of charge as soon as possible and within 30 days at the latest, depending on their nature. If the process requires an additional cost, the tariff determined by the Board may apply. If you believe your rights have been violated, you may apply to the Turkish Personal Data Protection Authority: www.kvkk.gov.tr