Information Notice

As OME Teknoloji Yazılım Sanayi ve Ticaret A.Ş. ("yeschef"), the confidentiality and security of your personal data are among our priorities. This Information Notice has been prepared in order to fulfil our disclosure obligation arising from Article 10 of the KVKK, and to inform you about the Personal Data processed, the purposes of processing, the legal grounds, the parties to whom it is transferred, the method of collection, and your rights.

Article 1 - Data Controller and Two Distinct Roles

1.1 With respect to the data of the restaurant user/authorized representative: yeschef is the Data Controller with respect to the Personal Data belonging to the authorized representative and the Authorized Users of the restaurant business that registers on the Platform. 1.2 With respect to End Customer data: With respect to the Personal Data belonging to the restaurant's End Customers (the consumers placing orders) that is contained in orders arriving through the Integrated Platforms, yeschef is the Data Processor acting in accordance with the restaurant's instructions and on its behalf. The Data Controller of such data is the relevant restaurant. This Information Notice principally concerns the data that yeschef processes in its capacity as Data Controller. The principles relating to the processing of End Customer data in the capacity of Data Processor are explained in Article 8.

Article 2 - Personal Data Processed

A) Restaurant representative / Authorized User data (yeschef in its capacity as Data Controller): • Identity: first name, last name; • Contact: e-mail address, telephone number, business contact information; • Business/Customer Transaction: business title, subscription and invoicing information, records of requests and complaints, support correspondence; • Transaction Security: IP address, session and log records, password (stored securely), cookie information; • Integration: API authorization and access information provided in order to connect to the Integrated Platforms. B) End Customer data (yeschef in its capacity as Data Processor, on behalf of the restaurant): • The name, delivery address, telephone number and order details contained in the order content - processed on behalf of the restaurant solely for the purpose of being displayed in the panel and transmitted to the restaurant.

Article 3 - Purposes of Processing the Personal Data

Your restaurant representative/user data is processed for the following purposes: • Establishment and performance of the contract and the provision of the Service (aggregating orders in a single panel, menu management, opening/closing products); • Carrying out membership, subscription and invoicing processes; • Managing request, complaint and support processes, and communication activities; • Carrying out information security, operational security and logging processes; • Developing and improving the Service; • Conducting activities in compliance with legislation, following up legal affairs and providing information to authorized authorities; • Where your explicit consent exists, informing you about developments and opportunities and sending commercial electronic messages.

Article 4 - Legal Grounds for Processing the Personal Data

4.1 Establishment/performance of the contract (KVKK Art. 5/2-c): Establishment of the membership and subscription contract, provision of the Service, invoicing and support processes. 4.2 Legal obligation (KVKK Art. 5/2-ç): Fulfilment of obligations arising from the relevant legislation, provision of information to authorized authorities. 4.3 Legitimate interest (KVKK Art. 5/2-f): Ensuring information and operational security, developing and improving the Service. 4.4 Establishment, exercise or protection of a right (KVKK Art. 5/2-e): Conduct of legal and litigation affairs. 4.5 Explicit consent (KVKK Art. 5/1): Marketing and sending commercial electronic messages, and, where necessary, transfer of Personal Data abroad.

Article 5 - Transfer of the Personal Data

5.1 Your Personal Data may be transferred to the following parties, in accordance with the "need to know" and "need to use" principles, with the necessary technical and administrative measures taken, and limited to the purposes stated above: • Our business partners and service providers that provide hosting (cloud/server) infrastructure, software and information technology services; • Payment service providers, banks and our financial advisors for subscription and payment/collection processes; • E-invoice/e-archive and private integrator business partners for invoicing; • The Integrated Platforms, to the extent of technical necessity, for the purpose of enabling the order flow; • Lawyers, auditors, consultants, and authorized public institutions and organizations, courts and enforcement offices, within the scope of legal obligations. 5.2 Transfer abroad: The hosting infrastructure of our service providers may be located domestically and/or abroad. Where a transfer of Personal Data abroad is involved, the transfer is carried out in accordance with the conditions set out in Article 9 of the KVKK (the existence of your explicit consent or the provision of the other appropriate safeguards prescribed in the Law).

Article 6 - Method of Collecting the Personal Data

6.1 Your Personal Data is collected in electronic form and through automated/partially automated means, by way of the forms completed during registration to and use of the Platform, the use of the Platform, the API connection/access established with the Integrated Platforms, cookies, and the support and communication channels.

Article 7 - Retention Period of the Personal Data

7.1 Your Personal Data is retained for the period required by the purpose of processing and for the minimum retention periods prescribed in the relevant legislation. Upon expiry of such periods, your data is deleted, destroyed or anonymized.

Article 8 - End Customer Data: Data Processor Role

8.1 yeschef processes the Personal Data belonging to the restaurant's End Customers that flows to the Platform through the Integrated Platforms solely in accordance with the restaurant's instructions, for the purpose of providing the Service (displaying orders in the panel and transmitting them to the restaurant). yeschef does not use, sell, or transfer such data to third parties for its own purposes. 8.2 With respect to the said End Customer data, the Data Controller is the restaurant. The restaurant acknowledges that the KVKK disclosure obligation towards its own End Customers, together with the obligation to obtain explicit consent where necessary, belongs to it. 8.3 yeschef takes appropriate technical and administrative security measures for this data that it processes in its capacity as Data Processor.

Article 9 - Your Rights as a Data Subject

Pursuant to Article 11 of the KVKK, by applying to the Data Controller you have the following rights: • To learn whether your Personal Data is being processed and, if so, to request information relating thereto; • To learn the purpose of processing and whether it is used in accordance with its purpose; • To know the third parties to whom it is transferred domestically or abroad; • To request that it be corrected if it has been processed incompletely or incorrectly; • To request that it be deleted or destroyed within the framework of the conditions prescribed in the KVKK; • To request that the correction, deletion and destruction operations be notified to the third parties to whom it has been transferred; • To object to a result that arises to your detriment as a result of analysis exclusively through automated systems; • To request the redress of the damage in the event that you suffer damage due to unlawful processing.

Article 10 - Application Method

10.1 You may submit your requests concerning your rights, together with information verifying your identity, to destek@useyeschef.com from your e-mail address registered in our system, or with a secure electronic signature or mobile signature. 10.2 We kindly request that you write "KVKK Data Subject Request" in the subject line of your application. Your request will be concluded free of charge within 30 (thirty) days at the latest, depending on its nature. However, where the transaction additionally requires a cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

Article 11 - About the Information Notice

11.1 yeschef reserves the right to update this Information Notice within the framework of any changes that may be made in the applicable legislation. The current text is published on the Platform.

Contact and Data Controller Details

Title: OME TEKNOLOJİ YAZILIM SANAYİ VE TİCARET A.Ş. MERSİS No: 0642110103700001 Tax Office: Beyoğlu Website: https://useyeschef.com E-mail: destek@useyeschef.com