Information Notice on the Processing of Personal Data

Dear customer, as SPORTS FAN ENTERTAINMENT MEDYA TICARET A.S. (the "Company"), we attach great importance to the protection of your personal data. In this context, as the data controller under Law No. 6698 on the Protection of Personal Data ("KVKK"), we process your personal data in accordance with the KVKK and within the purposes and limits stated below, and we take the necessary administrative and technical measures with due care.

We would like to inform you through this Information Notice on the Processing of Personal Data (the "Notice") about our personal data processing activities within the platform accessed through our website (the "Platform") and about your rights under the KVKK.

1. Personal Data We Process

Within the scope of Platform membership and/or use, the Company may process the following personal data ("Personal Data"):

• Identity information: name and surname, photograph.
• Contact information: address, telephone number, e-mail address.
• Marketing information: communication preferences.
• Transaction security information: Platform username and password information, IP address, website login/logout and visit information, log records.
• Customer transaction information: membership information, comment information, campaign information, discount code information.
• Order information: order, amount, invoice, cargo and delivery information for the product selected through the Platform.
• Financial information: encrypted bank and credit card information.
• Other information: requests and complaints submitted to the Company through the Platform and information shared within this scope.

Cookies are used only to the extent necessary to ensure the functionality of the Platform. For detailed information about cookies, please review the Cookie Information Notice.

2. Method of Collecting Your Personal Data

Your identity and contact information is collected from the information and documents you provide within the scope of membership or orders. Transaction security information, order information and other information are collected by automated methods within the scope of the Platform and processed electronically.

3. Purposes, Legal Grounds and Transfers of Your Personal Data

If you request to register on the Platform or create a membership, your identity information, contact information and transaction security information may be processed for the purposes of creating and verifying your membership, recording member information, enabling member login, keeping membership information accurate and up to date, providing membership-related notifications, performing the membership agreement, carrying out distance sales and fulfilling order-related processes. These processing activities are based on the legal grounds that processing is necessary for the establishment or performance of a contract and that processing is mandatory for the legitimate interests of the data controller, provided that your fundamental rights and freedoms are not harmed.

Your identity information, contact information, customer transaction information, order information and transaction security information may also be processed to ensure transaction security on the Platform and to increase and maintain customer loyalty, based on the same legal grounds.

If you submit a request or complaint to the Company through the Platform, your identity information, contact information and other information may be processed for the purposes of reviewing and resolving your request or complaint and increasing and maintaining customer loyalty, based on the Company's legitimate interests, provided that your fundamental rights and freedoms are not harmed.

Personal Data processed within these processes may be shared with information technology service providers from whom we receive software, Platform operation, platform software support, database and server, middleware, archiving and Platform service support, and with audit service providers within the scope of the Company's audit processes.

Because the servers used by certain software and service providers related to the Platform, including database and server providers, middleware providers, archiving providers and Platform service providers, may be located abroad, your Personal Data may be transferred abroad based on your explicit consent.

4. Processing of Personal Data for Commercial Electronic Communications

If you have consented to commercial electronic communications, your name, surname, telephone number and e-mail address may be processed so that the Company can inform you about campaigns, promotions, products and services, send newsletters, provide customer satisfaction applications, advertisements, information and marketing communications. This processing is based on the Company's legitimate interests, provided that your fundamental rights and freedoms are not harmed.

If you later refuse to receive commercial electronic communications from the Company, records regarding this refusal, and information regarding any later permission you give to receive such communications again, may be processed based on the Company's legitimate interests.

Where you have consented to commercial electronic communications, your name, surname and, depending on the communication method, your telephone number and/or e-mail address may be shared, to the extent necessary, with mobile media companies, agencies, marketing companies, information technology companies and consultants from whom the Company receives support for sending commercial electronic communications. Your telephone number and/or e-mail address and information regarding any refusal of, or later permission for, commercial electronic communications may be shared with authorized organizations under the Regulation on Commercial Communication and Commercial Electronic Messages, intermediary service providers and software providers, and information technology companies and consultants that support such transfers.

Personal Data processed within this scope may also be shared with information technology service providers from whom we receive software and service support, including database and server providers, monitoring/targeting technology providers, marketing/advertising/analytics support providers, middleware providers and archiving providers, and with audit service providers.

Because the servers used by certain software and service providers related to the Platform may be located abroad, your Personal Data may be transferred abroad based on your explicit consent.

5. Processing of Personal Data for Legal Processes and Internal Activities

Your Personal Data may be processed for purposes including exercising all response, objection and litigation rights before courts, enforcement offices, arbitral tribunals, the Personal Data Protection Authority, the Ministry of Trade and other official authorities in the event of a complaint or dispute; conducting negotiation and settlement processes, including mediation; using information as evidence; providing information requested by authorized public institutions; and responding to your information requests or legal rights applications. These processing activities are based on the legal grounds that processing is necessary for the establishment, exercise or protection of a right and that processing is mandatory for the legitimate interests of the data controller, provided that your fundamental rights and freedoms are not harmed.

Your Personal Data may also be processed within the scope of internal audit, internal control, compliance and reporting activities based on the legal grounds that processing is necessary for the data controller to fulfill its legal obligations and for the legitimate interests of the data controller.

Your Personal Data may be shared, to the extent necessary, with relevant public institutions and authorities in order to fulfill our legal obligations, including providing information to authorized public institutions. In addition, in the event of a complaint or dispute, Personal Data may be shared with relevant public authorities, judicial authorities and our lawyers/legal consultants for the purposes of exercising our legal rights, conducting mediation and dispute processes, and responding to claims.

If your Personal Data must be shared with a third party other than the cases listed in this article, we will separately fulfill our obligation to inform you regarding that specific transfer.

6. Processing of Personal Data Where the Platform User/Member Is a Legal Entity

If the Platform user/member is a legal entity, the name, surname, telephone number and e-mail address of the legal entity user's natural person representative are collected through information and documents submitted to the Company by the legal entity user. Depending on the form and channel through which such information and documents are submitted, they may be collected by non-automated methods for physical documents and by automated methods for electronic channels, and processed by automated methods when recorded in the Company's systems.

This information is processed for the purpose of contacting the Platform user/member, based on the Company's legitimate interests, provided that the representative's fundamental rights and freedoms are not harmed.

Because the servers used by certain software and service providers related to the data controller's systems, including database and server providers, middleware providers, archiving providers and Platform service providers, may be located abroad, your Personal Data may be transferred abroad based on your explicit consent.

7. Your Rights as a Data Subject Under the KVKK

Under the KVKK and applicable legislation, you have the right to:

• learn whether your Personal Data is processed;
• request information if your Personal Data has been processed;
• learn the purpose of processing your Personal Data and whether it is used in accordance with that purpose;
• know the third parties to whom your Personal Data is transferred in Turkey or abroad;
• request correction if your Personal Data is incomplete or incorrectly processed and request notification of the correction to third parties to whom the Personal Data has been transferred, if any;
• request deletion or destruction of your Personal Data if the reasons requiring processing no longer exist, even if it has been processed in accordance with the KVKK and applicable legislation, and request notification of this action to third parties to whom the Personal Data has been transferred, if any;
• object to a result against you arising from analysis of processed data exclusively through automated systems;
• request compensation if you suffer damage due to unlawful processing of your Personal Data.

8. How to Apply to the Company Regarding Your Rights

You may submit applications regarding the rights listed above in accordance with the Communique on the Procedures and Principles of Application to the Data Controller. Applications may be submitted in writing or electronically through a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the e-mail address previously notified to and recorded in our systems. To allow the Company to verify that you are the true right holder, your application should include information/documents verifying your identity but not containing any special categories of personal data such as religion or blood type. Examples include Turkish ID number or passport number for foreign nationals, residential or business address for notifications, mobile/telephone/fax number and e-mail address.

Applications may be sent by physical mail to Merdivenkoy Mah. Dikyol Sk. B Blok No. 2, Interior Door No:179, Kadikoy/Istanbul, or by e-mail to destek@star.fan. Depending on the nature of your request, your applications will be concluded as soon as possible and no later than 30 (thirty) days, free of charge. However, if the transaction requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

If any changes occur in the data processing processes regulated under this Notice, the changes will be reflected in the Notice as soon as possible, and you may always review the current version on the Platform.

9. Cookie Information Notice

As Sports Fan, we use certain cookies to improve the user experience on our website. Cookies used for security purposes may change from time to time in parallel with technological developments. This page contains information about the cookies currently used and the information they collect. All data collected through cookies is within the scope of Law No. 6698, related legislation, the Personal Data Processing and Protection Policy, and the Personal Data Retention and Destruction Policy.

10. Cookie Policy

Cookies are files created by websites you visit. They store browsing information such as site preferences or profile information. Cookies are loaded by your internet browser when you visit the Site and stored on the device through which you access the Site. Cookies are necessary to make browsing during your visit easier and to make the Site user-friendly, and they do not harm your device.

Sports Fan may track your browsing information on the Site and/or your membership usage history on the Site in order to provide personalized promotions, promotions and marketing offers, improve Site content for you and/or determine your preferences. Sports Fan may match information collected online and offline, or collected from you on the Site by different methods or at different times, and may use this information together with information obtained from third-party sources. Such matching and use will remain within the purposes and scope set out in this Privacy and Cookie Policy.

Sports Fan may also use cookies to present advertisements that may be of interest to you when you visit search engines, the Site and/or websites on which Sports Fan advertises. When presenting these advertisements, a third-party cookie may be placed in your browser so that Sports Fan can recognize you.

Except for third-party cookies used and managed by external organizations to provide services requested by us to improve the experience of users visiting the Site, information stored in cookies on the Site is used specifically only by Sports Fan. The main purposes of these third-party cookies are to obtain access statistics and to ensure the security of payment transactions.

We do not store sensitive information such as your password or credit/debit card information in the cookies we use. Information about cookies used to collect your browsing information will be provided through a pop-up screen when you first enter the Site. If you choose to prevent the use of cookies on the Site, you must first disable the cookie feature in your browser and then delete the saved cookies associated with this Site. You may use the option to prevent cookies at any time. However, preventing cookies may result in your inability to use certain services offered on the Site.