Disclosure Text Regarding the Protection and Processing of Personal Data

1PURPOSE AND SCOPE

This Disclosure Text Regarding the Protection and Processing of Personal Data has been prepared to inform users, members, customers, and order creators visiting the www.trio-gold.com website within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK"), about the purposes for which their personal data is processed, how it is collected, the legal grounds for processing, to whom and for what purposes it may be transferred, and the rights of the relevant individuals.

As TRIO GOLD / [Commercial Title to be Added], we emphasize the lawful, honest, specific, clear, and legitimate purpose processing of personal data.

This Disclosure Text is implemented together with the Distance Sales Agreement, Preliminary Information Form, Cancellation and Refund Conditions, Privacy and Security Policy, and Cookie Policy.

2DATA CONTROLLER

The data controller within the scope of KVKK is:

Hereinafter referred to as the "Data Controller" or "TRIO GOLD".

3PROCESSED PERSONAL DATA

Identity Information: Name, surname, billing information, in case of corporate invoice requests, title, tax office, tax number, and related billing information.

Contact Information: Phone number, email address, delivery address, billing address.

Customer Transaction Information: Order number, order date, purchased product details, payment preference, delivery information, return/exchange request, customer service records, request and complaint information.

Finance and Accounting Information: Invoice details, payment transaction data, refund payment information, bank account information, payment institution transaction records.

Transaction Security Information: IP address, website login/logout records, system logs, transaction time stamps, security authentication records.

Marketing Information: Subject to explicit consent, campaigns, discounts, product announcements, communication preferences, shopping history, and user preferences.

Request and Complaint Information: Customer service conversations, email correspondence, contact form records, return/exchange application details.

Personalized Product Information: Name, date, letters, special text, symbol, size, model, color, stone selection, coating preference, and other information provided by the customer for personalized product manufacturing.

Cookies and Usage Information: Website usage preferences, visit data, cookie records, and technical analysis data.

TRIO GOLD takes care not to collect unnecessary data beyond what the service requires.

4METHODS OF PERSONAL DATA COLLECTION

Personal data may be collected through the following methods:

Creating membership via the www.trio-gold.com website, placing orders, completing payment transactions, filling out contact forms, contacting customer service, submitting requests via email, phone, WhatsApp or similar communication channels, making return, exchange or cancellation applications, placing personalized product orders, technical data generation via cookies and similar technologies during website usage, transaction records generated by cargo, payment institutions, banks, e-invoice/e-archive providers, and technical service providers.

Personal data can be collected automatically or manually, electronically or physically.

5PURPOSES OF PROCESSING PERSONAL DATA

Personal data may be processed for the following purposes:

Managing membership and user account processes, receiving and confirming orders, preparing, packaging, and delivering products, preparing personalized products according to customer requests, carrying out payment and collection processes, managing invoice, e-invoice and e-archive processes, overseeing cargo and delivery processes, evaluating cancellation, return and exchange requests, conducting customer service activities, processing requests, suggestions and complaints, providing after-sales support services, improving product and service quality, ensuring website security, preventing suspicious transactions, fraud, and misuse risks, managing accounting and financial processes, fulfilling legal retention and notification obligations, complying with requests from authorized public institutions and organizations, conducting legal processes, sending campaign, advertisement, promotion, discount, and marketing communications subject to explicit consent.

6LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Personal data are processed based on the legal grounds specified in the KVKK. Accordingly, personal data may be processed based on the following legal grounds:

Explicitly stipulated by laws, directly related to the establishment or performance of a contract, mandatory for the data controller to fulfill a legal obligation, necessary for the establishment, use, or protection of a right, necessary for the legitimate interest of the data controller without harming the fundamental rights and freedoms of the data subject, with the explicit consent of the data subject when required.

Order, delivery, payment, invoice, return, and customer service processes are mostly conducted within the scope of contract establishment/performance and fulfillment of legal obligations.

Campaigns, advertisements, promotions, and marketing communications are conducted with explicit consent or commercial electronic communication approval of the relevant person.

7TRANSFER OF PERSONAL DATA

Personal data may only be shared with third parties to the extent necessary and in accordance with relevant legislation.

Within this scope, personal data may be transferred to the following persons, institutions, and organizations:

Cargo and logistics companies, banks and payment institutions, e-invoice and e-archive service providers, accounting and finance service providers, technical infrastructure, software and hosting service providers, customer service and support service providers, persons providing legal, financial advisory, and consultancy services, limited business partners in production, packaging or personalization processes, authorized public institutions and organizations, judiciary and legally authorized official authorities.

Personal data shall not be sold, rented, or shared for commercial purposes without consent.

8DATA PROCESSING RELATED TO PERSONALIZED PRODUCTS

If the BUYER places a personalized product order, information such as name, date, letters, special text, symbol, size, model, color, stone preference, coating preference, and similar data is processed for the purpose of preparing the order.

This data may be processed for the purposes of;

Preparing the product to meet the customer's request, managing production or preparation process, performing quality control, delivering the order, providing after-sales support, verifying order content in case of possible disputes

This type of data is shared only to the extent required by the order and limited to necessary parties.

9PAYMENT SECURITY AND FINANCIAL DATA

Payment transactions conducted via www.trio-gold.com are processed through secure infrastructures of banks or authorized payment institutions.

TRIO GOLD does not store customers' credit or debit card information in its own systems, depending on the technical structure of the payment infrastructure.

Transaction records arising during the payment process may be processed to complete the order, ensure payment security, manage return processes, create accounting records, and fulfill legal obligations.

If suspicious activity, unauthorized payment, fraud risk, or payment security issue is detected, the order may be subjected to additional verification or canceled.

10COOKIES AND WEBSITE USAGE DATA

Cookies may be used on the www.trio-gold.com website to improve user experience, ensure site security, perform performance analysis, remember preferences, and increase service quality.

Cookies can be classified as;

Necessary cookies, Performance and analytics cookies, Functional cookies, Advertising and marketing cookies

Details regarding cookie usage may also be regulated within the scope of the Cookie Policy.

11COMMERCIAL ELECTRONIC MESSAGES AND MARKETING ACTIVITIES

If the BUYER has given explicit consent or commercial electronic communication approval, they may receive messages regarding campaigns, discounts, product announcements, special offers, advertisements, promotions, and marketing content.

The BUYER can withdraw consent for receiving commercial electronic messages at any time.

Withdrawal of commercial electronic communication approval does not prevent the sending of order, payment, invoice, delivery, return, security, and mandatory notification messages.

Explicit consent and commercial electronic communication approval must be obtained separately from this Disclosure Text.

12RETENTION PERIOD OF PERSONAL DATA

Personal data are retained for as long as required by the purpose of processing and within the legal retention periods stipulated by relevant legislation.

Order, invoice, payment, accounting, delivery, return, customer service, legal process, and dispute records may be retained for the necessary periods specified in the relevant legislation.

Upon expiration of the retention period or cessation of the processing purpose, personal data shall be deleted, destroyed or anonymized in accordance with the legislation.

13SECURITY OF PERSONAL DATA

TRIO GOLD takes necessary technical and administrative measures to prevent unlawful processing and access to personal data and to ensure secure storage.

Within this scope;

Preventing unauthorized access, ensuring system security, protecting order and payment records, limiting access rights, securing technical infrastructure, conducting logging and auditing processes when necessary

are implemented.

Since absolute security cannot be guaranteed on the internet, users are also responsible for protecting the security of their own devices, connections, memberships, and passwords.

14RIGHTS OF THE DATA SUBJECT

Personal data owners have the following rights under KVKK:

To learn whether personal data is processed, to request information if processed, to learn the purpose of processing and whether it is used accordingly, to know third parties to whom personal data is transferred domestically or abroad, to request correction if data is incomplete or incorrect, to request deletion or destruction within conditions prescribed by relevant legislation, to request notification of corrections, deletions, or destructions to third parties to whom data was transferred, to object to automatic processing resulting in negative consequences for themselves, to claim compensation for damages due to unlawful processing of personal data.

15APPLICATION METHOD

Data subjects can submit their requests regarding their rights under KVKK to TRIO GOLD through the following communication channels:

Applications must include name, surname, contact information, request subject, and necessary information for identity verification.

TRIO GOLD evaluates and finalizes applications within periods stipulated by relevant legislation.

If the application is incomplete, incorrect, or identity verification is not possible, additional information may be requested for evaluation.

16TRANSFER OF DATA ABROAD

TRIO GOLD as a rule strives not to transfer personal data abroad.

However, if the website infrastructure, email services, cookies, analytics tools, hosting services, payment infrastructures, or technical service providers use foreign-connected systems, personal data may be transferred abroad in compliance with relevant legislation.

In cases requiring transfer abroad, actions are taken in accordance with KVKK and related legal requirements.

17THIRD-PARTY SERVICE PROVIDERS

TRIO GOLD may receive support from third-party service providers for order, payment, delivery, accounting, e-invoice, technical infrastructure, customer service, advertising/analysis, and security processes.

Personal data is shared with these service providers only to the extent required for the service.

Third-party service providers are expected to process personal data only for specified purposes and comply with confidentiality obligations.

18RIGHT TO UPDATE

TRIO GOLD reserves the right to modify this Disclosure Text in line with legislative changes, service processes, technical infrastructure changes, or updates in personal data processing activities.

The updated Disclosure Text becomes effective on the date it is published on the www.trio-gold.com website.

19EFFECTIVE DATE

This Disclosure Text Regarding the Protection and Processing of Personal Data becomes effective on the date it is published on the www.trio-gold.com website.