KVKK Information Notice

Your personal data is collected when:

• When you visit our website (www.blesyum.com),
• When you use our customer portal (accounts.blesyum.com),
• When you fill out contact forms, free analysis requests, meeting requests, or other forms,
• When you communicate via email, phone, or in person,
• When you sign a service agreement,
• When you apply for a business partnership,
• When you subscribe to a newsletter or commercial electronic communications,
• Through cookies and automated tracking technologies

both automated and non-automated means, whether verbally, in writing, or electronically.

Legal Grounds: KVKK Art. 5/2 (a) Explicit provision in laws, (c) Conclusion or performance of a contract, (ç) Legal obligation, (f) Legitimate interest; and, where necessary, your explicit consent under KVKK Art. 5/1.

Identification Information

Data Types: First name, last name, title, company name · Purpose of Processing: Contract execution, billing, customer management

Contact Information

Data Types: Email, phone number, address · Purpose of Processing: Communication, service provision, information sharing

Customer Transaction Information

Data Types: Project details, orders, payments, invoices · Purpose of Processing: Service fulfillment, accounting, project management

Digital Trace Data

Data Types: IP address, browser, device, location · Purpose of Processing: Security, analytics, service improvement

Marketing Data

Data Types: Cookie ID, consent record, campaign parameters · Purpose of Processing: Only if you have given consent: campaign measurement and marketing communications

Content Data (Subscription)

Data Types: Subscriber’s current, billing, inventory, customer, and document records entered into the dashboard · Purpose of Processing: Provision of the service — with respect to this data, the subscriber is the data controller, and Blesyum is the data processor

Legal Records

Data Types: Consent records, applications · Purpose of Processing: Legal obligations, evidence

• Provision of Subscription Services (ERP, CRM, E-Commerce, B2B, Call Center, Email, Consulting, Advertising Management, and Web modules);
• Execution of Project Services (custom software development, mobile applications, integration, data migration);
• Opening accounts, managing users and permissions, and carrying out setup and data migration processes;
• Carrying out integration, artificial intelligence integration, and bot development tasks;
• Responding to support requests and providing maintenance/support packages;
• Project tracking and payment management via the customer portal (accounts.blesyum.com);
• Handling contract processes, preparing proposals, and invoicing;
• Marketing communications, campaign measurement, and conversion tracking, subject to your consent;
• Ensuring website security and preventing fraud;
• Fulfilling legal obligations;
• Statistical analysis and reporting;
• Sending commercial electronic communications (with your consent).

5.1. Domestic Transfer

Your personal data may be transferred to our business partners, suppliers, service providers, and authorized public institutions and organizations within the scope of legal obligations, the performance of a contract, and legitimate interests.

5.2. Cross-Border Transfer

To provide the service, your personal data may be transferred to the following recipient groups:

• Hosting and Infrastructure: Providers from whom we obtain server, database, backup, domain name, DNS, and

content delivery (CDN) services;

• Payment Provider: Card payments are processed via the iyzico Ödeme Hizmetleri A.Ş. infrastructure;

card information does not reach Blesyum and is not stored by Blesyum;

• E-Invoice / E-Ledger Integrator: An authorized private integrator for

submitting financial documents to the Turkish Revenue Administration (GİB);

• Email and Notification Delivery: Delivery providers used to

transmit system emails and notifications;

• Artificial Intelligence Providers: Only when you use artificial intelligence features

and only to the extent required for that specific process; providers do not use the data for model training;

• Analytics and Advertising Platforms: Only if you have given consent to the relevant

cookie category and the relevant tool has been enabled by us;

• Legal Authorities: Courts, prosecutors’ offices, and regulatory agencies (when

legally required).

Transfers to analytics and advertising platforms occur only if you have consented to the relevant cookie category and the relevant tool has been enabled by us; you may withdraw your consent at any time via the cookie preference panel.

These transfers are carried out in accordance with the provisions of Article 9 of the Personal Data Protection Law (KVKK), based on your explicit consent or within the framework of adequate safeguards.

• Contract and customer data: Contract term + 10 years;
• Invoice and financial data: 10 years (Tax Procedure Law);
• Cookie data: Session-based or up to 2 years;
• Commercial electronic communication consents: Until consent is withdrawn + 3 years;
• Cookie consent logs: 3 years;
• KVKK applications: 10 years;
• Web server logs: 2 years.

Pursuant to Article 11 of the KVKK, you have the following rights:

1. To learn whether your personal data has been processed;
2. If your personal data has been processed, to request information regarding such processing;
3. To learn the purpose of the processing of your personal data and whether it is being used in accordance with that purpose;
4. To know the third parties to whom your personal data has been transferred, whether within or outside the country;
5. To request the correction of your personal data if it has been processed incompletely or incorrectly;
6. To request the erasure or destruction of your personal data under Article 7 of the KVKK;
7. To request that third parties to whom your data has been transferred be notified of any corrections, deletions, or destruction;
8. To object to any adverse decision made solely through the automated analysis of your processed data;
9. To request compensation for any damages you may have suffered due to the unlawful processing of your personal data.

To exercise your rights, you may submit a request using one of the following methods, along with documents verifying your identity:

• Email: kvkk@blesyum.com (with the subject line “KVKK Information Request”)
• Mail: Orta Mah. Alparslan Sok. No: 8, 34880 Kartal/Istanbul (return receipt requested)
• Notary: Through a notary public to our company

Your request will be processed free of charge as soon as possible and no later than 30 (thirty) days, depending on the nature of the request. If the process incurs additional costs, the fee specified in the KVKK tariff will apply.

Your request must include your first and last name, your Turkish ID number, the date of the request, the subject of your request, and any relevant explanations regarding the request. You must submit your request on your own behalf; a special power of attorney is required for requests submitted on behalf of third parties.

If your request is rejected, if the response is deemed insufficient, or if no response is provided within the prescribed timeframe, you may file a complaint with the Personal Data Protection Board within 30 days of receiving the response and, in any case, within 60 days of the date of your request.