INFORMATION TEXT WITHIN THE SCOPE OF THE LAW ON THE PROTECTION OF PERSONAL DATA NO. 6698

TEXYLON PERSONAL DATA PROTECTION LAW (KVKK) CLARIFICATION TEXT

1. Purpose

This Clarification Text has been prepared in accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK") for the purpose of informing natural persons whose personal data are processed.

Texylon Teknoloji Anonim Şirketi ("Texylon", the "Platform", the "Company" or "Data Controller") attaches great importance to the lawful processing, retention, and protection of personal data.

This text has been prepared for;

• Platform visitors,

• Free Buyer members,

• Paid Supplier members,

• Company representatives,

• Potential clients,

• Individuals who fill out the contact form,

• Users requesting support,

• Business partners,

• Suppliers,

• All natural persons communicating through the Platform

2. Data Controller

Pursuant to Law No. 6698, your personal data is processed by the Data Controller whose details are provided below.

Data Controller: Texylon Teknoloji Anonim Şirketi

Headquarters: Istanbul / Turkey

E-mail: info@texylon.com

Web: https://texylon.com

3. About Texylon

Texylon is a global B2B platform operating in the textile industry that connects buyers with manufacturers and suppliers in a digital environment.

Within the scope of the Platform, users may;

• create a company profile,

• promote their products and services,

• create RFQs (Requests for Quotation),

• receive quotes,

• send quotes,

• share certificates,

• upload catalogs,

• publish product images,

• apply for a verified company status,

• communicate with other members,

• manage their platform memberships.

Texylon is not a party to the commercial transactions conducted between users. The primary activity of the Platform is to provide membership services and to bring together textile industry professionals in a digital environment.

4. Processed Personal Data

Personal data that may be processed by Texylon are classified under the following categories.

4.1 Identity Information

• First Name

• Last Name

• Title

• Role within the company

• User identity

4.2 Contact Information

• E-mail address

• Telephone number

• Country

• City

• Postal address (if necessary)

4.3 Company Information

Regarding the company you represent on the Platform;

• Company name

• Tax details

• Trade registry details

• Website

• Production capacity

• Product categories

• Export details

• Certificates

• Brand information

• Factory details

• Company promotional content

Although this information belongs to a legal entity, it may constitute personal data to the extent it can be associated with a natural person.

4.4 Membership Information

• Username

• Password (cryptographically encrypted)

• Membership type

• Membership start date

• Membership end date

• Verified member status

• Account status

• Login records

4.5 Transaction Security Data

In order to ensure platform security;

• IP address

• Session details

• Browser information

• Operating system information

• Device details

• Cookie records

• Security logs

• Error logs

may be processed.

4.6 Usage Data

Regarding platform usage;

• RFQ records

• Offer records

• Messages

• Searches

• Favorites

• Viewing history

• Downloaded documents

• Click records

• Usage statistics

may be processed.

4.7 Uploaded Content

Uploaded by platform users;

• Company logos

• Profile photos

• Product images

• Certificates

• Catalogs

• Technical documents

• Videos

• Files

may be processed and published on the platform in accordance with user preferences.

4.8 Payment Information

Within the scope of Supplier memberships;

• Billing information

• Tax details

• Payment records

• Transaction reference numbers

may be processed.

In the event that payment services are provided through third-party payment institutions, Texylon does not store full credit card information on its own systems.

4.9 Communication Records

Within the scope of support requests;

• e-mail correspondence,

• support records,

• live support chats (if applicable),

• user feedback,

• complaint records

may be processed.

4.10 Automatically Collected Data

During the use of the Platform;

• visited pages,

• duration of use,

• session actions,

• error logs,

• traffic details,

• performance data,

• anonymous analysis data

may be processed using automated methods.

5. Purposes of Processing Personal Data

Texylon processes your personal data in accordance with the fundamental principles of KVKK, adhering to the law and principles of honesty, ensuring accuracy and up-to-date status where required, for specific, explicit, and legitimate purposes, and in a limited, proportionated, and relevant manner regarding the purposes of processing.

Your personal data may be processed for the following purposes:

5.1 Management of Membership Processes

• Creation of user accounts

• Verification of user identity

• Account administration

• Ensuring account security

• Password reset operations

• Updating membership details

• Suspension or closure of accounts

• Evaluation of verified member applications

5.2 Provision of Platform Services

Your personal data may be processed for the purposes of;

• creation of RFQs,

• submitting offers to RFQs,

• viewing offers,

• matching buyers and suppliers,

• publishing company profiles,

• displaying product and service details,

• enabling communication between users,

• enabling the utilization of platform functions.

5.3 Management of Paid Memberships

Within the scope of Supplier memberships, personal data may be processed for the purposes of;

• managing membership plans,

• executing the subscription process,

• performing automatic renewals,

• managing billing processes,

• retaining payment records,

• fulfilling accounting obligations.

5.4 Ensuring Platform Security

In order to ensure the security of the Platform, operations may be conducted for the purposes of;

• detecting unauthorized access,

• preventing abuse,

• blocking fraudulent activities,

• preventing spam and fake accounts,

• investigating cybersecurity incidents,

• generating system logs,

• analyzing security breaches.

5.5 User Support Services

Personal data may be processed for the purposes of;

• responding to support requests,

• resolving technical issues,

• evaluating complaints,

• enhancing user satisfaction,

• retaining communication logs.

5.6 Improvement of the Platform

Texylon may process anonymized data or specific personal data for the purposes of;

• analyzing usage statistics,

• performance measurement,

• developing new features,

• improving user experience,

• resolving system errors,

• optimizing the platform.

5.7 Fulfillment of Legal Obligations

Personal data may be processed for the purposes of;

• fulfilling legal obligations,

• responding to requests from public institutions,

• complying with court orders,

• sharing information with official authorities,

• managing legal processes,

• resolving disputes,

• retaining records for evidentiary purposes.

5.8 Communication Activities

Texylon may communicate with users regarding;

• membership notices,

• security alerts,

• system announcements,

• maintenance activities,

• contract amendments,

• payment notifications,

• support processes.

These notices are essential for the delivery of the service and do not constitute commercial electronic messages.

5.9 Commercial Electronic Messages

Subject to the user's explicit consent or other legal conditions set forth in the applicable legislation, electronic messages may be sent regarding;

• campaigns,

• new services,

• platform announcements,

• events,

• industry-related content,

• marketing activities.

The user may opt-out of receiving these communications at any time.

6. Legal Grounds for Processing Personal Data

Texylon processes personal data based on the legal processing conditions set forth in Article 5 and, where applicable, Article 6 of the KVKK.

The processed personal data may be based on one or more of the following legal grounds:

• Explicit provision in the laws.

• Direct relation to the establishment or performance of a contract.

• Fulfillment of Texylon's legal obligations.

• Necessity of data processing for the establishment, exercise, or protection of a right.

• Existence of Texylon's legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject.

• Existence of the data subject's explicit consent (where required).

Personal data is processed only to the extent required by the relevant legal ground.

7. Method of Personal Data Collection

Your personal data may be obtained through the following methods:

• Membership forms,

• Company registration forms,

• RFQ creation screens,

• Contact forms,

• Support requests,

• E-mail correspondence,

• Telephone calls,

• Cookies,

• Server records,

• Mobile devices,

• Website usage,

• Security logs,

• API integrations (if any),

• Third-party service providers,

• Official authorities and institutions (where permitted by legislation).

Data may be collected through automated, semi-automated, or non-automated methods.

8. Transfer of Personal Data

Texylon transfers your personal data only in accordance with the KVKK and relevant legislation, by taking the necessary technical and administrative measures.

Personal data may be shared with the following recipient groups:

• Authorized public institutions and organizations.

• Courts, execution offices, and other authorized judicial authorities.

• Relevant public institutions for the fulfillment of tax and financial obligations.

• Legal advisers, financial advisers, and independent auditors.

• Cloud computing and data hosting service providers.

• E-mail and communication service providers.

• Technical infrastructure and information technology service providers.

• Security and cybersecurity service providers.

• Payment service providers (for the execution of membership payments).

• Business partners and suppliers (only to the extent necessary for the provision of the service).

Under no circumstances is personal data sold to third parties or shared for unlawful commercial purposes.

9. Cross-Border Transfer of Personal Data

Due to the nature of its activities, Texylon may utilize cloud computing, data hosting, e-mail, security, analysis, and similar technical services.

Within this scope, your personal data may be transferred abroad in accordance with Article 9 of the KVKK and the provisions of the relevant legislation in force, by implementing the necessary technical and administrative measures.

In cases where data must be transferred abroad, Texylon;

• acts in compliance with the legislation in force,

• applies the required security measures,

• transfers only the data necessary for the provision of the service,

• adheres to the principle of data minimization.

10. Retention Period of Personal Data

Texylon retains personal data only for the period required by the processing purpose and during the retention periods stipulated in the relevant legislation.

The following criteria are considered when determining the retention period:

• Continuation of the membership relationship,

• Fulfillment of contractual obligations,

• Tax and accounting legislation,

• Commercial law obligations,

• Statutes of limitation,

• Potential legal disputes,

• Information security requirements,

• Retention obligations arising from the legislation.

In the event that the processing purpose ceases to exist and the retention period expires, personal data is;

• deleted,

• destroyed or

• anonymized.

11. Security of Personal Data

Texylon implements reasonable technical and administrative measures to prevent unlawful processing, access, modification, disclosure, or loss of personal data.

Measures that may be taken within this scope include:

• Authorization matrix and access control,

• Role-based authorization,

• Strong authentication mechanisms,

• Secure hashing of passwords,

• Encryption in data transmission,

• Firewalls,

• Malware protection,

• Regular security updates,

• Logging and monitoring systems,

• Backup and disaster recovery plans,

• Penetration testing and security assessments,

• Personnel authorization and awareness programs,

• Physical and electronic access controls.

However, it cannot be guaranteed that data transmissions over the internet are completely risk-free. Texylon undertakes to implement reasonable and up-to-date security measures to ensure the security of personal data.

12. Cookies and Similar Technologies

Texylon may use cookies and similar technologies to ensure that the website and platform services are provided in a secure, efficient, and user-friendly manner.

These technologies may be used for the following purposes:

• Maintaining the session,

• Remembering user preferences,

• Performing security checks,

• Measuring platform performance,

• Conducting error analysis,

• Traffic analysis,

• Developing the platform.

Detailed information regarding the use of cookies is provided in the separately published Cookie Policy.

13. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, personal data subjects possess the following rights:

• To learn whether their personal data is being processed,

• To request information if their personal data has been processed,

• To learn the purpose of processing and whether the data is used in accordance with its purpose,

• To learn the third parties to whom personal data is transferred (within the scope provided by legislation),

• To request rectification of personal data if it is processed incompletely or inaccurately,

• To request deletion or destruction of personal data in the event that the conditions stipulated in the KVKK are met,

• To request that the processes of rectification, deletion, or destruction be notified to third parties to whom the data has been transferred (within the scope provided by legislation),

• To object to any result behavior to the detriment of the person as a result of analyzing the processed data exclusively through automated systems,

• To claim indemnification of damages in the event of suffering loss due to unlawful processing.

The exercise of these rights is evaluated subject to the exceptions stipulated in the KVKK and relevant legislation.

14. Application Procedure

Data subjects may submit their requests within the scope of Article 11 of the KVKK to Texylon in accordance with the procedures and principles set forth in the applicable legislation.

Applications may be submitted through one of the following methods:

• Written application,

• Registered Electronic Mail (KEP) address (if any),

• With secure electronic signature or mobile signature,

• Electronic application method announced by the Company.

During the evaluation of applications, additional information or documentation may be requested to verify the identity of the applicant.

Texylon concludes applications free of charge within the period stipulated in the relevant legislation. However, if the transaction requires an additional cost, the fee determined in accordance with the applicable legislation may be requested.

The following information must be completed prior to publication:

• Notification address

• KVKK application e-mail address (e.g., privacy@texylon.com)

• KEP address (if any)

• MERSIS number

• Trade registry number

15. Amendments to the Clarification Text

Texylon reserves the right to update this Clarification Text in accordance with the applicable legislation, technical requirements, or amendments that may occur in the platform services.

The current text becomes effective as of the date of its publication on the website www.texylon.com. In the event of material changes, users may be notified additionally if appropriate.

16. Contact

Data Controller: Texylon Teknoloji Anonim Şirketi

Headquarters Address: Istanbul, Turkey

E-mail: info@texylon.com

Website: https://www.texylon.com