Kişisel Verilerin Korunması Kanunu Kapsamında Gizlilik Politikası ve Aydınlatma Metni

PRIVACY POLICY AND CLARIFICATION TEXT

In this Privacy Policy and Clarification Text, the terms and conditions regarding the processing of personal data shared by users ("Data Owner") via the OpisPlay Mobile Application ("Mobile Application") and OpisPlay Website ("Website") managed by Alba Bilgi Teknolojileri A.Ş. ("OpisPlay"), located at FerhatPaşa Mahallesi 77. Sokak No:46 Alba Plaza Ataşehir/İstanbul, or processed by Alba Bilgi Teknolojileri during the users' use of the Mobile Application and Website, in accordance with the Law on the Protection of Personal Data No. 6698 ("Law") and other relevant legislation, are explained.

The security of user data is ensured, and all necessary security measures are taken against unlawful access.

This Privacy Policy and Clarification Text explains the conditions under which personal data collected within the scope of services offered through the Mobile Application and Website are processed.

1. Data Controller Your personal data is processed by Alba Bilgi Teknolojileri A.Ş. in the capacity of data controller in accordance with the relevant legislation and through the methods specified below.

2. Method of Collection of Your Personal Data and Legal Grounds for Processing

2.1. All information collected within the framework of commercial activities carried out by Alba Bilgi Teknolojileri A.Ş. is processed for the purpose of conducting Alba Bilgi Teknolojileri A.Ş.’s activities in accordance with the law. Personal data and special categories of personal data obtained in this context are procured verbally, in writing, or electronically. Your personal data is collected by Alba Bilgi Teknolojileri via the Mobile Application and Website, through fully or partially automated means, or by non-automated means provided that they form part of a data filing system, based on the legal grounds of the establishment or performance of a contract, legitimate interest, legal obligation, the establishment, exercise, or protection of a right, and explicit consent for activities requiring such consent.

2.2. Within the framework of this Privacy Policy, unless otherwise stated, the term "personal data" comprises the information listed below:

• Identity and Contact Information: Name, Surname, Phone number, E-mail address.

• User Information, User Transaction Information, and Financial Information: Membership details, membership ID, date and time information regarding your use of Mobile Application services, your reasons for contacting the Mobile Application, Website, or Live Support, Member Merchant Preferences, Preferred Member Merchant Branch, spending information at the Member Merchant, campaign participation details, points earning and spending information, spending cancellation/refund transaction information, errors occurring during usage, invoice and payment details, balance information, at which member merchant/branch the spending was made, campaign participations, points earned, points spending refund/cancellation requests, shared balance information.

• Transaction Security Information: Log-in credential information, password information, user movements (audit trails).

• Location Data (Subject to explicit consent): Location data obtained for the purpose of finding Member Merchant/branch locations and for security purposes during payment.

• Marketing Information: Reports and evaluations showing your habits and tastes, targeting data, cookie records, etc.

• Request/Complaint Management Information: Requests and complaints you make, and comments you share via the Mobile Application, Website, and call center.

• Risk Management Information: IP address, Device information.

2.3. Data that has been anonymized pursuant to Articles 3 and 7 of the Law shall not be considered personal data within the framework of said legal provisions, and processing activities regarding such data shall be carried out irrespective of the provisions of this Privacy Policy.

Within the scope of the personal data processing conditions specified in Articles 5 and 6 of the KVKK (Personal Data Protection Law), the categories of your personal data processed and the purposes for processing such data—including user notifications regarding products or services (e.g., legal notifications, account activity notifications), accounting and finance transactions, balance loading and updating, balance sharing, customer relationship management, evaluation and resolution of requests and/or complaints, execution of necessary works by our relevant units to ensure users benefit from the services offered by Alba Bilgi Teknolojileri A.Ş., ensuring information security, performing secure login operations to accounts, preserving data accuracy and quality standards, and fulfilling legal obligations—are explained in detail below.