PARTIES This Membership Agreement ("Agreement") is made between DSM GRUP DANIŞMANLIK İLETİŞİM VE SATIŞ TİC. A.Ş. (“DSM”), located at Maslak Mahallesi, Saat Sokak (Spine Tower), No: 5, İç Kapı No: 19, Sarıyer/İstanbul, and the user (“Member”, “Members”) regarding the Member’s registration on the mobile application and/or website provided by DSM (“Platform”) and the terms under which the Member can access other services mentioned in this Agreement. DSM operates as an e-commerce intermediary and service provider, offering multi-category and multi-model e-marketplace and electronic commerce services (“Platform Services”) through one or multiple mobile apps or websites. By approving this Agreement, downloading and using the Platform, and/or performing transactions on it, the user becomes a member under the terms outlined herein. DSM and the Member will be referred to individually as a “Party” and collectively as the “Parties.” DEFINITIONS Marketplace: The model where DSM, as an “e-commerce intermediary service provider” under Turkish Law No. 6563 and “hosting provider” under Law No. 5651, connects sellers and buyers on the Platform and acts as a commercial representative for sales conducted by sellers on the Platform. Buyer: A natural or legal person Member who purchases goods and/or services listed by third-party sellers on the Platform. Personal Data: Any information that identifies or can identify a real person, as defined under Turkish Law No. 6698 on the Protection of Personal Data (KVKK). Personal Data Notice: A document accessible via the Platform explaining how DSM collects, uses, and protects Members’ personal data. Account / Menu Page: A private page accessible only with the Member’s credentials, where the Member can manage their information, perform transactions, and receive notifications. Seller(s): Legal or natural person Members offering goods and/or services on the Platform under an intermediary agreement with DSM. RIGHTS AND OBLIGATIONS OF THE PARTIES To obtain membership, users must approve this Agreement, provide accurate and current information on the Platform, and have their application approved by DSM. Members must be at least 18 years old and meet other DSM requirements and legal conditions. Once approved, the user obtains full membership rights on the Platform and under this Agreement. Members may access Platform Services across DSM’s websites and apps (including ArStylez) without creating additional accounts, subject to those platforms’ membership terms. Failure to provide accurate information makes the Member personally liable, and DSM may limit or terminate membership at its discretion. Members must promptly update any changes to their information. Membership accounts are personal and cannot be shared with third parties. DSM acts as an “e-commerce intermediary service provider” and “hosting provider” under applicable laws. DSM is not responsible for the accuracy, reliability, legality, or content of third-party listings or materials on the Platform, except for products sold directly by DSM. Members acknowledge that for remote sales agreements with third-party Sellers (excluding DSM itself as a seller), the Sellers are fully responsible under applicable laws, and DSM holds no liability. Members agree that any legal action concerning such products is directed solely at the relevant Seller. Payments to DSM are considered full settlement to Sellers, and DSM is not liable for duplicate payments by Members. Members must comply with this Agreement, Platform rules, applicable laws, and ethical standards in all activities on the Platform. Members bear full legal and criminal responsibility for their actions. Members are responsible for maintaining accurate and current information, including login credentials, and for account security. DSM is not liable for unauthorized access or damages arising from misuse. Members acknowledge that any action performed with their credentials is considered their own, and DSM is not responsible for actions taken under their account. Members must use the Platform and its content lawfully and ethically. DSM may restrict or terminate accounts at its discretion for violations. Examples of prohibited use include: Damaging the Platform or others’ systems Unauthorized data collection or database manipulation Creating fake accounts or using others’ credentials Uploading harmful software, viruses, or malware Overloading or interfering with Platform systems Violating others’ rights or using the Platform unethically Members must ensure all uploaded content (“Member Content”) complies with laws, ethics, third-party rights, and the Platform rules. DSM has no obligation to monitor content but reserves the right to review and remove it. Members acknowledge that product reviews may be shared with Sellers in compliance with laws. By uploading Member Content, Members confirm they hold exclusive intellectual property rights and grant DSM a worldwide, royalty-free, sublicensable license to use such content without limitations. DSM has taken reasonable precautions to ensure Platform content is free from harmful software, but does not guarantee it. Members are responsible for protective measures on their devices. DSM ensures the Platform’s functionality and availability “as-is” and provides no guarantees regarding accuracy, security, or uninterrupted access. Links on the Platform may lead to external websites or apps. DSM is not responsible for these external sites. DSM may reject membership applications, terminate memberships, or impose additional conditions at its discretion. Any changes published on the Platform are binding upon Members unless explicitly required to be approved by law. Members can terminate their membership at any time via the Platform. Account closure prevents further access and rights transfer. DSM may modify, suspend, or remove the Platform or Platform Services at its discretion and bears no liability to Members or third parties. PERSONAL DATA PROTECTION DSM processes personal data in compliance with KVKK and other applicable laws for purposes including service delivery, order fulfillment, account security, fraud prevention, dispute resolution, and Member satisfaction. DSM may process personal data to offer Members suitable products and facilitate access. Members can review DSM’s Personal Data Notice on the Platform, which DSM may update. Members may submit requests regarding their personal data via the methods provided in the Personal Data Notice or via email to kvkk@arstylez.com . Upon termination of membership, personal data not required by law will be deleted, while legally required data will continue to be processed. DSM will implement all necessary measures to protect personal data from unauthorized access or illegal processing. COMMERCIAL ELECTRONIC MESSAGES DSM may send marketing messages to Members who have consented, via email, calls, or SMS. Members must keep contact information up-to-date. Members may withdraw consent or opt-out through the Platform or other legally prescribed methods. INTELLECTUAL PROPERTY RIGHTS All Platform content and related rights (“DSM Content”) are owned by DSM. Other Members’ shared content (“Other Member Content”) belongs to the sharing Member. Membership does not grant rights to DSM Content or Other Member Content. Unauthorized use is strictly prohibited, and Members are liable for any resulting damages. AMENDMENTS AND WAIVER DSM may unilaterally amend this Agreement, Platform rules, or policies at any time. Changes are effective upon publication unless legally required to obtain Member consent. Any waiver by DSM does not constitute future waiver of rights or obligations. FORCE MAJEURE Events beyond DSM’s control, such as natural disasters, cyberattacks, labor disputes, infrastructure failures, or legal changes, may excuse performance without DSM liability. MISCELLANEOUS DSM’s records, including databases and electronic archives, are binding evidence in disputes. Turkish law governs this Agreement. Disputes fall under Istanbul Central (Çağlayan) courts and enforcement offices. Invalidity of any provision does not affect the remaining Agreement. Members may not transfer rights or obligations under this Agreement without DSM’s prior written consent.
As ArStylez, we would like to inform you that, with your explicit consent, your personal data may be processed for the purpose of improving our products and services and offering you exclusive advantages. If you provide your explicit consent, your segmentation data will be processed so that we can develop our products and services and present you with special and advantageous offers. Your segmentation data consists of scores and profiling information created based on your activities performed through your membership account on our website and/or mobile application. By giving consent, the profiling and scoring data generated for you may be processed electronically by ArStylez for the following purposes: presenting you with personalized special offers, carrying out activities to better understand you and improve your satisfaction, offering products or services tailored to your preferences, enriching our data, and sending you commercial electronic communications. At ArStylez, we handle your personal data in accordance with the principles of “need-to-know” and “need-to-use,” ensuring data minimization and taking all necessary technical and administrative security measures. Your scoring and profiling data, primarily for the purposes mentioned above, may also be shared with our business partners, affiliates, or—if required—authorized persons, institutions, and organizations, in order to ensure business continuity, conduct audits, operate digital infrastructures, and enable necessary data flows with different stakeholders.
1 - Introduction As DSM Group Consultancy, Communication and Sales Trade Inc. (“Company”), the privacy and security of your personal data are among our top priorities. Our Company processes your personal data in compliance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) and relevant secondary legislation. Personal data refers to any information that identifies or can identify you. If you become a Platform Member by accepting the Membership Agreement to use the services provided in our mobile applications and/or websites (collectively, the “Platform”) (collectively, the “Platform Services”), we would like to inform you about the personal data that is processed. 2 - What Personal Data Do We Process? As a Platform Member, the following personal data may be processed: User Account Information: Name, surname, customer number, membership email, and if provided, phone number, gender, date of birth, height and weight, Turkish ID number (processed only for certain product groups according to relevant legislation). Customer Transaction Information: Order and invoice information, purchase history, requests and complaints, Platform usage data, any information shared in comments or questions about products, rating and review data, chat content, cancellation/refund details. Delivery Information: Phone number and delivery address added for product delivery, delivery transaction details. Payment Information: Payment and payment method details, saved card information. Transaction Security Information: Device information, IP address, password information, cookies, platform access logs, login method (Google/Facebook). Legal Transaction Information: Information in correspondence with authorized persons, institutions, and organizations, lawsuit and enforcement file data, legal information requests. Audio Recordings: Voice recordings if you contact our call center. Additional Services: Data processed when using additional services such as food delivery, marketplace, financial services, insurance, lucky draws, or buy-sell platforms (like Dolap). 3 - Legal Basis, Purpose, and Collection Methods for Processing Your Personal Data Your personal data may be collected electronically via our Platform (mobile app or website), live chat, call center, email, printed forms, postal services, or physically if required by legal authorities, either fully or partially automatically or manually. The purposes and legal basis for processing your data are as follows: 3.1 Membership and Account Creation Processed Data: User account information, customer transaction information, transaction security information. Purpose: Execution and fulfillment of the membership agreement. Creation and management of Platform profiles/accounts. Verification of contact information. Enabling purchase transactions on the Platform. Conducting and auditing Company operations. Ensuring Platform security. Compliance with laws such as the Electronic Commerce Law (No. 6563), Turkish Commercial Code (No. 6102), Turkish Penal Code (No. 5237), and Consumer Protection Law (No. 6502). Legal Basis: Legal obligation, fulfillment of membership agreement, legitimate interest. Note: If you use the Platform as a guest, detailed information about your processed data is available via the “Continue without Membership” button. 3.2 Order, Delivery, and Cancellation/Return Processes Processed Data: User account information, delivery information, customer transaction information, payment information, transaction security information. Purpose: Order creation and processing. Fulfillment of distance sales contracts. Execution of delivery and logistics processes. Handling cancellations/returns. Payment and invoicing processes. Compliance with relevant regulations and decisions issued by authorities. Execution of product/service purchase processes. Legal Basis: Legal obligation, fulfillment of membership agreement. 3.3 Customer Experience Improvement Processed Data: User account information, customer transaction information, delivery information, transaction security information, legal transaction information, audio recordings. Purpose: Providing fast and easy access to products based on preferences and interests. Improving user experience across Platform Services. Enhancing service quality, analytics, reporting, and communication. Evaluating feedback, complaints, and suggestions. Supporting post-sale services. Legal Basis: Fulfillment of membership agreement, legitimate interest. 3.4 Company Information Security, Risk, Audit, and Control Processes Processed Data: User account information, customer transaction information, delivery information, payment information, transaction security information. Purpose: Conducting finance and accounting processes and audits. Ensuring information security and investigating suspicious activity. Securing Platform operations. Monitoring, improving, and ensuring the quality of services. Fraud prevention. Legal and financial reviews during mergers, acquisitions, or structural changes. Legal Basis: Fulfillment of membership agreement, legitimate interest. 3.5 Legal Procedures Processed Data: User account information, customer transaction information, delivery information, payment information, transaction security information, legal transaction information, audio recordings. Purpose: Managing legal cases and responding to legal requests. Compliance with laws and Company obligations. Legal consulting and sharing information with authorized institutions if required. Protecting and exercising rights in case of disputes. Legal Basis: Required for exercising or protecting a legal right, fulfilling Company legal obligations. 3.6 Consent-Based Processes Processed Data: User account information, customer transaction information, delivery information, payment information. Purpose: Conducting marketing, advertising, and promotional activities. Providing financial offers and personalized advantages. Sending commercial electronic communications based on your preferences. Legal Basis: Your explicit consent. Note: You can withdraw your consent at any time using the methods described under the “7-Rights and Requests Communication” section. 3.7 Additional Services on the Platform Personal data is also processed when using additional services. Detailed information is available for each service: Food & Quick Market (arstylez): Personal data processed after accessing ArStylez can be viewed under “Data Policy” in the “My Account” Insurance: Personal data processed via ArStylez Insurance is detailed by DSM Turkey Insurance Brokerage Services Inc. Financial Solutions: Information is available in the related screen for processed data. Lucky Draw (Prize Lottery): Personal data processed when participating in the lucky draw is available in the identity verification screen. 4. To Whom and Why Does the Company Transfer Your Personal Data? Our Company processes your personal data with care, following the principles of “need to know” and “need to use,” ensuring necessary data minimization, and applying required technical and administrative security measures. Within Turkey, your personal data may be shared with the recipient groups listed below based on the legal grounds outlined in Article 8 of the KVKK: “explicitly prescribed by law, necessary for the Company to fulfill its legal obligations, necessary for establishing or executing a contract, necessary for establishing, using, or protecting a right, and/or necessary for the legitimate interests of the Company.” When transferring personal data abroad, it is shared with the recipient groups below based on the legal grounds in Article 9 of the KVKK and the Regulation on the Transfer of Personal Data Abroad: “providing adequate safeguards with a standard contract or, incidentally, the existence of one of the situations specified in Article 9, Paragraph 6 of the KVKK.” 4.1 Membership and Account Creation For the purpose of providing you access to Platform Services, establishing and executing the membership agreement, your personal data is shared with: Our affiliates and group companies; Our affiliates, group companies, partners, and service providers who operate or provide IT, technology, and software services for Platform operations; Our affiliates and group companies located abroad for the purposes above. Legal Basis: Necessary for the establishment or execution of the contract; providing adequate safeguards with a standard contract. 4.2 Order, Delivery, and Cancellation/Return Processes Your personal data may be shared with: Product sellers or service providers, to facilitate your purchase and billing and to comply with applicable legislation; Product sellers, cargo companies, and private couriers, to manage logistics and delivery processes; Banks and other payment institutions, for payment processing and monitoring; Business partners providing bulk SMS/email services to inform you about delivery or related updates; For international orders, with foreign logistics companies, sellers, and customs consultancy firms for delivery, returns, logistics, customs processes, and Platform operations. Legal Basis: Fulfillment of legal obligations; necessary for establishing or executing a contract; providing adequate safeguards with a standard contract. 4.3 Customer Experience Improvement For improving customer experience, your data may be shared with: Partners providing call center or customer support services for sales and post-sales support, ensuring satisfaction, and handling requests and complaints; Service providers abroad, affiliates providing IT, software, and technology services, group companies, partners, and consultants for Platform operations and service improvement. Legal Basis: Necessary for establishing or executing the contract; providing adequate safeguards with a standard contract; incidentally, one of the situations specified in Article 9, Paragraph 6 of the KVKK. 4.4 Information Security, Risk, Audit, and Control Your data may be shared with: Partners, consultants, service providers, banks, e-invoice partners, cargo and courier companies, private integrators, auditors, customs, and accounting service providers for billing, electronic invoice delivery, contract/fiscal delivery, risk detection, fraud prevention, and financial/accounting management; For operational security, quality control, risk identification, with independent auditors, integrators, technology companies, partners, and group companies; For mergers, acquisitions, joint ventures, or other structural changes, with potential buyers, sellers, consultants, and database service providers under confidentiality obligations. Legal Basis: Fulfillment of legal obligations; necessary for establishing or executing a contract; necessary for the legitimate interests of the Company. 4.5 Legal Procedures Your personal data may be shared with: Regulatory and supervisory authorities, courts, enforcement offices, mediators, and other public institutions to fulfill legal obligations and ensure compliant Platform operations; Lawyers, auditors, tax consultants, forensic IT experts, cybersecurity consultants, group companies, affiliates, and other third-party service providers for audit, legal consultancy, operational security, and investigation of suspicious transactions; Foreign authorities, if requested, and for exercising or protecting a legal right in case of dispute. Legal Basis: Explicitly prescribed by law; fulfillment of legal obligations; necessary for establishing, exercising, or protecting a right; necessary for establishing or executing a contract; incidentally, one of the situations specified in Article 9, Paragraph 6 of the KVKK. 4.6 Processes Based on Explicit Consent For marketing, advertising, promotions, offering personalized advantages, and improving customer satisfaction, your data may be shared with affiliates, group companies, service providers, and business partners. Legal Basis: Your explicit consent. 5. How Does the Company Protect Your Personal Data? Personal data shared with the Company is under its supervision and control. As the data controller, the Company establishes the necessary organization and implements technical measures to protect the confidentiality and integrity of data. Periodic penetration tests are conducted according to international and national standards for data confidentiality. Personal data transmitted via website, mobile site, or app is protected with SSL (Secure Sockets Layer) technology. Regular risk analyses are performed to mitigate risks in data processing activities. Access and authorization controls prevent unauthorized access to personal data. Data processing policies are regularly updated. 6. Your Rights Regarding the Protection of Personal Data You can exercise your rights by applying to the Company using the methods described in the “Contact for Rights and Requests” section of this privacy notice. Your rights include: Learning whether your personal data is being processed, Requesting information if your data has been processed, Learning the purpose of processing your personal data and whether it is being used in accordance with that purpose, Knowing the third parties your personal data has been transferred to, whether domestically or internationally, Requesting the correction of incomplete or inaccurately processed personal data, Requesting deletion or destruction of personal data in accordance with the conditions prescribed by the KVKK, Requesting that the corrections, deletions, or destructions carried out be communicated to third parties to whom your personal data has been transferred, Objecting to results arising against you from the exclusive analysis of your personal data through automated systems, Claiming compensation if you suffer damage due to the unlawful processing of your personal data. 7. Contact for Rights and Requests You can submit your questions and requests regarding your personal data through: A petition prepared in accordance with the Communiqué on Procedures and Principles for Application to the Data Controller, or The ArStylez Application Form. The application methods are as follows: Application Method Address for Submission In-person Written Application Maslak Mahallesi Saat Sokak Notary Maslak Mahallesi Saat Sokak Signed via Secure Electronic Signature or Mobile Signature with Registered Electronic Mail (KEP) From your previously registered email in our system kvkk@arstylez.com Please write “Request Regarding Personal Data Protection Law” in the subject line of your email or on the envelope of your petition. For in-person written applications, it is mandatory to present documents proving your identity. In such cases, when applying in person at Maslak Mahallesi Saat Sokak Spine Tower No:5, Internal Door:19, Sarıyer, Istanbul, please provide a copy of the front side of your ID only (excluding blood type and religion) along with the application form. As the data owner, your requests will be processed free of charge within 30 days. However, if responding to your application incurs a cost under the legislation, the Company may charge a fee as determined by the Personal Data Protection Board. 8. About the Privacy Notice The Company reserves the right to update this Personal Data Protection Notice at any time in accordance with changes in the applicable legislation.