KVKK Disclosure Notice (Personal Data Protection Disclosure)

1. Identity of the Data Controller

This Disclosure Notice has been prepared by Fil Ofis Mobilyaları Ticaret Limited Şirketi ("Company", "we"), acting as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK" or "Law") and the Communiqué on the Principles and Procedures to be Followed in Fulfilling the Disclosure Obligation, in order to inform data subjects about the personal data processed through the website at https://filofis.com/ ("Site").

The identity and contact information of the data controller under the Law are as follows:

• Trade Name: Fil Ofis Mobilyaları Ticaret Limited Şirketi
• Address: Tatlısu Mah. Arif Ay Sk. No: 9-13BA Ümraniye/İstanbul
• Tax Office / Tax No: Alemdağ Tax Office — 3871423795
• Phone: +90 (216) 420 40 30
• E-mail: [email protected]
• Website: https://filofis.com/

2. Scope and Definitions

The Site is a CATALOGUE and QUOTATION platform in the field of office furniture. NO ONLINE SALE OR PAYMENT is processed through the Site; no credit card, debit card, or similar payment information is requested or collected. Products are offered through the "Request a Quote" / WhatsApp flow by which data subjects contact us directly. Accordingly, this notice does not contain provisions relating to distance sales, right of withdrawal, returns, or payment processes.

The principal definitions used in this notice are as follows:

• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing of Personal Data: Any operation performed on personal data such as collection, recording, storage, preservation, alteration, disclosure, transfer, classification, or prevention of use, whether by wholly or partially automated means or by non-automated means provided that they form part of a data filing system.
• Data Subject: The natural person whose personal data is processed (Site visitor, quote requestor, corporate representative, business partner/affiliate, etc.).
• Data Controller: Fil Ofis Mobilyaları Ticaret Limited Şirketi, who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system.
• Data Processor: A natural or legal person who processes personal data on behalf of the data controller by virtue of the authority granted by the data controller.
• Explicit Consent: Freely given, specific, and informed consent.

3. Personal Data Processed, Methods of Collection, and Legal Bases

Our Company processes the following categories of personal data through the Site and its communication channels. Pursuant to Article 10 of the KVKK, the METHOD OF COLLECTION and the LEGAL BASIS relied upon are indicated for each data category. Data are obtained either directly from you (by non-automated means) through web forms, phone, WhatsApp, and e-mail, or automatically during your use of the Site through tools such as cookies, tags (pixels), and server logs.

• Quote Form (First-last name, phone, e-mail, company [optional], subject, message content): Collected directly from you (non-automated) via a web form; based on the legal basis of being directly related to the establishment or performance of a contract relating to the conduct of the quotation process (KVKK Art. 5/2-c).
• Corporate Quote (Brief) Form (Company name, authorised person's first-last name, title/role, e-mail, phone, needs/project details): Collected directly from you (non-automated) via a web form; based on the legal basis of establishment or performance of a contract (KVKK Art. 5/2-c).
• Business Partner (Real Estate / Marketing Affiliate) Panel (First name, e-mail, account password [not stored in plain text; stored as an irreversible hash using a strong, salted one-way hashing algorithm], commission/sales records): Collected directly from you (non-automated) via the panel; based on the legal bases of establishment or performance of a contract (KVKK Art. 5/2-c) and compliance with a legal obligation (KVKK Art. 5/2-ç).
• Automatically Collected Data (IP address, browser and device information, session data, server log records): Collected automatically during your use of the Site (server logs, mandatory cookies); based on the legal bases of the legitimate interests of the data controller (KVKK Art. 5/2-f) and compliance with a legal obligation (KVKK Art. 5/2-ç).
• Analytics and Marketing Data (cookie/device data obtained via analytics/advertising cookies and tags): Collected automatically during your use of the Site, only where your consent is present; based on the legal basis of explicit consent (KVKK Art. 5/1).
• Communication Channels (Identity and contact information and message contents transmitted via phone, WhatsApp, and e-mail): Collected directly from you (non-automated); based on the legal basis of establishment or performance of a contract (KVKK Art. 5/2-c) or the legitimate interests of the data controller (KVKK Art. 5/2-f), depending on the nature of your request.
• Google Reviews (publicly published review text, rating, and abbreviated first-last name): Reviews you have publicly published about our business on our Google Business Profile may be featured on our website with the source indicated and your first-last name abbreviated; you may request their removal at any time. Based on the legal basis that the data has been made public by the data subject (KVKK Art. 5/2-d).

4. Purposes of Processing Personal Data

Your personal data specified above are processed for the following purposes:

• Conducting the office furniture catalogue and quotation process, evaluating your requests, and preparing quotations,
• Receiving and responding to your requests, questions, suggestions, and complaints; maintaining communication with you,
• Creating and managing business partner (affiliate) panel accounts, and calculating and tracking commission/sales records,
• Ensuring the security of the Site, systems, and data; preventing fraud, misuse, and spam activities,
• Fulfilling legal obligations arising from applicable legislation and meeting the requests of authorised public authorities and institutions,
• Where your explicit consent is present: analysing website traffic (analytics), conducting, measuring and managing advertising and marketing activities.

5. Legal Bases of Processing (KVKK Art. 5)

Your personal data are processed on the basis of the legal grounds set out in Article 5 of the KVKK. The mapping of each processing purpose to its corresponding legal basis is shown in the table below. Where processing relies on more than one legal basis, the PRIMARY (principal) legal basis is listed first.

6. Transfer of Personal Data (Data Processors and Domestic Recipients)

Your personal data may be transferred to the following recipient groups, limited to the purposes stated in this notice and in accordance with the conditions set out in Articles 8 and 9 of the KVKK. Our Company enters into agreements containing confidentiality and data security obligations with suppliers acting as data processors on its behalf.

• E-mail delivery service provider (Resend): For the delivery of form and notification e-mails,
• Hosting and infrastructure provider: For the technical hosting and serving of the Site and data,
• Only where your explicit consent is present: Google (Analytics 4, Google Ads, AdSense — via Google Consent Mode v2), Meta Platforms (Facebook/Instagram Pixel and server-side Conversions API) and TikTok (Pixel) — for analytics, advertising, and measurement purposes,
• The partner (affiliate) whose code is used: When you enter a valid partner code in a quote form (quote basket or corporate quote form), ONLY the masked form of your full name (first letter of each word visible, the rest hidden) and the list of quoted products/categories are shown to the owner of that code in their partner panel, for the purpose of tracking the commission and partnership relationship (legitimate interest under KVKK Art. 5/2(f)). Your phone number, e-mail address, company name, message and location details are NEVER shown to the partner,
• Authorised public institutions and bodies and judicial/administrative authorities: Only where required by a legal obligation arising from applicable legislation.

7. Cross-Border Transfer of Personal Data (KVKK Art. 9)

As some of the service providers mentioned above (such as Resend, Google, Meta, and TikTok) are established abroad, your personal data may be transferred abroad in the course of using these services. Cross-border transfers are carried out in accordance with the tiered structure provided for in Article 9 of the KVKK as amended by Law No. 7499.

Accordingly, transfers are based on the following principles in order: 1) first, where a decision of adequacy issued by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) exists in respect of the country, sector, or international organisation to which the transfer is to be made; 2) if no adequacy decision exists, where appropriate safeguards (such as standard contractual clauses or binding corporate rules) are provided by the parties; 3) if neither of these is available, where the exceptional/incidental conditions enumerated in Article 9 of the Law are present.

Cross-border transfers for analytics and marketing purposes that are subject to explicit consent are only carried out where your explicit consent has been obtained and the above conditions for cross-border transfer are satisfied. You may withdraw your explicit consent at any time.

8. Cookies and Explicit Consent Management

The Site uses a KVKK-compliant cookie consent banner and Google Consent Mode v2 infrastructure. MANDATORY cookies that are technically necessary for the Site to function are not subject to explicit consent and no consent is sought for them.

In contrast, ANALYTICAL and MARKETING cookies do not operate without your explicit consent, and no data is collected for these purposes without it. You may manage your cookie preferences via the banner and may withdraw your explicit consent (within the scope of KVKK Art. 5/1) at any time.

For detailed information on cookie categories and their purposes, please refer to the Cookie Policy published at https://filofis.com/.

9. Retention Period of Personal Data

Your personal data are retained for the period required by the purpose for which they are processed, the periods prescribed by applicable legislation, and for as long as there is a legitimate legal basis for their retention.

Upon expiry of the retention period or where the purpose of processing ceases to exist, your personal data are erased, destroyed, or anonymised within the framework of our Company's retention and disposal policy.

10. Measures Regarding Data Security

Our Company takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of and unlawful access to the personal data it processes, and to ensure the preservation of such data.

In this context, access authorisation, server-side bot/spam protection (honeypot, rate limiting, and invisible proof-of-work verification), server and network security measures, and data minimisation principles are applied. Business partner (affiliate) panel passwords are never stored in plain text; they are stored as irreversible hashes using a strong, salted one-way hashing algorithm.

11. Rights of the Data Subject (KVKK Art. 11)

Pursuant to Article 11 of the KVKK, you have the following rights with respect to our Company as data controller:

• To learn whether your personal data are being processed,
• To request information if your personal data have been processed,
• To learn the purpose of processing your personal data and whether they are used in accordance with that purpose,
• To know the third parties to whom your personal data have been transferred, whether domestically or abroad,
• To request the rectification of your personal data if they are incomplete or inaccurate,
• To request the erasure or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK,
• To request that the rectification and erasure/destruction operations be notified to the third parties to whom your personal data have been transferred,
• To object to the emergence of a result against you by means of exclusively automated analysis of your processed data,
• To claim compensation for damages in the event that you suffer loss due to the unlawful processing of your personal data.

12. Exercise of Rights and Application Procedure

You may submit your requests regarding the rights listed above to our Company through the following methods, in accordance with the Communiqué on the Principles and Procedures for Application to the Data Controller published in the Official Gazette dated 10.03.2018 and numbered 30356:

• By submitting a wet-signed written petition in person or by post to Tatlısu Mah. Arif Ay Sk. No: 9-13BA Ümraniye/İstanbul,
• By using a registered electronic mail (KEP) address, a secure electronic signature, or a mobile signature,
• By sending an e-mail to [email protected] from the e-mail address you previously notified to our Company and which is registered in our system.

Your application must include: your first and last name and, if the application is in writing, your signature; your Turkish ID number (or passport/nationality information for foreign nationals); your residential or workplace address for notification purposes; your e-mail address and phone and fax number for notification, if any; and the subject of your request.

Your request will be concluded free of charge within the shortest possible time and in any case within thirty (30) days, depending on its nature. However, if the processing requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

If your application is rejected, the response is found to be insufficient, or no response is provided within the prescribed period, you have the right to lodge a complaint with the Personal Data Protection Board within thirty (30) days from the date on which you learn of the response and, in any case, within sixty (60) days from the date of your application.

13. Disclosure Obligation and Explicit Consent

This Disclosure Notice constitutes the fulfilment of the disclosure obligation required under Article 10 of the KVKK in all cases, regardless of whether your personal data are processed on the basis of explicit consent or other processing conditions provided for in the Law.

For processing operations that require explicit consent, your declaration of explicit consent is obtained separately from this Disclosure Notice; disclosure is not a prerequisite for explicit consent. You have the right to withdraw your consent for processing operations based on explicit consent at any time.

Supplementary Section — Disclosure Regarding Partner Panel (Marketing Partner) Membership

This supplementary disclosure applies to natural persons who register as members of the Partner Panel (marketing partner / affiliate programme) on our Site.

Personal data processed: full name, e-mail address, phone number, password (never in plain text; stored only as a salted one-way hash), partner code, commission rate and balance/transaction records, together with timestamps of membership and consent transactions and security records (including IP address). E-mail verification links and one-time login codes (OTP) are also processed for membership and login security purposes.

Purposes and legal bases: Establishing and performing the membership relationship and operating the partner code and commission/balance accounts rely on Article 5/2(c) of the KVKK ('processing directly related to the conclusion or performance of a contract'); security and audit records rely on legitimate interest under Article 5/2(f). These data are mandatory elements of membership and are not subject to separate explicit consent; membership itself is entirely voluntary.

Processing subject to explicit consent: Sending commercial electronic messages (e-mail) for campaigns/announcements and adding you to the partners' WhatsApp group are based SOLELY on the EXPLICIT CONSENT you may optionally give during or after registration (KVKK Art. 5/1; Law No. 6563 Art. 6). Not giving consent does not affect your membership in any way (consent is never a condition of membership). You may withdraw your consent at any time, without giving reasons, from the Communication Preferences section of the Partner Panel or via the opt-out link in the e-mails sent. Consent and withdrawal transactions are recorded with date and text-version information for evidentiary purposes.

Quotes received with your code (lead visibility): When customers use your partner code in a quote form, your panel shows ONLY the masked form of the customer's full name, the quote date, the source and the list of quoted products/categories (legitimate interest under KVKK Art. 5/2(f); data minimisation). The customer's phone, e-mail, company and message details are not shown to you. This information may be used solely for commission/partnership tracking; any other use or sharing with third parties is prohibited.

14. Amendments to the Disclosure Notice

Our Company reserves the right to amend this Disclosure Notice in line with changes in legislation and updates to business processes. The current version of the notice is always published at https://filofis.com/.

Effective / Last Updated Date: 5 July 2026

Controlling Language

This English translation is provided for information purposes only. In the event of any discrepancy or dispute, the Turkish version published on https://filofis.com/ shall prevail.