Privacy Notice on Protection of Personal Data

I. IDENTITY OF THE DATA CONTROLLER:

MYTH Yapay Zekâ ve Tekstil Anonim Şirketi (the “Company”) will act as a data controller under the Turkish Personal Data Protection Law, UK Data Protection Act 2018 and General Data Protection Regulation (the “Law”). We value the protection of your personal data. In that respect, this Privacy Notice on Protection of Personal Data (the “Privacy Notice”) is presented to our customers and third persons who use our website and/or mobile application under the Law and Communiqué on Rules and Principles for Fulfilment of the Obligation to Inform (the “Communiqué”).

The Company will adopt necessary safety measures in line with the law to prevent unlawful use and ensure the safekeeping of your personal data while processing your personal data.

II. METHOD FOR COLLECTION OF YOUR PERSONAL DATA:

Your personal data will be collected in writing or electronically using our website and cookies.

The Company will use cookies for offering services and customizing content according to personal needs and interests. For detailed information about the cookies, please review our Cookie Policy.

III. PERSONAL DATA CATEGORIES:

Identification Data: Name, surname

Communication Data: Telephone number, e-mail

Marketing Data: Cookie sessions, processes previously conducted by users, targeting, records of habits and likes

Legal Action Data: consent for commercial electronic messages, the consent provided under the PDPL privacy notice

Transaction Security Data: IP Address, password details, traffic data, website visit information

IV. PERSONAL DATA PROCESSING OBJECTIVES AND LEGAL GROUNDS:

The reasons and legal grounds for processing your personal are explained below:

A. ONLINE VISITOR DATA:

Personal Data Processing Objectives:

1. Performing market analysis, targeting, and analysis activities to undertake customized advertisement, marketing, and promotion activities for potential purchasers of our products or services

Personal Data to be Processed: Identification, Communication, Marketing Data, Transaction Security Data

Legal Grounds: Explicit consent

2. Considering requests, suggestions, and complaints

Personal Data to be Processed: Identification, Communication, Marketing Data, Legal Action, Transaction Security Data

Legal Grounds: i) Mandatory for the fulfillment of legal obligations of the data controller, ii) Mandatory for creation, use, or protection of any right, and iii) Mandatory for legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not impaired

3. Promoting information and process security during the use of our services

Personal Data to be Processed: Identification, Communication, Legal Action, Transaction Security Data

Legal Grounds: i) Explicit requirement in the law, ii) Mandatory for the fulfillment of legal obligations of the data controller, iii) Mandatory for creation, use, or protection of any right, and iv) Mandatory for legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not impaired

4. Performance and supervision of our business operations

Personal Data to be Processed: Identification, Communication, Legal Action, Transaction Security Data, Marketing Data

Legal Grounds: i) Mandatory for the fulfillment of legal obligations of the data controller, ii) Mandatory for creation, use, or protection of any right, and iii) Mandatory for legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not impaired

5. Fulfilment of our legal obligations and use of our rights arising from the applicable laws

Personal Data to be Processed: Identification, Communication, Legal Action, Transaction Security Data, Marketing Data

Legal Grounds: i) Explicit requirement in the law, ii) Requirement to process the personal data of the parties to a contract provided that any such processing shall be directly related to the execution or performance of the contract, iii) Mandatory for the fulfillment of legal obligations of the data controller, iv) Mandatory for creation, use or protection of any right, and v) Mandatory for legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not impaired

V. TRANSFER OF YOUR PERSONAL DATA AND REASONS FOR TRANSFER

Your personal data may be transferred to domestic and overseas recipients below in line with the Law to realize the following objectives:

- Shareholders, employees, and business partners of the Company to evaluate job applications

- Business partners for offering the services related to the website,

- Contracted business partners for sending commercial electronic messages and undertaking advertisement, campaign, and promotion activities based on the consent of the users

- Several domestic and overseas agencies, advertising companies, market research firms, and survey companies under the marketing activities to be conducted for improving customer experience and ensuring customer satisfaction

- Service providers for the performance of statistical and technical services

- Service providers for user relations management as well as the performance of requisition and complaint processes

- Shareholders and affiliates of the Company to conduct the corporate management functions and perform statistical studies and reporting processes

- Domestic and overseas program partners and social networking sites with whom we collaborate for our activities and business development processes

- Domestic and overseas business partners providing cloud services for personal data

- Domestic and overseas service providers that are engaged in technological infrastructure, server, e-mail, and cookie services for the website

- Audit companies, legal counsels, and competent authorities and institutions for the fulfillment of our legal obligations

VI. DATA SUBJECT RIGHTS

You may contact us by e-mail at info@myth-ai.com at any time for all kinds of questions and opinions about your personal data as well as your requests under article 11 of the PDPL governing the “rights of data subjects”.

Upon receiving a request from you, the Company will conclude your request free of charge in 30 (thirty) days at the latest. Still, if any cost is incurred about the request, the Company may, at its option, request you to pay the fee provided in the tariff which will be determined by the Personal Data Protection Board.

On 25 May 2018, GDPR came into force and replaced the “95/46/EC Directive on Data Protection” of 24 October 1995. GDPR lays out specific requirements for businesses and organizations that are established in Europe; who serve users in Europe or European citizens. The Company as a data controller gives importance to the personal data protection of the Users and its own employees is handled in accordance with GDPR. The GDPR embodies the well-recognized privacy principles of transparency, fairness, and accountability. The GDPR requires that data controllers only use data processors that process personal data on the data controller’s behalf and provide adequate guarantees to meet specific requirements of the GDPR.

International Data Transfer Under GDPR: The Company has designed its privacy and security programs to ensure an appropriate level of data protection and has outlined the supplemental measures and safeguards for transfers of personal data outside of the European Union and European Economic Area. The GDPR provides for several mechanisms to facilitate transfers of personal data outside of the European Union and European Economic Area. These mechanisms are aimed at confirming an adequate level of protection or ensuring the implementation of appropriate safeguards when personal data is transferred to a third country. Where personal data will be transferred outside of the EU to third countries not covered by adequacy decisions, we commit under our data processing agreements to maintain a mechanism that will facilitate these transfers as required by the GDPR.

User Rights: The rights of the Users’ are the right to be informed, right of access, right to rectification, right to erasure/to be forgotten, right to restrict processing, right to data portability, right to object and rights in relation to automated decision making and profiling.

Right to Erasure' (aka Right to be Forgotten): The User has the right to erasure their personal data without undue delay and The Company shall have the obligation to erase personal data without undue delay. If The Company receives a complete erasure request from the User, The Company shall delete the relevant User data from all of its databases within a maximum period of 30 days.

For more information about GDPR and UK Data Protection Act, please visit https://ec.europa.eu/info/law/law-topic/data-protection_en & https://www.gov.uk/data-protection

VII. VARIATIONS TO THE PRIVACY NOTICE ON THE PROTECTION OF PERSONAL DATA:

The Company may, at its option, update this Privacy Notice at any time. Any such variation to be made by the Company will become effective immediately upon publication of the Privacy Notice on info@myth-ai.com.