Privacy and Personal Data Protection Notice

As NYZ BEBE TEKSTİL KONFEKSİYON SANAYİ VE TİCARET LİMİTED ŞİRKETİ (the "Company"), we care about the security of your personal data. This notice is provided under Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") to inform you about the personal data processed in connection with the website and wholesale platform at https://electionbaby.com (the "Platform"), sales links, dealership and agent relationships and customer services.

1. Data controller

Your personal data is processed by the Company, as data controller, whose details are as follows:

• Legal name: NYZ BEBE TEKSTİL KONFEKSİYON SANAYİ VE TİCARET LİMİTED ŞİRKETİ
• Brand: election baby
• Address: 100. Yıl Mah. Nato Cad. No: 170/D-5, Bandırma / Balıkesir
• Tax office: Bandırma Vergi Dairesi Müdürlüğü
• Tax ID number: 6320869087
• Phone: +90 531 010 97 38
• Website: https://electionbaby.com

2. Categories of personal data processed

Depending on the nature of your relationship with us, the following personal data may be processed:

• Identity: first name, surname, Turkish ID number (for individual buyers who must be invoiced), title and position.
• Contact: phone number, email address, delivery and billing address.
• Customer transactions: dealership application, order, cart, quote, return, defect notice, current account and correspondence records.
• Financial: tax office and tax ID number, bank account (IBAN) details, payment and collection records, credit limit and payment terms. Card details are not processed by the Company; card payments are taken by licensed payment institutions.
• Legal transactions: contracts, accepted text versions, records relating to legal claims.
• Transaction security: user account, password hash, two-factor authentication records, IP address, browser information, session and transaction logs.
• Marketing: commercial electronic message preferences and interaction with campaign emails.
• Professional and business information: business, field of activity and commercial documents shared in the dealership application.

3. Method of collection

Your personal data is collected electronically or physically through registration, dealership application, order and contact forms on the Platform, orders placed through sales links, correspondence by email, phone and messaging, meetings with our sales representatives and agents, and automatically while you use the Platform (server logs and strictly necessary cookies).

4. Purposes and legal bases

Your personal data is processed for the following purposes on the legal bases set out in Article 5 KVKK:

• Assessing dealership applications, opening and managing dealer accounts; receiving, preparing and delivering orders, handling payment and collection, and assessing returns and defect notices: necessity for the formation and performance of a contract (Art. 5/2-c).
• Invoicing, e-invoice and e-archive processes, keeping commercial books and records, responding to requests of competent public authorities: compliance with a legal obligation of the controller and express provision by law (Art. 5/2-a and ç).
• Monitoring current accounts, collecting receivables and using records as evidence in disputes: establishment, exercise or protection of a right (Art. 5/2-e).
• Securing the Platform, preventing misuse and fraud, measuring service quality, calculating the performance and entitlements of sales representatives and agents, and managing customer relations: legitimate interest, provided that your fundamental rights and freedoms are not harmed (Art. 5/2-f).
• Retaining traffic and access logs under Law No. 5651: express provision by law (Art. 5/2-a).
• Informing buyers who are merchants or tradespeople about campaigns and products under Law No. 6563 on the Regulation of Electronic Commerce and the related regulation: express provision by law and legitimate interest; sending commercial electronic messages to persons who are not merchants or tradespeople: explicit consent (Art. 5/1).

You may exercise your right to opt out at any time free of charge through the link in every commercial electronic message or through the application channels below.

5. Transfer of personal data

Your personal data may be transferred, limited to the purposes above and in accordance with Articles 8 and 9 KVKK, to the following groups of recipients:

• Payment institutions and banks: to carry out card payments, bank transfers and refunds.
• Carriers and logistics companies: to deliver orders, collect cargo cheques and track shipments.
• E-invoice and e-archive integrators, financial advisors and auditors: for invoicing and statutory accounting obligations.
• IT, hosting, email and security service providers: to operate the Platform, deliver notifications and protect against bot attacks.
• Agents: only the order and product information, excluding payment details, of the customers assigned to them and of orders placed through their own sales links, to calculate their entitlements.
• Legal and advisory service providers: to protect rights and resolve disputes.
• Competent public authorities and courts: within the scope of legal obligations and requests.

Where our service providers are located abroad, transfers are made by providing one of the appropriate safeguards set out in Article 9 KVKK (including the standard contract announced by the Board) and making the required notifications.

6. Retention period

Your personal data is retained for as long as the purpose of processing requires and for the periods laid down in the applicable legislation. Commercial books and records, invoices and contracts are kept for ten years under the Turkish Commercial Code No. 6102 and the Tax Procedure Law No. 213; traffic logs for two years under Law No. 5651; rejected dealership applications for two years from the application date; and consent and opt-out records for commercial electronic messages for three years under the related legislation. At the end of these periods, personal data is erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

7. Data security

The Company applies technical and administrative measures such as encrypted connections, access authorisation, two-factor authentication for staff, transaction logging and regular backups to prevent unlawful processing of and access to your personal data and to ensure its safekeeping.

8. Your rights under Article 11 KVKK

As a data subject you have the right to apply to the Company to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether the data is used in accordance with that purpose,
• know the third parties in Türkiye or abroad to whom your personal data is transferred,
• request correction if your personal data is incomplete or inaccurate,
• request erasure or destruction of your personal data under the conditions of Article 7 KVKK,
• request that third parties to whom your data was transferred be notified of correction, erasure or destruction,
• object to a result to your detriment arising from analysis of your data exclusively by automated systems,
• claim compensation if you suffer damage because of unlawful processing of your personal data.

9. How to apply

You may submit requests concerning your rights to the Company through the channels below, stating your request clearly together with information that identifies you, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• in writing to 100. Yıl Mah. Nato Cad. No: 170/D-5, Bandırma / Balıkesir, delivered by hand or through a notary

Your application is concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. If the action requires an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, the response is found insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the application date.

10. Cookies

Information about the cookies used on the Platform is set out in the Cookie Policy.

To measure in aggregate how the storefront pages of the Platform are used and to improve our service, we use Google Analytics, provided by Google Ireland Limited. For this purpose, the addresses of the pages visited (with parameters that could contain personal data removed), page titles, the referring site, device and browser information, approximate location and, for signed-in dealers, the products viewed and added to the cart, order numbers and order amounts are processed. No name, email address, phone number, company name, address or user ID is sent to Google; the admin panel and the sign-in, password and security pages are not measured; no advertising or remarketing features are used, and Google Analytics does not store IP addresses. Google Analytics cookies are placed in your browser for measurement. This data is processed on the basis of our legitimate interest in improving our service (Art. 5/2-f) and transferred to Google's servers abroad with one of the appropriate safeguards set out in Article 9 KVKK.

11. Changes

The Company may update this notice in line with changes in legislation and in its processing activities. The current notice is published on the Platform with its publication date.

This is a translation; in case of discrepancy the Turkish text prevails.