PERSONAL DATA PROTECTION LAW WEBSITE PRIVACY POLICY

Vorne / Company: All of the companies detailed below are hereinafter defined as "Vorne" or "Company" in this form.

• İleri Pencere Kapı Sistemleri Sanayi ve Ticaret Anonim Şirketi

Adres: Atatürk Sanayi Bölgesi Ömerli Mah. Hakkı İleri Cad. No:72 PK:34555 Hadımköy – Arnavutköy – İstanbul – Türkiye

• Vorne Pencere Kapı Sistemleri Pazarlama Dış Ticaret Anonim Şirketi

Adres: Atatürk Sanayi Bölgesi Ömerli Mah. Dr. Mithat Martı Sokak. No:23-2 PK:34555 Hadımköy – Arnavutköy – İstanbul – Türkiye

• Vorne Holding Anonim Şirketi

Adres: Atatürk Sanayi Bölgesi Ömerli Mah. Hakkı İleri Cad. No:72-1 PK:34555 Hadımköy – Arnavutköy – İstanbul – Türkiye

The purpose of this Privacy Policy is to determine the terms and conditions regarding the use of personal data shared with the Company by the Site users/members/visitors ("Data Owner") during the services provided by our Company and/or its service providers on the website ("" Website "") or produced by the Company during the use of the Site.

The Data Owner declares that he/she has been informed about the processing of his/her personal data by this Privacy Policy and that he/she consents to the use of his/her personal data as specified herein.

What Data is Processed?

Under this heading, the data processed by the Company and considered as personal data in accordance with the Law on the Protection of Personal Data are specified below, but not limited to the following. Unless otherwise expressly stated, the term ""Personal Data "" within the scope of the terms and conditions provided under this Privacy Policy shall include the following information.

• Identity Information
• Contact Details
• Customer Transaction Information

The Company may obtain information about the use of the Website by the Data Owner using cookies, which is a technical communication file, and IP information is collected through cookies to determine the access and usage habits of the services offered on the Website.

In accordance with Articles 3 and 7 of the Personal Data Protection Law, the data that are irrevocably anonymized will not be considered as personal data in accordance with the provisions of the said law and the processing activities related to these data will be carried out without being bound by the provisions of this Privacy Policy.

For What Purposes Is Data Used?

The Company shall process the personal data provided by the Data Owner for the following purposes; membership of the Company's websites, utilization of the products and services offered on the websites, notifications and updates related to the products and services are communicated to the data owners, the messages transmitted through the websites are evaluated, information requests are met, complaints are created, processed and finalized, after-sales services are provided, information requests related to the products and services of the Company are met, notifications and updates related to the products and services of the Company are sent to the data owners, information about the products and services of the Company are sent to the contact addresses provided by the data owners, test drive requests are received, test drive is carried out and data owners are contacted within this scope, information about the vehicle of interest is obtained, other information requests are met, the relevant dealer can be contacted and data owners can be contacted within this scope, customer faulty vehicle requests are received, assistance is provided to the place of the faulty vehicle and after-sales services are provided within this scope, determining and implementing commercial and business strategies, ensuring the legal, technical and commercial security of our Company and the persons who have a business relationship with our Company, and in this context, providing the Data Owner with the necessary information and fulfilling the obligations arising from the nature of these activities.

The Company may also process the said personal data in order to improve the services it provides, enhance the service and provide the necessary information to the Data Owner in this context and fulfill the obligations arising from the nature of the services it provides.

Such personal information may be used to contact the Data Owner or to improve the Data Owner's experience on the Website (such as developing existing services, creating new services, and providing personalized services), within the scope of company reporting and business development activities as well as to make various statistical evaluations, create databases and conduct market research without disclosing the identity of the Data Owner. Such information may be processed, stored, communicated to third parties for direct marketing purposes by the Company and its collaborators, and the Data Owner may be contacted for the purpose of making notifications regarding the promotion, maintenance and support activities of various applications, products and services.

The Company may also process and share personal data with third parties without the consent of the Data Owner in accordance with Articles 5 and 8 of the Personal Data Protection Law and/or in the presence of exceptions in the relevant legislation. The main ones of these situations are as follows:

• Foreseen clearly in the laws,
• In case it is mandatory for the protection of the life or bodily integrity of the person or another person's life or bodily integrity, who is unable to express their consent due to actual impossibility, or whose consent is not legally valid,
• In the event that it is required to process personal data of the parties of the agreement, provided that the processing is directly related to the conclusion or fulfillment of that agreement,
• Obligatory for the fulfillment of legal obligations,
• It is made public by the personal data owner himself/herself,
• If the data processing is required for the establishment, exercise, or protection of a right,
• In the event that processing is required for the legitimate interests of the Company, provided that the fundamental rights and freedoms of the data owner are not damaged.

As stated above, the Company may use cookies and in this context, it may process data and transmit them to third parties only for the purpose of processing within the scope of the analysis services offered by third parties and for the purpose of using these analysis services only to the extent required. The aforementioned technical communication files are small text files that the Site sends to the Data Owner's browser to be stored in the main memory. The technical communication file facilitates the use of the internet in this sense by storing the status and preference settings of a website. The technical communication file is designed and used to obtain statistical information about how many people use the websites on a temporal basis, for what purpose, how many times a person visits any website and how long they stay, and to help dynamically produce ads and content from user pages specially designed for users. The technical communication file is not intended to receive any personal data other than the main memory. Most browsers are originally designed to accept the technical communication file, but users may change the settings so that the technical communication file is not received or be alerted when the technical communication file is sent. The Company also has the right to associate the Data Owner's behavior on the site with a cookie in the browser for the purpose of online behavioral advertising and marketing, and to define remarketing lists based on metrics such as the number of pages viewed, duration of visits and number of goal completions. The Data Owner may then be shown targeted advertising content based on their interests on the Site or other sites in the display ad network.

Who Can Access Data?

The Company may transfer the personal data of the Data Owner and the new data obtained by using such personal data to third parties to whom the Company uses its services for the purposes specified in this Privacy Policy, limited to the purpose of providing such services.

The Company may share with third parties such as Vorne, outsourcing service providers, hosting service providers, law firms, research companies, business partners, suppliers, company shareholders, call centers, including those who send SMS to improve the Data Owner experience (including improvement and personalization), ensure the security of the Data Owner, detect fraudulent or unauthorized uses, investigate operational evaluation, troubleshoot the Website or Company Services and perform any of the purposes set out in this Privacy Policy.

The Data Owner agrees in advance that the aforementioned third parties may store the personal data of the Data Owner on their servers all over the world, provided that it is limited to the above-mentioned purposes.

  About the Right of Access to Data and Correction Requests

The Data Owner has the right to the following;

• To learn whether personal data is processed or not,
• Request information if their personal data have been processed,
• Find out the purpose of processing personal data and whether they are used appropriately for their purpose,
• being informed of the third persons to whom the personal data is transferred within and out of the country,
• To request the rectification of the incomplete or inaccurate data, if any,
• To request the deletion or destruction of personal data within the framework of the conditions stipulated in the relevant legislation,
• To request notification of the correction, deletion and destruction procedures made in accordance with the relevant legislation to the third parties to whom the personal data are transferred,
• To object to results to the detriment of personal data owner arising exclusively from analysis of such processed data through automated systems,
• To claim compensation in case of loss due to unlawful processing of personal data.

 The Data Owner shall submit the above-mentioned requests in writing in the name of Committee of Protection of Personal Data to İleri Pencere Kapı Sistemleri Sanayi ve Ticaret Anonim Şirketi Atatürk Sanayi Bölgesi Ömerli Mah. Hakkı İleri Cad. No:72 PK:34555 Hadımköy – Arnavutköy – İstanbul – TURKEY. The Company may give a reasoned positive/negative response to the applications to be made in line with the requests above within thirty days at the latest in written or through digital media. Requests will be met free of charge and if the necessary transactions related to the requests require an additional cost, it is possible for the Personal Data Protection Board to request a fee over the tariff determined in accordance with Article 13 of the Personal Data Protection Law.

Detailed information about the use of legal rights can be found in the section titled "Rights of Personal Data Owners; Methodology of Use and Evaluation of These Rights" of the Vorne Regulation on Protection and Processing of Personal Data at www.vorne.com.tr.

The Data Owner undertakes that the information subject to this Privacy Policy is complete, accurate and up-to-date and that he/she will immediately update any changes in this information. The Company shall have no liability if the Data Owner has not provided up-to-date information.

The Data Owner agrees that he/she may not be able to fully benefit from the operation of the Website in the event that he/she makes a request that will result in the inability of any personal data to be used by the Company, and that any responsibility arising in this context will belong to him/her.

Retention Period of Personal Data

The Company will retain the personal data provided by the Data Owner for the duration required by the purposes of the processing set out above.

In addition to this, our Company may retain personal data during the term specified in the applicable legislation in case of any dispute that may arise between the data subject and the Company, provided that it is limited to the purpose of conducting the necessary defenses for a dispute.

Precautions and Commitments Regarding Data Security

The Company, under the conditions specified in the relevant legislation or expressed in this Privacy Policy, commits to the following;

• Not to process personal data unlawfully,
• Not to access personal data unlawfully, and
• To take the necessary technical and administrative measures to ensure

the appropriate level of security in order to ensure the protection of personal data, to carry out the necessary inspections.

The Company may not disclose the personal data obtained about the Data Owner to anyone contrary to the provisions of this Privacy Policy and the Personal Data Protection Law and may not use them for purposes other than processing.

In the event that links are provided to other applications through the Website, the Company does not bear any responsibility for the privacy policies and contents of the applications.

Changes in the Privacy Policy

The Company may change the provisions of this Privacy Policy at any time. The current Privacy Policy takes effect on the date it is made available to the Data Owner by any means.