Pursuant to Law No. 6698 on the Protection of Personal Data (“the Law”), LC WAIKIKI Mağazacılık Hizmetleri Ticaret Anonim Şirketi (“LC Waikiki” or “Company”) may process your personal data as the data controller, within the scope specified below.

A. Identity of Data Controller

Title: LC Waikiki Mağazacılık Hizmetleri Ticaret Anonim Şirketi

MERSİS Number: 0837007181700013

Address: 15 Temmuz Mahallesi, Gülbahar Caddesi No: 41 Bağcılar / İSTANBUL

Phone: +90 212 657 55 55

E-mail: [email protected]

Registered Electronic Mail (REM) Address: [email protected]

B. Categories and Types of Processed Personal Data

Personal Data Categories	Data Types
Identity Information	Your name, surname and, if shared by you, gender, T.R. identity number, date of birth, title, marital status
Contact Information	Your address information (including billing and delivery addresses), address information regarding the relevant recipient if you benefit from our “Buy for Me” service, your e-mail address, your phone number
Location Information	Real-time location information of your current location, limited solely to enabling you to view the nearest store (your location information is not stored or separately recorded by us)
Customer Transaction Information	Your order information, delivery transaction information, transaction history regarding your purchases, membership information, membership, points, campaign, benefit and advantage usage information within the scope of the loyalty program, and gift card usage information if applicable
Request and Complaint Information	Your call center records, request and complaint information, data subject applications, suggestion and satisfaction information
Financial Information	Your billing information, payment method and payment details, bank account information, credit card information, LCW Money information
Physical Space Security Information	If applicable, camera records of the relevant store within the scope of return/exchange transactions carried out in stores
Legal Action Information	Your information in correspondence with judicial authorities, information in the case file, transactions arising from withdrawal and similar consumer protection legislation, consumer arbitration committee transactions
Transaction Security Information	Your membership password information, IP address, device information, log records, information about transactions regarding access to your account such as password changes
Marketing Information	Your shopping history information, and if applicable, information obtained through surveys, cookie records, and campaign studies
Visual and Audio Records	Your photograph, video, and voice recordings

Although your credit card information, such as bank information, bank card or credit card number, expiration date, and CVV code, is processed during the sale, this data is not stored by LC Waikiki. Limited financial information (e.g., the last 4 digits of your card number) is processed by LC Waikiki for the purposes of maintaining sales records and fulfilling requests such as returns and exchanges in accordance with the relevant legislation, and this processing is limited to the purposes stated below.

Cookies: You may access information regarding the processing of your personal data through cookies used on our site from the Cookie Clarification Text.

C. Processed Personal Data, Purpose of Processing and Legal Grounds

Your personal data will be processed within the framework of the personal data processing conditions specified in Article 5 of the Law for the purposes ("Purposes") set forth below:

Personal Data Categories	Purpose of Processing	Legal Grounds
Identity, contact, customer transaction, transaction security, legal action, request and complaint, location, visual and audio records, financial information, and if applicable, physical space security and marketing information	Management of transactions and requests related to the follow-up of financial and sales records, Providing special advantages and conveniences in return and exchange transactions, Execution of accounting and finance processes, Carrying out necessary work for the realization of commercial activities, planning business strategies, and managing associated business processes, Performing controls to ensure the security of the website/mobile application and information security enhancement activities, Providing the opportunity to add comments, evaluating comments, and informing you about the status of your comment, Carrying out gift card processes, ensuring, verifying and tracking the use of gift cards, and carrying out the balance, usage and transaction processes regarding gift cards, Carrying out necessary work by our business units to benefit data subjects from products and services offered by our Company, including sales and marketing activities of our products and services, and execution of related business processes, Carrying out customer acquisition activities, Providing information to 3rd real or legal persons with whom a business relationship is entered into within the scope of the execution of commercial activities carried out by LC Waikiki, Managing customer relations and ensuring the accuracy and currency of customer contact information, Ensuring the legal, technical, commercial, and business safety of our Company and relevant persons, Determining and implementing our Company's commercial and business strategies, Carrying out necessary work by our business units and executing related business processes for conducting all necessary research, development, corrective and preventive activities in order to resolve your requests and complaints and prevent their recurrence, Planning and execution of customer satisfaction and corporate communication activities, Planning and execution of raffle, campaign, competition, promotional activities, and controlling whether the conditions for participation in the relevant activity are met within this scope, Ensuring the results arising from the said legal transactions in case of the division of the Company or the transfer of all or a part of it to another company, In case you are a member of our loyalty program; carrying out loyalty building and development activities regarding the loyalty program, In case you are a member of our loyalty program; ensuring that records and transactions are kept and executed in a compliant manner in the event that there is a third-party contracted organization enabling the utilization of the relevant additional benefit, In case you are a member of our loyalty program; measuring and reporting the effectiveness of the benefits and campaigns offered within the scope of the loyalty program, In case you are a member of our loyalty program; carrying out activities for the control, detection and prevention of fraudulent transactions and/or abuse of the loyalty program.	It is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject
Identity, contact, customer transaction, transaction security, legal action, request and complaint, visual and audio records, financial information, and if applicable, physical space security information	Fulfilling the legal obligations to which our Company is subject, primarily the Law on Consumer Protection, the Law on the Regulation of Retail Trade, and the Law on the Regulation of Electronic Commerce, Providing information to authorized organizations and fulfilling requests of official institutions, Ensuring compliance with storage obligations stipulated in the legislation, Evaluating your applications submitted to the Company regarding the exercise of your rights specified in Article 11 of the Law concerning your personal data processed by our Company, finalizing them in accordance with the legislation, and carrying out the necessary procedures within this framework, Detection and prevention of fraud risk, ensuring payment security, prevention of abuse, and reducing the risks of financial loss and chargeback.	It is expressly provided for by the laws and it is necessary for compliance with a legal obligation to which the data controller is subject
Identity, contact, customer transaction, transaction security, location, financial information, and if applicable, physical space security information	Presenting products and services through our stores, website, and mobile application and carrying out sales transactions, Establishing sales contracts and carrying out invoicing processes, Providing and transmitting invoices electronically within the scope of the easy invoice tracking service, Carrying out and completing orders, delivery processes and ensuring communication, Fulfilling after-sales support services and warranty processes, Execution of order processes, providing information regarding the delivery status of purchased products and service changes, and carrying out communication activities regarding current product stock information upon request, In case you create a membership for our loyalty program; creating membership accounts and executing membership transactions, and if applicable, carrying out the closure/deletion of the membership account, In case you become a member of our loyalty program; creating and making available the additional benefits you have earned, informing you about the earned additional benefits, and making reminders for those whose validity period is about to expire.	Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract
Identity, contact, customer transaction, legal action, request and complaint, visual and audio records, financial information, and if applicable, physical space security information	Receiving, evaluating, and finalizing your requests and complaints, managing customer relations, and providing digital assistance services, Following up and executing legal affairs, and storing personal data during the general statute of limitations in order to constitute evidence in possible future disputes.	Data processing is necessary for the establishment, exercise or protection of a right
Identity, contact, customer transaction and marketing information	Carrying out profiling and analysis activities and recommending products/services by customizing them according to your needs, Sending commercial electronic messages via e-mail, SMS, Whatsapp, and/or call channels based on your communication preference.	Based on your explicit consent

D. Parties to Whom Your Personal Data is Transferred and Purposes of Transfer

Your personal data collected in line with the fulfilment of the Purposes set forth above may be transferred to the parties specified below, within the framework of the personal data processing conditions specified in Article 5 of the Law and in accordance with the rules regarding the transfer of personal data as set forth in Articles 8 and 9 of the Law:

Recipient	Purpose of Transfer	Legal Grounds
To legally authorized public institutions and legally authorized private persons	Execution of legal processes and fulfilment of obligations arising from the legislation	Expressly provided for by the laws and it is necessary for the fulfillment of the legal obligation of the data controller
To Tanı Pazarlama ve İletişim Hizmetleri A.Ş., in its capacity as the provider of the Chippin program	Carrying out relevant transactions in the event that you have a Chippin membership and wish to use this membership within the scope of your shopping	Processing of data is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject
To the relevant company to which the assets will be transferred in case of division or transfer	Ensuring the results arising from legal transactions within the scope of the said division/transfer	Processing of data is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject. Explicitly provided for by the laws
To the person whom you wish to perform the purchase and/or the person to whom the products will be delivered	Carrying out sales and delivery processes if you benefit from our “Buy for Me” service within the scope of providing our Company's products and services to you via our mobile application	Processing of data is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject
To supplier companies from which we procure services (cargo, call center, research companies, advertising agencies, etc.) and other technical service providers (infrastructure, database management, etc. service providers)	Providing outsourced support services, infrastructure and information technology services, in particular the execution of cargo processes, execution of call center activities, execution of research and marketing activities, and execution of advertising processes	Processing of data is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject
To business partners, group companies, subsidiaries, and shareholders	Execution of business activities and coordination of business processes, provision of services and execution of operational processes	Processing of data is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject
To the relevant contracted party, in the event that you are a member of our loyalty program and in case there is a third-party contracted organization enabling the utilization of the relevant additional benefit	Ensuring that the registration and transactions for the loyalty program are kept and executed in a compliant manner	Processing of data is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject
To foreign suppliers	Use of cloud computing services, execution of system infrastructure, data storage, hosting, and execution of operational processes, Providing advertising, measurement, analysis, and related digital services, evaluating system and service performance, analysing user interactions, and executing related operational processes, Execution of digital advertising activities, managing advertising and marketing processes, and executing related operational processes, Communication, collaboration, data storage, document and file management, execution of business processes, realization of operational activities, and provision of related technological infrastructure services, Execution of customer relations processes, carrying out survey and evaluation activities for customer satisfaction, planning and execution of raffle, campaign, and marketing activities.	Existence of a standard contract declared by the Board (including data categories, purposes of transfer, recipient groups, technical and administrative measures to be taken by the data recipient, and additional measures taken for special categories of personal data, if any)

E. Method of Personal Data Collection

Your personal data is collected in verbal, written, or electronic media through automatic or non-automatic methods; physically via sales stores, offices, branches, through meetings held and forms when you communicate through them; and electronically through the call center, website, social media, communication applications, mobile applications, through parties providing the service if you use third-party accounts during platform login, and via online forms such as membership and sales forms, and comment areas, verbally or in writing. If you are a member of our loyalty program, your personal data may also be obtained through third parties with whom we cooperate within the scope of the loyalty program.

F. Rights of Data Subjects under the Law

As the data subject (relevant person), you may submit your requests regarding your rights specified in Article 11 of the Law by filling out the form available at https://corporate.lcwaikiki.com/Kisisel-verilerin-islenmesi-aydinlatma-metni in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. You may send your requests in writing, via registered electronic mail (REM/KEP), secure electronic signature, mobile signature, or by using the e-mail address previously notified to us and registered in our system, to the following addresses:

Address: 15 Temmuz Mahallesi, Gülbahar Caddesi No: 41 Bağcılar / İSTANBUL

Registered Electronic Mail (REM/KEP) Address: [email protected]

E-mail Address: [email protected]

Submitted for your information.

LC Waikiki Mağazacılık Hizmetleri Ticaret A.Ş.