Leartes Studios Data Privacy Notice and Clarification Text

General InformationLeartes Studios Tasarım ve Yazılım Hizmetleri Ticaret Anonim Şirketi (“Company”) respects its clients’, visitors’ and employees’ concerns about privacy and data protection. This Clarification Text is not a contract and does not create any contractual rights or obligations.This Clarification Text describes the types of personal information Leartes Studios collects about users of our services, how we may use the information and with whom we may share it. The clarification text also describes the measures we take to safeguard the personal information. The clarification text also informs about the rights of data subject.This Clarification Text has been drafted in accordance with the European Union General Data Protection Regulation (“GDPR”), Turkish Law No.6698 (“KVKK”), Consumer Data Protection Act of State of Virginia (“ CDPA”), and California Privacy Rights Act of State of California (“ CPRA”).What is personal data?Personal data means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data. In this context, the data of legal entities are not within the scope of the personal data protection legislation. However, personal data belonging to natural persons representing legal entities are subject to the processing conditions and legal protection shown herein and in the data texts of Leartes Studios.Information which cannot be linked to your real identity is not considered personal data.

Data ControllerThis Clarification Text applies for the data processing carried out by:Leartes Studios Tasarım ve Yazılım Hizmetleri Ticaret Anonim ŞirketiAddress: Merdivenköy Mah. Dikyol Sk. B Blok No: 2 İç Kapı No: 193 KADIKÖY/ İSTANBULPhone Number: +90 5551416847E-Mail: privacy@leartesstudios.com If you have any queries with regard to the processing of your personal data, please contact the Company. The Data Protection Team is also available to help with data subject access requests, take suggestions or handle complaints.

DefinitonsFor the purposes of this Clarification Text;

"Consent": Means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to Data Subject.

"Contract": Means any contract between Company and data subject.

"Controller": Means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

"Data Subject": Means the identified or identifiable living individual to whom personal data relates.

"Personal Data": Means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing": Means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Processor": Means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

"User": Refers to the natural and legal persons who visit the Website and Platforms offered by Leartes Studios (“ Visitors“) and the natural and legal persons who are members of these websites and platforms (“ Members“).

Data Categories Obtained and Processed by Company

Data Category	Purpose of Processing	Legal Basis
Traffic Data	Legal Obligation	Law No. 5651 - GDPR(6)(1)(c) - KVKK(5)(2)(ç)
Identification Data (name, gender, nationality etc.)	Contractual Relationship / Legal Obligation / Necessity for legitimate interests	GDPR(6)(1)(b) - KVKK(5)(2)(c) GDPR(6)(1)(c) - KVKK(5)(2)(ç) GDPR(6)(1)(f) - KVKK(5)(2)(f)
Address Data	Contractual Relationship / Legal Obligation / Necessity for legitimate interests	GDPR(6)(1)(b) - KVKK(5)(2)(c) GDPR(6)(1)(c) - KVKK(5)(2)(ç) GDPR(6)(1)(f) - KVKK(5)(2)(f)
Communication Data (phone number, e-mail etc.)	Contractual Relationship / Legal Obligation / Necessity for legitimate interests	GDPR(6)(1)(b) - KVKK(5)(2)(c) GDPR(6)(1)(c) - KVKK(5)(2)(ç) GDPR(6)(1)(f) - KVKK(5)(2)(f)
Payment Data	Contractual Relationship / Legal Obligation / Necessity for legitimate interests	GDPR(6)(1)(b) - KVKK(5)(2)(c) GDPR(6)(1)(c) - KVKK(5)(2)(ç) GDPR(6)(1)(f) - KVKK(5)(2)(f)
Customer Preference Data	Contractual Relationship / Legal Obligation / Necessity for legitimate interests	GDPR(6)(1)(b) - KVKK(5)(2)(c) GDPR(6)(1)(c) - KVKK(5)(2)(ç) GDPR(6)(1)(f) - KVKK(5)(2)(f)
Audio Data	Necessity for legitimate interests	GDPR(6)(1)(f) - KVKK(5)(2)(f)
Data Regarding to Customer Requests	Necessity for legitimate interests	GDPR(6)(1)(f) - KVKK(5)(2)(f)
Legal Consent Data	Legal Obligation	Law No. 6698 - GDPR(6)(1)(c) - KVKK(5)(2)(ç) - GDPR (7)(1)

Visiting Leartes Studios’ Platforms“Leartes Studios” is committed to preserving the privacy of the users of their services and online platforms. When a data subject visit our web sites, our servers always temporarily save the connection data of the computer connecting to our site, a list of the web sites that you visit within or via our web sites, the date and duration of your visit, the IP address of your device, the identification data of the type of browser and operation system used as well as the web site through which you linked to our site. This type of data is necessary for conducting our activities in accordance with the laws and other applicable legislation. Additional personal information such as your name, address, telephone number or e-mail address is not collected unless you provide this data voluntarily and with your consent such as through completing an online contact form, as part of a registration, fulfilment of contract or an information request. This data is only collected and processed based on the original purpose of collection.The legal basis for the processing of the aforementioned data categories is legitimate interests Art. 6 (1) f of the General Data Protection Regulation and necessity for compliance with a legal obligation to which the controller is subject Art. 6 (1) c of the General Data Protection Regulation. Also KVKK Art. 5 (2) (f) and KVKK Art. 5 (2) (ç) establishes legal basis for processing of the aforementioned data.Performance of a contractFor contractual reasons, we also need personal data to provide our services and comply with the obligations arising from contractual agreements concluded with you. This data is used for managing customer data, ensuring operational security, conducting our activities in accordance with the laws and other applicable legislation and handling payments. This data can also be used in order to carry out information security processes and to carry out archiving activities accordingly with laws.The legal basis is necessary for the performance of a contract Art. 6 (1) (b) GDPR and Art. 5 (2) (c) of KVKK.Legal ObligationsLeartes Studios is dedicated to complying with legal obligations, including court orders, judicial orders, and administrative orders. When required by law, we process personal data to fulfill these obligations. This includes but is not limited to:

Responding to Legal Requests: When we receive a court order, judicial order, or administrative order, we process the necessary personal data as mandated by law. This may involve sharing data with law enforcement agencies, courts, or other governmental bodies.
Regulatory Compliance: We process data to comply with various regulatory requirements. This includes maintaining records, reporting to authorities, and adhering to legal standards and practices.
Legal Disputes and Investigations: In the event of legal disputes or investigations, we may process personal data as required to establish, exercise, or defend legal claims.

This data processing is grounded in the necessity to comply with legal obligations to which Leartes Studios is subject, as outlined in Art. 6 (1) c of the General Data Protection Regulation and relevant provisions of other applicable legislations.Data Processing for Security PurposesLeartes Studios also processes data to ensure the security of its services, connections, and physical premises. This encompasses:

Service Security: Monitoring and analyzing data traffic to prevent unauthorized access, cyber-attacks, and other malicious activities. This includes the use of firewalls, intrusion detection systems, and other security measures.
Connection Security: Ensuring the integrity and security of the connections made to our online platforms. This involves encrypting data transmissions and authenticating users to protect against unauthorized access.
Physical Security: Implementing measures to secure our physical premises, such as access controls, surveillance systems, and security personnel. This is to prevent unauthorized access, theft, or damage to our physical assets.

This aspect of data processing is based on legitimate interests Art. 6 (1) f of the General Data Protection Regulation and the necessity for ensuring the security of processing as per Art. 32 GDPR and corresponding provisions in other applicable legislations.Customer Satisfaction PurposesTo ensure providing high quality and secure services to our customers and members Leartes Studios processes customer preference data, audio data and data regarding to customer requests. Those data usually obtained through online channels such as; web site support page, live support service, filling out request form, sending a request to Company via e-mail. Those type of data could also be obtained when a customer sends physical document to Company or calls Leartes Studios Customer Service.The legal basis for the processing of the aforementioned data categories is legitimate interests Art. 6 (1) f of the General Data Protection Regulation and necessity for compliance with a legal obligation to which the controller is subject Art. 6 (1) c of the General Data Protection Regulation. Also KVKK Art. 5 (2) (f) and KVKK Art. 5 (2) (ç) establishes legal basis for processing of the aforementioned data.Processing for advertisement purposesYour e-mail address and communication data could be processed for marketing of other web sites and apps that belongs to Leartes Studios other than purposes listed above (eg. Service communication). Legal basis for the processing for advertisement processing is Art. 6 (1) f) GDPR and Art. 5 (2) f of KVKK. The processing of customer data for own direct marketing purposes is regarded as carried out for a legitimate interest.For other advertisements, including advertisements for third party product or services, we will process your data with your explicit consent in accordance with GDPR Art. 6 (1) (a) and KVKK Art. 5 (1). You have right to object at any time to this processing. To exercise your right, simply get in touch with us by using the contact details mentioned above under “ DATA CONTROLLER”. In case you file an objection the data will be deleted and no longer be processed for such purposes.

Usage of Personal Data and Principles

Provide services
Process and collect payments
Provide customer support and respond to and communicate with you about your requests, questions and comments
Establish and manage your account
Offer you products and services we believe may interest you
Communicate about, and administer your participation in, special events, programmers, surveys, contests, prize draws and other offers or promotions
Process claims we receive in connection with our services
Operate, evaluate and improve our business (including developing new products and services; managing our communications; determining the effectiveness of our sales, marketing and advertising; analyzing and enhancing our products, services, websites and apps; ensuring the security of our networks and information systems; performing accounting, invoicing, reconciliation and collection activities; and improving and maintaining the quality of our customer services)
Perform data analyses (including market and consumer search and analytics, trend analysis, financial analysis and anonymization of personal information)
Protect against, identify and prevent fraud and other prohibited or illegal activity, claims and other liabilities
To protect Company’s commercial reputation
To ensure ability to operate preventive or alternative dispute resolutions
Fulfil obligations as part of statutory requirements;
Fulfil our security requirements (e.g., for crime detection purposes);
Compile statistics
For the purposes of quality assurance, process optimisation and planning certainty
Conducting internal studies for the development of services
Ability to fulfill the company's audit obligations
Comply with applicable legal requirements and our policies
Establish, exercise and defend legal claims
Monitor and report compliance issues

The main principles that Leartes Studios complies with while collecting, storing and processing the personal data of the Data Subjects are listed below;

To operate Personal Data processing processes in accordance with the law, legislation and good faith
To process personal data accurately and by keeping them up-to-date when necessary
To collect, store and process data in accordance with the purpose of the services provided and only for these limited purposes
To store the personal data collected and processed for the period required by the law and the relevant legislation, and to anonymise or delete such data upon expiry of the relevant legal periods

Data RetentionYour personal data will not be kept for any longer than is necessary to fulfill the purposes that data has been collected, as specified by applicable retention policies, and/or as required by applicable legislation. Our retention policies reflect Turkish statutory obligations of Leartes Studios. Our retention policies are fully compliant with EU GDPR.The Company shall retain personal data collected from data subjects only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. Upon the expiration of the retention period or upon the data subject's request for deletion, the Company shall promptly delete or anonymize the personal data in a manner that ensures its permanent destruction and prevents any further processing.Leartes Studios stores data accordingly with laws and regulations listed here;

Law No. 6698 on the Protection of Personal Data
Turkish Code of Obligations No. 6098
Turkish Commercial Code No. 6762
Law No. 6502 on Consumer Protection
Tax Procedure Law No. 213
Information Law No. 4982
Law No. 5651
Regulation on Commercial Communication and Commercial Electronic Messages Published in the Official Gazette dated 15.07.2015 No. 29417 and the Regulation on Archive Services
GDPR

Notwithstanding the above, the Company may retain personal data to the extent necessary to comply with its legal obligations, resolve disputes, enforce its rights, or protect its legitimate interests.In the event of a data subject's request for deletion or withdrawal of consent, the Company shall make reasonable efforts to inform any third parties with whom it has shared the personal data, unless such notification is impossible or involves disproportionate effort.Personal Data are stored for the retention periods stipulated within the framework of other secondary regulations in force in accordance with these laws.

Data TransferWe may transfer the personal information we collect about you to countries other than the country in which the information originally was collected. Those countries may not have the same data protection laws as the country in which you initially provided the information.When we transfer your personal information to other countries, we will protect that information as described in this Clarification Text and in accordance with applicable law. We use contractual protections for the transfer of personal information among various jurisdictions.We may transfer your data;

To our Business Partners at home or abroad in order to carry out our archiving activities,
To our Business Partners at home or abroad, where we receive services within the scope of service performance in the processes of intermediation and marketplace activities,
To Authorized Payment Institutions and banks where we receive support for Payment Solutions,
To our Business Partners, where we receive services in the fields of customer relations and communication management,
To our Business Partners who provide services in the field of advocacy and legal consultancy in order to secure legal issues
To competent judicial bodies, if requested by courts, enforcement offices and other competent judicial bodies,
To the relevant service providers within the scope of service communication.

The transfer of personal data shall be carried out in compliance with applicable data protection laws, including the European Union General Data Protection Regulation (GDPR), Turkish Law No. 6698 (KVKK), Consumer Data Protection Act of State of Virginia (CDPA), and California Privacy Rights Act of State of California (CPRA).The Company shall take appropriate measures to ensure that any third party receiving personal data provides an adequate level of protection in accordance with the applicable data protection laws. The transfer of personal data to third parties shall be limited to the extent necessary for the purposes specified in this Clarification Text, and shall be conducted in a manner that respects the rights and freedoms of the data subjects.In the event that the Company transfers personal data to a country or organization outside the European Economic Area (EEA) or a country deemed by the European Commission to provide an adequate level of data protection, the Company shall ensure that appropriate safeguards, such as standard contractual clauses or binding corporate rules, are in place to protect the transferred personal data.Data subjects may contact the Company's Data Protection Team for further information regarding the transfer of their personal data and the safeguards implemented to protect their rights and freedoms.

Data Protection MeasuresLeartes Studios keeps administrative, technological, and physical precautions in place to protection against accidental, unlawful, or unauthorized destruction, loss, modification, access, disclosure, or use of the personal information Data Subjects provide. More detailed information could be obtained by reaching out Data Controller.

Rights of Data SubjectRegarding your personal data in accordance with the law you have the following rights;

A) Right to Know: Learning if personal data is processed
B) If your personal data has been processed, right to request information about it,
C) Right learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
Ç) Right to know the third parties to whom personal data is transferred at home or abroad
D) Right to request correction of your personal data in case of incomplete or incorrect processing,
E) Right to request the deletion or destruction of your personal data in case the reasons requiring its processing disappear,
F) Right request that the transactions made in accordance with subparagraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,
G) Right to object to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
H) Right to request compensation for the damage in case you suffer damage due to unlawful processing of personal data,
G) In addition, your Personal Data is processed in compliance with the GDPR. Therefore, you also have the right to object to the scope of data processing instead of requesting deletion.The data subject have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Art. 6 of GDPR, including profiling based on those provisions. The Company will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

You have rights and you can use these rights by applying to our company that collects, stores and processes your personal data as a data controller.If you request to restrict the processing of your Personal Data for the reasons set out in subparagraph (g) above, this personal data - except for their storage - will only be processed with the consent of the data owner or for the purposes of establishing, using and/or defending and/or protecting legal claims and/or protecting the rights or important public interests of another natural or legal person.In accordance with Law No. 6698 and in addition to your rights listed herein, the rights you have under the GDPR are as follows:

Right of access (as specified in subparagraphs a and b above)
Right to Information (as specified in subparagraphs a and b above)
Right to rectification (as specified in subparagraph d above)
Right to delete ('Right to be forgotten') (as specified in subparagraph e above)
Right to restriction of processing (as specified in subparagraph g above)
Right to data portability (as specified in subparagraph f above)
Right to object (as specified in subparagraph g above)

Rights of Data Subject (For US residents only)US resident customers also have right to Opt-Out of Sale or Sharing of Personal Information through Do Not Sell or Share My Personal Information page on the web site. This right is mirroring of right to restriction of processing and right to object as in GDPR, however, for legal compliance US resident should use this right through the link given above. Only US residents’ requests will be evaluated and accepted through that link. To make a clarification; Leartes Studios never sells any portion of personal data in any circumstance.US resident customers also have right to appeal if they are not satisfied with initial decision of the company regarding to usage of their rights.US resident customers also have right of no retaliation following opt-out or exercise of other right.

Procedure for Usage of RightsIn order to exercise your rights regarding your personal data, you must first contact the Data Controller. According to Article 14 of KVKK, it is not possible to file a direct complaint with the Personal Data Protection Board. Data Subjects can send their requests with regards to their rights stated above to: Merdivenköy Mah. Dikyol Sk. B Blok No: 2 İç Kapı No: 193 KADIKÖY/ İSTANBUL in writingWith a secure electronic signature or mobile signature and/or by using your registered e-mail address to privacy@leartesstudios.comYour application shall consists of;

For citizens of the Republic of Turkey, your identity number, if you are a foreigner, your passport number or your identity number,
Your location or workplace address
If any, your e-mail address, phone and fax number
It is mandatory to have your request subject, and if any, information and documents related to the subject must also be added to the application.

Your application may be finalized within 30 (thirty) days and (i) it can be either accepted and or (ii) it may be rejected by explaining the justification. If your request is accepted, Company will provide detailed information regarding to process.If the requests you have directed to the Company are rejected by the Company, or if you are not satisfied with the answer given by the Company or your requests are not answered, you can file a complaint with the Personal Data Protection Board within 30 days from the date the answer is notified to you. If no response is given, you can file complaint to Personal Data Protection Board within 30 days from the end of the 30-day period that is aforementioned in the previous paragraph.

Non-DiscriminationIf you exercise any of the aforementioned privacy rights or any other rights granted to you by the KVKK, GDPR or CPRA Leartes Studios may not treat you differently including but not limited to;

Denying your access to goods or services
Charging different rates or prices for products or services,
Delivering lower standard service
Implying that you will be charged a different price or rate for services, or that the services will be of a lower quality

Updates To Our Clarification TextThis Clarification Text may be updated periodically and without prior notice to you to reflect changes in our personal data and privacy practices. We will post a prominent notice on our websites to notify you of any significant changes to our Clarification Text and indicate at the top of the notice when it was most recently updated.