I. DATA PRIVACY COMMITMENT
This Personal Data Protection Policy (”Policy"), Luxury Furniture San. Tic. A.P.(The“company”) of the Law No. 6698 on protection of personal data in accordance with the provisions of the legislation in fulfilling its obligations to protect personal data and when processing personal data within the company and/or procedures that must be followed by the Company defines.
The Company undertakes to comply with this policy and the procedures to be applied depending on the policy in terms of personal data contained within it.
II.PURPOSE OF POLICY
The main purpose of this policy is to define the principles of methods and processes for processing and protecting personal data by the company.

III. SCOPE OF POLICY
This policy covers all activities related to the personal data that the company processes and applies to those activities.
This policy does not apply to data that is not personal data.
This policy may be amended from time to time with the approval of the Board of partners if required by the KVK regulations.
In the event of a discrepancy between the KVK regulations and this policy, the KVK regulations are based.
IV.Definitions
Definitions adopted in this policy include the following meanings;
"Express consent" refers to consent based on information about a particular subject and expressed by free will.

“Anonymization " means that personal data cannot be associated with an identified or identifiable natural person under any circumstances, even by matching it with other data.

"Disclosure obligation" refers to the obligation of the data officer or authorized person to provide information to the data subject in accordance with Article 10 of the KVKK during the acquisition of personal data.

"Personal data “means any information relating to an identified or identifiable natural person (under this policy,” Personal Data “shall include, to the extent appropriate, the" special qualified personal data " defined below).

“The processing of personal data” personal data fully or partially automated, with the record to be part of any data recording system or non-automatic means obtaining, recording, storage, preservation, alteration, rearrangement, disclosure, transfer, acquisition, can be obtained, making the classification or use refers to any operation that is performed on the data such as the Prevention of.

"Board" means the Personal Data Protection Board.

"Institution" means the Personal Data Protection Agency.

"KVKK" refers to the Personal Data Protection Law No. 6698.

“KVK Arrangements” personal data protection law No. 6698 for the protection of personal data with other relevant legislation, regulatory and supervisory authorities, official authorities issued by courts and other binding decisions, policy decisions, provisions, conditions and data protection legislation and any other applicable international agreements for the references.

“KVK procedures " refers to procedures that determine the obligations that the company and its employees must comply with under this policy.

“Special personal data qualified” People, race, ethnic origin, political opinion, philosophical belief, religion and sect, or other beliefs, costume and clothing, Association or trade union membership, health, sexual life, criminal convictions and security measures, and biometric data and genetic data refers to.



“Deletion or deletion” means that personal data is in no way accessible and reusable for the respective users.

“Data processor " means a natural or legal person who processes personal data on behalf of the data processor, authorized by the data processor.

"Data subject" means all natural persons whose personal data is processed by or on behalf of the company.

"Data Officer" means a natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

“Destruction " means the process of making personal data inaccessible, irrevocable and reusable by anyone in any way.

V. PRINCIPLES OF PERSONAL DATA PROCESSING
Processing of personal data in compliance with the law and integrity rules
The company processes personal data in accordance with the law and the rules of honesty and on the basis of moderation.

Taking necessary measures to ensure that personal data is accurate and up-to-date when necessary
The company takes all necessary measures to ensure that the personal data is complete, accurate and up-to-date, and updates the relevant personal data if the data subject requests changes to the personal data in accordance with the KVKK regulations.

Processing of personal data for specific, explicit and legitimate purposes
Prior to the processing of personal data, the company determines for what purpose the personal data will be processed. In this context, the data subject is illuminated within the scope of the KVK regulations and their explicit consent is obtained if necessary.

Personal data is linked, Limited and limited to the purpose for which they are processed
The company processes personal data only in exceptional circumstances under the KVK Regulations (Article 5.2 and Article 6.3 of the KVKK) or for the purpose of explicit consent obtained from the data subject (Article 5.1 and Article 6.2 of the KVKK) and in accordance with the basis of moderation. The data officer processes personal data in a manner that is conducive to the realization of the specified goals and avoids processing personal data that is not related to the realization of the goal or is not needed.



Retention of personal data for the period stipulated in the relevant legislation or required for the purpose for which they are processed
The company retains personal data as necessary for the purpose. If the company wishes to retain personal data for a period longer than the period stipulated in the KVK regulations or required for the purpose of processing personal data, the Company shall comply with the obligations specified in the KVK regulations.
After the period required for the purpose of processing personal data has expired, personal data is deleted or anonymized. In this case, third parties to which the company transfers personal data also delete, destroy or anonymize personal data.
The company and persons authorized by the company are responsible for the operation of the processes of deletion, destruction and anonymization. In this context, the company creates the necessary technical and administrative procedures to carry out the work.
VI. PROCESSING OF PERSONAL DATA
Personal data can only be processed by the company in accordance with the procedures and principles set out below.

Explicit Consent
Personal data is processed after the information to be made within the framework of the fulfillment of the obligation to inform the data subjects and if the data subjects give explicit consent.
The explicit consent of the data subject must be disclosed in relation to a particular subject, based on information and of free will.
Data subjects are notified of the processing of their personal data, the purposes of transmission, the groups of recipients, the identity of the data controller, the method of collection of personal data, the legal reasons and the rights of the data subjects within the framework of the disclosure obligation.
The explicit consent of the data subject is obtained by methods in accordance with the KVK regulations. Explicit consent is evidently maintained by the company for the period required under the KVK regulations.
Processing Of Personal Data Without Explicit Consent
In cases where processing of personal data is provided without explicit consent under the KVK Regulations (Article 5.2 of KVKK), the company may process personal data without explicit consent of the data subject. If personal data is processed in this way, the company processes personal data within the limits set out by the KVK regulations. In this context,:
In other words, if there is a clear provision in the law regarding the processing of personal data, personal data may be processed by the company without explicit consent.
Personal data may be processed by the company without express consent if the data subject, who is unable to disclose his consent due to actual impossibility or whose consent is not granted legal validity, is required to protect the life or body integrity of himself or someone other than the data subject.
Data subject is directly related with the formation or performance of a contract is a party, provided that if the parties to the contract is required for the processing of personal data personal data can be handled by the company without the express consent of the data subject.
If the processing of personal data is mandatory for the company to fulfill its legal obligation, personal data may be processed by the company without the explicit consent of the data subjects.
Personal data that has been publicly disclosed in any way by the data subject may be processed by the company without explicit consent.
If the processing of personal data is mandatory for the establishment, use or protection of a right, personal data may be processed by the company without explicit consent.
Personal data may be processed by the company without express consent if data processing is mandatory for the legitimate interests of the company, provided that it does not harm the fundamental rights and freedoms of the data subject.
VII. PROCESSING OF SPECIALLY QUALIFIED PERSONAL DATA
Personal data of special nature may only be processed if the data subject has the explicit consent or if it is explicitly required by law to process personal data of special nature other than sexual life and personal health data.