VANTUZ CONTROL PRIVACY POLICY

As Karaca Züccaciye Ticaret ve Sanayi A.S., we are committed to protecting your privacy.

Please take a moment to read our privacy policy and let us know if you have any questions.

Karaca Züccaciye Ticaret ve Sanayi A.S. and its subsidiaries (hereinafter referred to as “Karaca”, “we”, “our”, or “us”) are committed to protecting your privacy. In the Vantuz Control mobile application, our company applies the Privacy Policy and Terms of Application and Use, the principles of which are given below, in relation to the confidentiality of user data, protection and processing of personal data, commercial electronic communication, and other related issues. This privacy policy applies to Karaca’s mobile applications offered in Google Play Store and IOS App Store. This Privacy Policy (the “Policy”) describes our practices in connection with the privacy on your Personal Data that we process through your personal use of the following services, products, and related mobile applications (collectively, the “Products”):

Vantuz Control Mobile Application

In this Privacy Policy, “Personal Data” means information that can be used to identify individuals, either alone or in combination with other relevant information. “Smart Devices” means non-standard data processing devices manufactured by hardware manufacturers, which has the capability to connect wirelessly to a human-machine interface and a network to transmit data, such as smart home appliances, smart wearable devices, and smart air purifiers. “Applications” mean the mobile applications developed by Karaca to allow users to remotely control Smart Devices by connecting to the supplier’s IoT Platform.

Our users have control on all Personal Data collected through our Products for mobile applications from other brands, which are supported by Karaca. This data is collected in line with the instructions given by our users and processed in a way limited to the purpose of delivering the service offered to our users.

As Karaca, we can make modify this Privacy Policy from time to time and when a material modification is made, we will notify you through our service. In other words, we will give you the opportunity to review before any modifications take effect. If you do not agree with a proposed modification, you can simply close your account.

(I) What Kind of Personal Data Do We Collect? We will ask you to provide the Personal Data we need for the delivery of our services to you. (II) The cases when you need to authorize us for collecting and using your personal data

Personal Data is collected to ensure that our company comply with the applicable laws, regulations, and other regulatory documents, in addition to providing you with the necessary products and/or services. You always have the option to provide this data or not. However, in most cases, if you do not provide such data, we may not be able to provide you with the relevant services or respond to the problem you are facing with.

1. Data You Voluntarily Provide Us

-Account or Profile Data: When you open an account, we may collect your contact information, such as your name, e-mail address, phone number, username, and login information. During your interaction with our products, we may also collect your nickname, profile picture, country code, language preference, and time zone information on your account. We will store this data in order to improve the application and meet the language setting requirements.

- Feedback: When using the feedback and suggestion features on our products, we will collect your e-mail address, mobile phone number, and your feedback content in order to solve your problems and troubleshoot any device malfunctions in a timely manner.

2. Automatically Collected Data

This data is provided by App users since it is required for device control. Certain data and device logs are stored in order to analyse and solve any problems that may arise from app processing.

- Device Information: When you establish an interaction with our product, we automatically collect device information such as your device’s MAC address, IP address, wireless connection data, operating system type and version, application version number, notification identifier, and log files, in addition to mobile network information.

- Usage Data: During your interaction with our Websites and Services, we automatically collect usage data regarding visits, clicks, downloads, messages sent or received, and other uses of our Websites and Services.

- Log Data: When you use our application, the system and exception log can be loaded.

- Location Data: When you use our certain Products or Services, such as a robotic vacuum cleaner or weather services, we may collect information about your real-time precise or imprecise geolocation. Your location data is collected upon your consent, and you can control it on the device you use and cancel your consent any time.

3. Information about Smart Devices:

This data is provided by App users since it is required for device control. Data and device logs are stored to analyze and solve problems arising from the app processing process.

Basic Information about Smart Devices: When you connect your Smart Devices with our Products or Services, we may collect basic information about your Smart Devices, such as device name, device ID, online status, activation time, firmware version, and upgrade information.

Information Reported by Smart Devices: Depending on the type of the Smart Device you connect with our Products or Services, we may collect various information reported by your Smart Device. For example, smart weights or fitness trackers may report your height, weight, body fat mass (BFM), BMI, and skeletal muscle mass (SMM) information, while smart cameras are used for navigation and mapping.

(I) Cases where you can authorize us to collect and use your personal data

In order to enable you to better control and manage the smart devices offered by Karaca, we may collect and use your personal data having the following additional features. If you do not provide this personal data, you can still use Karaca basic services, but you may not be able to use certain additional features of value. These additional features include the following:

(II) User feedback:We may collect feedback on issues you report to us, the feedback log, and the phone number or e-mail address you give to us. This data is used to help us better understand the problems you are facing with, as well as to allow us to contact you when necessary.

(III) Cases where we collect your personal data from third parties

Your personal data can be collected from third parties under certain conditions allowed by the applicable laws and regulations.

(IV) Nonpersonal data

We may also collect other data that is not directly or indirectly linked to an individual and cannot be defined as personal data under applicable local laws and regulations. Such data may include statistical data generated when you use a particular service, such as clicks, page redirects, and browsing time, collected in order to improve the services we provide to you.

Purposes and Legal Basis of the Processing of Personal Data Your personal data can be processed for the following purposes:

Service Delivery: We process your account and profile data, device information, usage data, location information, and information related to your Smart Devices in order to provide you with our Products and Services that you request or purchase. The legal basis for this kind of processing is the contract made in accordance with our Terms of Use.

Service Improvement: We process your device information, usage data, location information, and information related to your Smart Devices in order to ensure the functionality and security of our Products, develop and improve our Products and Services, analyse the efficiency of our operations, and track and prevent improper use and fraud.

Non-Marketing Communication: We process your Personal Data to send you important information about the Services, modifications proposed on our terms, conditions and policies, and/or other administrative information. You cannot opt out of receiving such communication since this information may be important. The legal basis for this kind of processing is the contract made in accordance with our Terms of Use.

Marketing Communication: We may process your Personal Data in order to provide you with marketing and promotional materials about our Products and Services. When we do this, every communication we send to you contain instructions allowing you to opt out of receiving such communication in the future. The legal basis for this processing is your consent. Additionally, if you agree to participate in our lotteries, contests, or other promotional campaigns, we may use your Personal Data to manage such activities.

Personalization: We may process data related to your use of our products in order to offer you customised services such as personalizing your account and profile data, usage data, device information, and product design, suggesting and displaying information and advertisements about products suitable for you, and inviting you to participate in surveys. The legal basis for this processing is your consent.

Legal Compliance: We may process your Personal Data as we believe is necessary or appropriate for (a) complying with applicable laws and regulations, (b) complying with the legal procedures, (c) responding to requests from public and government officials, (d) enforcing our terms and conditions, (e) protecting our operations, businesses, and systems, (f) protectingour rights, privacy, safety or property and/or the property of other users including you, and (g) allowing us to seek available remedies or limit harm we may suffer.

With Whom Do We Share Personal Data? We never sell any personal data to third parties. We may share your Personal Data with our third-party service providers and business partners as necessary to help us provide you with the products and services described in this Privacy Policy. We only share Personal Data in the ways that we have described you in advance. In this context, we may share your Personal Data with the following recipients:

- Our third-party service providers who perform certain business-related functions for us, such as website hosting, data analysis, payment and credit card processing, infrastructure provision, IT services, customer support services, e-mail delivery services, and other similar services to enable them to serve us.

- Our customers and other business partners who directly or indirectly provide you with your Smart Devices and/or the networks and systems through which you access and use our Websites and Services.

- Affiliates or other third parties in the event of any restructuring, merger, sale, joint venture, transfer, transfer or other disposal of all or any part of our business, assets, or stocks (any bankruptcy or similar proceedings).

- In such a case, you will be notified by e-mail and/or an easily visible notice on our website of any changes in ownership, any modifications on the use of your Personal Data, and the choices you may have regarding your Personal Data.

- As we believe is necessary or appropriate for (a) complying with applicable laws and regulations, (b) complying with the legal procedures, (c) responding to requests from public and government officials, (d) enforcing our terms and conditions, (e) protecting our operations, businesses, and systems, (f) protecting our rights, privacy, safety or property and/or the property of other users including you, and (g) allowing us to seek available remedies or limit harm we may suffer.

- Affiliates or subsidiaries in our corporate family, in order to conduct regular business activities.

- Third parties only upon your consent, except to the third parties described above. If we share your personal information with these third parties, we will use encryption or other similar technology to keep your information secure. We conduct strict audits of the data security practices of the companies and organizations with whom we share personal data, and we also sign very strict data processing contracts with them. We also require third parties to take adequate measures to protect your data and strictly comply with applicable laws, regulations, and regulatory requirements.

International Transfer of Collected Data In order to facilitate our processing operations, we may transfer, store, and process your Personal Data in jurisdictions other than where you live. The laws in these jurisdictions may differ from the laws in effect in your country of residence. Your Rights Related to Your Personal Data

We respect your rights about and control on your Personal Data. You can exercise any of the following rights through the application methods specified below:

Application Method	Application Address	Information to Be Stated in the Application
Personal Application (application in person by the applicant by presenting an identity document)	Cumhuriyet Mahallesi Yeni Yol 1 Sk. Now Bomonti Apt. No: 2/12 Şişli/İstanbul, Turkey	“Information demand under the Law on the Protection of Personal Data” on the envelope
Through Registered Electronic Mail signed with “secure electronic signature”	Karaca.hukuk@hs03.kep.tr	“Information demand under the Law on the Protection of Personal Data” in the subject section of the e-mail
Via the electronic mail address registered to the system of the data controller	kvkk@Karaca.com.tr	“Information demand under the Law on the Protection of Personal Data” in the subject section of the e-mail

We aim to respond to you free of charge within 30 days. If you decide to e-mail us about the use of your Personal Data, make it clear at your request whether you want your Personal Data deleted from our database or what restrictions you would otherwise like to impose on us. Please note that for security purposes, we may ask you to verify your identity before further processing of your request.

You can demand the following in relation to your Personal Data: - To request access to the Personal Data we process about you.

- To request the correction of any inaccurate or incomplete Personal Data.

- To request the deletion of your Personal Data.

- To request temporary or permanent restrictions on the processing of some or all of your

Personal Data.

- To request the transfer of Personal Data to you or a third party or based on your consent or a contract with you, to a third party where we process the data and in an automated manner. - To object to or opt-out of our use of your Personal Data where our use is based on your consent or our legitimate interests.Withdrawal of ConsentYou can withdraw your consent to the collection, use and/or disclosure of your Personal Data under our possession or control, by simply submitting a request. Depending on the specific service you use, you can do this by contacting us at kvkk@Karaca.com.tr. We will process your request within a reasonable time from the date of receipt of your request and then, pursuant to your request, we will stop collecting, using and/or disclosing any of your Personal Data.

Please note that withdrawing your consent may have certain legal consequences. Depending on the scope of the authorizations you have given us to process your Personal Data, you may not be able to use Karaca products or services. However, any decision you take at the point of authorization or withdrawal of consent will not affect Personal Data previously processed upon your consent.

Security We use commercially reasonable physical, administrative, and technical safeguards to protect the integrity and security of your Personal Data. Karaca offers various security strategies to effectively ensure user and device data security. In device access, Karaca-specific algorithms are used for data isolation, access verification, and authorization application. In data communication, communication using security algorithms and transmission encryption protocols and commercial-grade information encryption transmission based on dynamic keys are supported. In data processing, strict data filtering, validation and complete data inspection are applied. In data storage, all confidential information of users is securely encrypted for storage. If you think that your interaction with us is not secure (for example, if you think that the security of your account is compromised), you can immediately report the problem to us by sending an e-mail to kvkk@karaca.com.tr.

Data Storage We will store personal data for as long as necessary to fulfil the purpose for which it was collected, as described in this Privacy Policy, or we will store personal information to comply with the applicable legal requirements. We will stop storage and delete or anonymize your

Personal Data once the purpose for which it was collected is met, or after we receive your request for deletion or cancellation, or when we discontinue the delivery of the relevant product or service. Provided that it is in the public interest or for scientific or historical research or statistical purposes, we will continue to store relevant data in accordance with applicable law, even if the need for further processing is unrelated to the original purpose of collection.

Modifications on the Privacy Policy We may update this Privacy Policy to reflect changes in our information practices. If we make a material modification, we will notify you by e-mail (sent to the e-mail address specified in your account) or via a notification in the mobile apps, before the modification takes effect. We encourage you to periodically review this page for the most recent information on our privacy practices.

Contact Us If you have any questions about our practices or this Privacy Policy, please contact us through the following contact information: Business Name: Karaca Züccaciye Ticaret ve Sanayi A.S.Address: Cumhuriyet Mahallesi Yeni Yol 1 Sk. Now Bomonti Plaza No: 2/12 Şişli/İstanbul, Turkey

MARMARA CORPORATE TAX OFFICE / 5060024769 Trade Registration Number: 278836

Central Registration System (MERSIS) Number: 0506002476900010