GİZLİLİK SÖZLEŞMESİ

A) THE PARTIES 

This agreement (“Confidentiality Agreement”) is signed by Subaşı Gümrük Müşavirliği A.Ş., located at Sultan Selim Mahallesi Lalegül Sokak No:5 İç Kapı No:31 Kağıthane/İstanbul. (Hereinafter referred to as TARAF1) and HYPNOTIC HUMAN HAZIR GİYİM SAN. located at Caddebostan neighborhood Yener Sokak No:1/1 İç Kapı No: 12 Kadıköy / İstanbul. AND TRADE LLC. (Hereinafter referred to as PARTY2). 

In this Agreement, PARTY1 and PARTY2 will be referred to individually as "Party" and together as "Parties". 

B. PURPOSE

Within the scope of this agreement, the parties will mutually exchange information, and the Parties will determine which party, for which purpose and/or purposes, which person, persons or group of persons, Personal Data and Special Category Personal Data defined in Article D of this Agreement belong to. It regulates which data they will process, in accordance with which conditions defined in Article E, and the consequences of this violation in case of any violation.

C. DEFINITIONS

1st Law: Personal Data Protection Law No. 6698

2. Institution: Personal Data Protection Board

3. Personal Data (PI): Any information regarding an identified or identifiable natural person.

4. Personal Data of Special Nature (PRIV): Individuals' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security. Data regarding measures and biometric and genetic data are special personal data.

5. Processing of Personal Data: Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system. Any action performed on data such as bringing, classifying or preventing its use

Policy 6: Personal Data Storage and Destruction Policy

7. Confidential Information: Personal and Sensitive Personal Data

8. Data Destruction: Irrecoverably deleting electronic data. Destroying printed data so that it cannot be read again.

D. PERSONAL AND SPECIAL CATEGORIES OF PERSONAL DATA TRANSFERRED BY THE PARTIES TO EACH OTHER

Categories of personal and special categories of personal data transferred by Party 1 to Party 2:

Data Owner

Personal Data Type

Personal Data Category

Categories of personal and special categories of personal data transferred by Party 2 to Party 1:

Data Owner

Personal Data Type

Personal Data Category

Aim

Party 2 Staff Shareholder/Partner

KV

ID information

Contact information

Transaction Security Information

Legal Transaction Information

Customer Transaction Information

Marketing Information

Risk Management Information

Financial Information

Physical Space Security Information

Audiovisual Recording Information

*Execution of Information Security Processes

*Conducting Audit / Ethics Activities

*Conducting Educational Activities

*Performance of Finance and Accounting Affairs

*Ensuring Physical Space Security

*Following and Execution of Legal Affairs

*Performing Communication Activities

*Execution/Audit of Business Activities

*Execution of Logistics Activities

*Execution of Goods / Service Sales Processes

*Execution of Customer Relationship Management Processes

*Execution of Advertising / Campaign / Promotion Processes

*Performing Storage and Archive Activities

*Execution of Contract Processes

*Ensuring the Security of Data Controller Operations

*Providing Information to Authorized Persons, Institutions and Organizations

PRNKV

Criminal Conviction and Security Measures Information

*Following and Execution of Legal Affairs

*Providing Information to Authorized Persons, Institutions and Organizations

E. CONDITIONS 

1. The Parties agree not to process Personal Data and Special Data in violation of the Law and to take all necessary technical and administrative measures to prevent their processing.

2. The Parties agree not to act contrary to the decisions of the Institution and to follow the decisions of the Institution regularly.

3. Parties agree to analyze the process before processing Personal Data, take precautions by identifying risks, and inform the data owner and the other Party.

4. The Parties agree to take additional precautions when processing personal data of special nature and to comply with the article "In the processing of personal data of special nature, it is also essential to take adequate measures determined by the Board" as stated in Article 6 of the Law.

5. The Parties agree to fulfill the Notification obligation in accordance with the Law and obtain Explicit Consent where necessary, before processing Personal Data and Special Data.

6. The Parties agree to sign a confidentiality agreement with the 3rd Party with whom they will share Personal Data and Sensitive Data, even if the obligations to obtain Information and/or Explicit Consent have been fulfilled. Legally mandatory sharing with authorized institutions and organizations of the state is not within the scope of this article.

7. The Parties agree to be more careful when sharing Special Data and to ensure security by keeping electronic media encrypted and sharing the crypto key with a different media at a different time.

8. The Parties agree to be more careful when sharing Special Qualified Data, to add phrases indicating their importance on printed documents, or to transfer them in protective containers and/or cases with these phrases.

9. The Parties agree to make efforts to minimize the Personal and Sensitive Data they will process as much as possible.

10. The Parties agree to create, enforce, ensure compliance with and supervise the Policy in accordance with the Law.

11. The Parties agree to inform their data processors about the Law and the Policy, provide the necessary training, raise awareness and monitor whether the Policy is complied with.

12. In case of unlawful processing of Personal Data and Special Data or data leakage in one of the Parties, the Party agrees to first apply to the Institution within the period specified in the Law, and then inform the other Party as soon as possible.

It accepts that, for any reason, even if Personal Data or Special Personal Data is processed contrary to the contract and the Law, the obligation to Process Personal Data in accordance with the Law continues.

14. The parties undertake to conclude a confidentiality agreement with their data processing personnel.

15. The Parties agree to make agreements with their data processing personnel that include disciplinary measures for the processing of data in accordance with the Law and this agreement.

16. The Parties undertake to destroy Personal Data after the purpose of data processing ceases.

17. The Parties undertake to destroy Personal Data after the legal reason for data processing is eliminated.

18. The Parties mutually agree to have their compliance with the Law and Policies audited.

F. VALIDITY PERIOD OF THE CONTRACT

This Agreement is valid even if the commercial relationship of the Parties ends, until the personal data processed by the parties is destroyed. It will automatically become invalid after the parties mutually destroy the data they have processed.

H. APPLICABLE LAW, COMPETENT COURT, NOTIFICATIONS

Turkish Law will apply to this Agreement, and if the Agreement needs to be interpreted for any reason, it will be interpreted in accordance with the current legislation of the Republic of Turkey.

Failure to comply with any of the obligations specified in the Agreement will mean the disclosure of Confidential Information. Each party accepts, declares and undertakes to compensate direct damages based on a final judicial decision arising from non-fulfillment of the obligations imposed on them by this Agreement.

In case of any dispute between the parties, a solution will be sought first through negotiation to be resolved within 1 (one) month.

In case of dispute, Istanbul Courts and Enforcement Offices are authorized.

All notifications to be made regarding this agreement will be in writing and the addresses of the parties shown in article (1) will be considered as the notification address. In case of a change of address, the Parties will notify the other Party of their new address within 10 days. Otherwise, the notification made to the old address is considered valid.

This Agreement, consisting of 8 main headings, was signed by the authorized representatives of the parties on 01.03.2024. Officials of the parties received two original copies of the contract.