BURCUONLINE PERSONAL DATA PROTECTION LAW INFORMATION NOTICE

1. Identity of the Data Controller

Within the scope of the Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by Mehmet Kocaman – Kocaman AR-GE Consultancy Industry Trade and Education Services, acting as the data controller, under the Burcuonline website for the purposes explained below and in compliance with the law.

Contact Information:

Website: www.burcuonline.com
Address: Kocacami Neighborhood, Lefke Street, Building No:16, Burhaniye/Balıkesir
Phone: 0530 882 75 00
E-mail: info@burcuonline.com
Registered E-mail (KEP) Address: mehmet.kocaman.10@hs01.kep.tr

2. Processed Personal Data

During your use of products and services offered through Burcuonline, the following categories of personal data may be processed:

• Identity information: Name, surname, and information required to be on the invoice when necessary
• Contact information: Phone number, e-mail address, delivery and billing address
• Customer transaction information: Membership, order, cart, request, return, cancellation, complaint, and customer service records
• Financial transaction information: Payment method, transaction and confirmation details, invoice and return records
• Transaction security information: IP address, login-logout records, device and connection information
• Legal transaction information: Correspondences with authorized institutions, dispute and application records
• Marketing information: Campaign preferences and commercial communication records if communication permission is given
• Request and communication information: Contact forms, messages, suggestions, and complaint content

Payment card information may be processed within the secure infrastructure of the relevant bank or authorized payment service provider depending on the preferred payment method. Only the payment and confirmation information necessary to complete the transaction may be transmitted to Burcuonline.

3. Purposes of Processing Personal Data

Your personal data is processed solely for the following purposes:

• Creating and managing membership processes
• Receiving, preparing, invoicing and delivering orders
• Managing payment, return, cancellation and right of withdrawal processes
• Evaluating customer requests, suggestions, and complaints
• Providing post-sales support services
• Managing cargo and delivery processes
• Issuing e-invoices and e-archive invoices
• Fulfilling accounting, finance and tax obligations
• Ensuring transaction and website security
• Preventing unauthorized access, fraud and misuse attempts
• Responding to requests from authorized public institutions and judicial authorities
• Establishing, exercising and protecting rights in legal disputes
• Sending campaign, discount and promotional notifications if explicit communication consent is given

4. Methods and Legal Grounds for Collecting Personal Data

Your personal data may be collected electronically or physically via website membership and order forms, payment and delivery transactions, phone, e-mail, WhatsApp, contact forms, cookies, technical transaction records, and other communication channels established with Burcuonline.

Your personal data is processed based on the legal grounds specified in Article 5 of the KVKK;

• Being directly related to the establishment or performance of a contract
• Being mandatory for the data controller to fulfill a legal obligation
• Explicitly prescribed by laws
• Being compulsory for the establishment, exercise or protection of a right
• Being mandatory for the legitimate interests of the data controller provided it does not harm the fundamental rights and freedoms of the relevant person

Consent is separately obtained for commercial electronic communications, use of non-mandatory cookies, or other transactions requiring explicit consent. Reading this information notice alone does not constitute consent or permission for commercial communication.

5. Transfer of Personal Data

Your personal data may be transferred to the following recipient groups limited to the purposes stated and with necessary security measures taken:

• Cargo and logistics companies for order delivery
• Banks and authorized payment institutions for processing payment transactions
• Firms providing website infrastructure, hosting, software, technical support and cybersecurity services
• Providers of e-invoice, e-archive, accounting and financial consulting services
• Authorized public institutions and judicial authorities to fulfill legal obligations
• Authorized consultants and service providers limited to necessary information when obtaining legal and technical support

In case of international transfer of personal data, the conditions and appropriate safeguards stipulated in Article 9 of the KVKK are applied; explicit consent is obtained separately if required.

6. Storage and Security of Personal Data

Your personal data is retained for the period required for the purpose of processing and within the legal retention periods prescribed by the relevant legislation. Upon expiration of the retention period or cessation of the processing purpose, personal data is deleted, destroyed or anonymized.

Necessary technical and administrative measures are taken to prevent unlawful processing and access to personal data and to ensure secure storage.

7. Rights of the Data Subject

Under Article 11 of the KVKK, everyone has the right to apply to the data controller and;

• Learn whether personal data is processed
• Request information if personal data has been processed
• Learn the purpose of processing and whether it is used in accordance with that purpose
• Know the third parties to whom the personal data has been transferred
• Request correction of incomplete or incorrect data
• Request deletion or destruction of data under the conditions specified by law
• Request notification of correction, deletion or destruction to the third parties to whom data has been transferred
• Object to any result unfavorable to them arising from analysis solely by automated systems
• Claim compensation for damage due to unlawful processing of personal data

in respect of their personal data.

8. Application Method

You can submit your requests within the scope of the KVKK along with information confirming your identity;

• In writing to Kocacami Neighborhood, Lefke Street, Building No:16, Burhaniye/Balıkesir
• To the registered e-mail (KEP) address mehmet.kocaman.10@hs01.kep.tr
• By using one of the legally accepted application methods to the e-mail address info@burcuonline.com

Applications are concluded free of charge within the shortest time possible and at the latest within thirty days, depending on the nature of the request. If additional costs arise, fees determined by the Personal Data Protection Board may apply.

9. Effective Date and Updates of the Notice

This information notice may be updated depending on Burcuonline’s personal data processing activities or changes in the relevant legislation. The updated notice becomes effective as of the date it is published on www.burcuonline.com.

Last Update Date: August 2026