Employee and Intern Candidate Clarification Text

KİĞILI GİYİM TİCARET A.Ş. (KİĞILI RETAIL TRADE INC.)

APPLICANT / INTERN APPLICANT

EXPLANATION TEXT

Update Date: September 2025

Dear Employee and Intern Applicant;

We would like to inform you that we show utmost sensitivity in processing your personal data that you have shared with us through your job application to our Company, in accordance with the Law on Protection of Personal Data No. 6698 and all relevant legislation, to ensure the lawful processing of your data and the full security of your processed data. For this reason, we would like to inform you about our Company's corporate identity, the purposes for which your personal data is processed, to whom and for what purposes your processed personal data may be transferred, the method and legal reason for collecting your personal data, and your rights under Article 11 of the Law.

A) Identity of the Data Controller and its Representative, if any

Company Title: Kiğılı Giyim Ticaret Anonim Şirketi

Company Headquarters: Aeropark Yenişehir Mah. Osmanlı Blv. No: 11/B 34912, Kurtköy, Pendik/İstanbul

Tax Identification Number: 5620035661

B) Purposes of Personal Data Processing

Your personal data included in the job application forms and resumes (CVs) you have submitted to us for the purpose of evaluating your job application to our Company, through:

are processed for the purposes of evaluating your suitability for the position you applied for, conducting candidate and intern selection processes, evaluating your suitability for the applied position, evaluating your resume for other vacant positions if your application is unsuccessful and you provide explicit consent, preparing your employment contract and personnel file if your application is successful, ensuring information processing security, notifying you about the status of your job application process, conducting physical and online interviews, and preparing your employment contract if the interviews are successful.

C) To Whom and for What Purpose Personal Data May Be Transferred

Your personal data processed by us for the purpose of evaluating your job applications to our Company for employment in our stores under the brands "Kiğılı" and "Abdullah Kiğılı", at our Company headquarters, or in our headquarters-affiliated units and warehouses, will only be transferred to authorized institutions and organizations upon their request within the scope of a judicial or administrative prosecution or investigation, and for intern applicants, to the relevant educational institution for intern commencement notification, and to our consulting law firm for the completion of legal procedures if your employment contract is terminated. Apart from this, personal data of our employee candidates is not transferred to any third party or institution.

We kindly inform you that if your resumes are sent to our Company via foreign database-based applications and/or applications with headquarters abroad, or via our Microsoft-based e-mail addresses, the said data is transferred abroad by these Companies as "data processors".

Ç) Method and Legal Reason for Collecting Personal Data

The personal data we collect through the CVs you provide includes: the phone number and/or email address of the person or persons you introduce as a reference, your name, surname, phone number, company/title information; your email address, and if you choose to disclose it at this stage, your gender, age (your full date of birth if you choose to disclose it), your marital status if you wish to disclose it for the purpose of arranging suitable positions and working hours, whether you have a driving license if the position you applied for requires it, your educational status and history, and your professional experience. Your personal data within the information in your CV is processed based on the following legal grounds:

  • Expressly stipulated in laws.

  • It is necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract.

  • It is mandatory for the data controller to fulfill its legal obligation.

  • It has been made public by the data subject themselves.

  • Data processing is mandatory for the establishment, exercise or protection of a right.

  • Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

D) Rights Enlisted in Article 11 of Law No. 6698 on the Protection of Personal Data

Pursuant to Article 11 of the KVKK, the data subject has the right to:

  • Learn whether personal data is processed,

  • Request information if personal data has been processed,

  • Learn the purpose of personal data processing and whether it is used in accordance with its purpose,

  • Know the third parties to whom personal data is transferred domestically or abroad,

  • Request correction of personal data if it is incomplete or incorrectly processed,

  • Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,

  • Request notification of the operations carried out regarding the correction, deletion or destruction of personal data to third parties to whom personal data has been transferred,

  • Object to the emergence of a result against the person themselves by analyzing the processed data exclusively through automated systems,

  • Request compensation for damages in case of suffering damage due to unlawful processing of personal data.

    They can exercise their rights.

    Requests regarding the use of these rights;

  • If you wish, you can submit your applications and requests regarding your personal data via the Data Subject Application Form;

  • By sending it with a wet signature and a copy of your ID to Aeropark, Yenişehir Mahallesi, Osmanlı Bulvarı No:11, B Blok, 34912 Pendik/İstanbul,

  • By applying in person with a valid identity document to Kiğılı Giyim Ticaret Anonim Şirketi at Aeropark, Yenişehir Mahallesi, Osmanlı Bulvarı No:11, B Blok, 34912 Pendik/İstanbul,

  • By sending an e-mail to kvkk@kigili.com.tr after signing with a mobile signature or a secure electronic signature,

  • By sending an e-mail to the registered electronic mail (KEP) address 0562003566100015@hs02.kep.tr using a registered electronic mail (KEP) address, secure electronic signature, or mobile signature,

    By sending an e-mail to kvkk@kigili.com.tr via your e-mail address registered in the system of Kiğılı Giyim Ticaret Anonim Şirketi.

According to the Communiqué on the Procedures and Principles for Applications to the Data Controller, the data subject's application must include the name, surname, signature if the application is written, Turkish ID number (passport number if the applicant is a foreign national), domicile or business address for notifications, e-mail address for notifications if available, phone number, fax number, and information regarding the subject of the request.

The data subject must clearly and understandably state the subject requested in the application for exercising the rights mentioned above and including explanations regarding the right they wish to exercise. Information and documents related to the application must be attached to the application.

While the subject of the request must be related to the applicant personally, if acting on behalf of another person, the applicant must be specifically authorized in this regard and this authorization must be documented (power of attorney). In addition, the application must contain identity and address information, and identity verification documents must be attached to the application.

Requests made by unauthorized third parties on behalf of another will not be considered.

Your requests regarding your personal data rights will be evaluated and answered within 30 days at the latest from the date they reach us. In case your application is evaluated negatively, the justified reasons for rejection will be communicated to you by e-mail or post to the address you provided in the application, primarily, and if possible, through the same method by which the request was made.