Privacy Notice on the Processing of Personal Data

As Vitaly Global Vitamin Gıda Takviyeleri ve Kozmetik Ticaret Anonim Şirketi (“Vitaly Global” or the “Company”), acting in our capacity as data controller pursuant to the Personal Data Protection Law No. 6698 (KVKK) (“KVKK”) and the related secondary legislation, we would like to inform you about your personal data that we process through the www.vitalyglobal.com website (the “Site”) and the mobile application.

1. Identity of the Data Controller

Your personal data is processed by Vitaly Global Vitamin Gıda Takviyeleri ve Kozmetik Ticaret A.Ş. in its capacity as data controller.

Address: İçerenköy Mah. Umut Sk. No:10-12 Quick Tower Kat:16 Ataşehir/İstanbul

E-Mail: iletisim@vitalyglobal.com

Website:www.vitalyglobal.com

Mersis No: 0925-1331-2630-0001

2. Purposes for Which Personal Data Will Be Processed

Your personal data that we collect is processed for the following purposes:

1. Carrying out membership procedures, creating member registrations and managing accounts,
2. Administering the food supplement tests on our Site (Focus, Immunity, Energy, Hair-Skin-Nail, Sleep, Digestion, Joint and Bone Health, and Stress Tests) and calculating the test results,
3. Providing you with food supplement product recommendations suited to you based on your test results and sending these recommendations to you by e-mail,
4. Conducting order and sales processes and performing contractual obligations,
5. Sending you commercial electronic messages (e-newsletters, campaigns, promotions) where you have given your explicit consent,
6. Managing customer relations and evaluating requests and complaints,
7. Ensuring the security of the Site and the mobile application, fulfilling legal obligations, managing legal disputes and fulfilling obligations to provide information to competent authorities/institutions.

3. Categories of Personal Data Processed

3.1 Personal Data of a General Nature

• Identity information: First name, last name
• Contact information: E-mail address, mobile phone number
• Customer transaction information: Order, payment and delivery information
• Marketing information: E-newsletter/commercial message preferences
• Transaction security information: Cookie records, IP address, session information

3.2 Special Categories of Personal Data (Health Data)

Some of the food supplement tests on our Site contain questions relating to your health so that the test result can be calculated. The reviewed and verified examples are as follows:

• Immunity Test: A question regarding the frequency of flu/colds experienced in the past year,
• Joint and Bone Health Test: Questions regarding the presence of a chronic condition/joint-bone problem, the area of the body where the complaint is felt (knee/leg, shoulder/arm, lower back/back, hand/wrist) and how often this complaint affects daily movements.
• Digestion Test: Questions regarding stomach problems such as bloating, reflux, etc.

Since these three tests include certain preliminary information that may be considered special categories of personal data (health data), your data is processed in this category and on a limited basis. Where the content of a test is clarified as including health data, the categories defined in this section and the explicit consent text in Section 5 below are updated for the relevant test so as to correspond exactly to the questions actually asked.

Since it has been verified that special categories of data are processed in at least one test, the explicit consent mechanism is applied to all tests in accordance with the principle of prudence; however, in each test only the data relating to the questions actually asked in that test are processed.

Data within this scope is processed only if you give your explicit consent on the relevant test screen, and is used solely for the purpose of calculating the test result and providing you with a suitable product recommendation.

4. Method and Legal Basis for Collecting Personal Data

Your personal data is collected electronically through the forms you fill in on the Site and the mobile application, membership registration, food supplement tests and cookies.

Your personal data of a general nature is processed, within the scope of Article 5/2 of the KVKK, on the basis of the following legal grounds:

• It being directly related to the establishment or performance of a contract (membership and order processes),
• It being mandatory for our Company to fulfil its legal obligation,
• Data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,

In cases where these grounds cannot be applied, your explicit consent is obtained.

Your special categories of personal data (health data), on the other hand, are processed pursuant to Article 6 of the KVKK only where you have given your explicit consent and limited to the scope of that consent. If you do not give your explicit consent on the relevant test screen, the test flow does not continue or questions containing special categories of data are not asked.

5. Explicit Consent Regarding Special Categories of Personal Data

The explicit consent text for those food supplement tests that contain health data is presented separately on the entry screen of the relevant test, with a checkbox that is not pre-ticked. The explicit consent text is tailored to the questions actually asked in the relevant test. Examples of explicit consent texts for the verified tests are provided below:

For the Immunity Test: “I hereby give my explicit consent to the processing by Vitaly Global of the health information I have shared within the scope of this test regarding the frequency of illnesses I have had in the past year, for the purpose of calculating my test result and recommending food supplement products suitable for me.”

For the Joint and Bone Health Test: “I hereby give my explicit consent to the processing by Vitaly Global of the health information I have shared within the scope of this test regarding my joint-bone health, my chronic condition and the effect of my complaints on my daily movements, for the purpose of calculating my test result and recommending food supplement products suitable for me.”

For the Digestion Test: “I hereby give my explicit consent to the processing by Vitaly Global of the health information I have shared within the scope of this test regarding stomach problems such as bloating, reflux, etc., for the purpose of calculating my test result and recommending food supplement products suitable for me.”

For other tests that are later clarified or modified to contain health data, the explicit consent text is prepared on the same basis and so as to cover only the health questions asked in that test.

You may withdraw your explicit consent at any time from the moment you give it by submitting a written request to iletisim@vitalyglobal.com. The withdrawal of your explicit consent does not affect the lawfulness of processing carried out before the date of withdrawal.

6. Evaluation by Automated Systems and Health Disclaimer

Providing a personalised product recommendation based on the test result may involve the evaluation of your answers by automated means. The Site offers the food supplement tests for general information and product recommendation purposes, without any purpose of medical diagnosis or treatment; test results do not replace the assessment of a healthcare professional.

You have the right, under Article 11 of the KVKK, to object to the occurrence of a result to your detriment through the analysis of the processed data exclusively by means of automated systems.

7. Data of Minors

The Site and the food supplement tests offered are intended for users over the age of eighteen. Our Company does not aim to collect personal data belonging to persons under the age of eighteen. If it is determined that data belonging to a minor has been submitted without the consent of a parent/guardian, such data will be deleted as soon as possible. If you believe that data belonging to a minor is being processed, you may contact us at iletisim@vitalyglobal.com.

8. Transfer of Personal Data

Your personal data may be transferred, limited to the achievement of the purposes stated above and in accordance with the conditions set out in Articles 8 and 9 of the KVKK, to:

• Our business partners providing cargo and logistics services (for the purpose of order delivery),
• Payment infrastructure providers/banks and card institutions (for the purpose of carrying out payment transactions),
• Information technology and cloud service providers (for the purpose of hosting data and operating the site/application),
• E-mail/marketing automation service providers (for the purpose of sending test result and campaign e-mails),
• Competent public institutions and organisations (for the purpose of fulfilling legal obligations).

Where the servers of some of these service providers are located abroad, your personal data may be transferred abroad in accordance with the conditions laid down in Article 9 of the KVKK (explicit consent or mechanisms relating to adequate/appropriate safeguards). Your special categories of personal data are not shared with third parties outside the scope of your explicit consent.

9. Retention Period of Personal Data

Your personal data is retained for the periods stipulated in the relevant legislation and/or for the period required by the purpose of processing. Your membership information is retained for as long as your membership continues, while your test result data is deleted, destroyed or anonymised within a reasonable period after the purpose of processing ceases to exist (e.g. after the end of the relevant campaign/recommendation process), also taking into account the retention obligations stipulated in the legislation.

10. Rights of the Data Subject (Article 11 of the KVKK)

Pursuant to Article 11 of the KVKK, we would like to inform you that, by applying to our Company, you have the right to:

• Learn whether your personal data is being processed,
• Request information in this regard if your personal data has been processed,
• Learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
• Know the third parties to whom your personal data is transferred, domestically or abroad,
• Request the rectification of your personal data if it has been processed incompletely or incorrectly,
• Request the erasure or destruction of your personal data within the scope of Article 7 of the KVKK,
• Request that your rectification, erasure and destruction requests be notified to the third parties to whom your personal data has been transferred,
• Object to the occurrence of a result to your detriment through the analysis of the processed data exclusively by means of automated systems,
• Request compensation for damages in the event that you suffer damage due to the unlawful processing of your personal data.

11. Method of Application

You may submit your requests regarding the rights listed above in writing, together with documents verifying your identity, to the e-mail address iletisim@vitalyglobal.com or to the address İçerenköy Mah. Umut Sk. No:10-12 Quick Tower Kat:16 Ataşehir/İstanbul. Depending on its nature, your request will be concluded free of charge as soon as possible and within thirty days at the latest; if the process requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

12. Amendments to the Information Notice

Our Company reserves the right to update this Information Notice in line with changes in legislation or changes in our processing activities. The current text becomes effective as of the moment it is published on the Site.