Chef Seasons Corporation – Data Policy

1. Purpose

As Chef Seasons Corporation, our priority is to ensure that the personal data of natural persons — including our members, customers, visitors, suppliers and employees — is processed in accordance with international human rights conventions and the data protection laws of the countries in which we operate — including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, applicable US state privacy laws such as the California Consumer Privacy Act ("CCPA"), and Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK") (together, "Applicable Data Protection Laws"), and that data subjects can effectively exercise their rights.

Accordingly, we carry out all processing, storage and transfer of personal data obtained in the course of our activities — including, without limitation, data of our employees, suppliers, customers, visitors, members, and users visiting our stores, website and mobile applications — in accordance with the Chef Seasons Corporation Personal Data Protection and Processing Policy (the "Policy").

The protection of personal data and respect for the fundamental rights and freedoms of the natural persons whose data we collect is the core principle of our policy on processing personal data. We therefore conduct all activities involving personal data with due regard to the protection of private life, the confidentiality of personal information, the confidentiality of communications, freedom of thought and belief, and the right to effective legal remedies.

To protect personal data, we take all administrative and technical protective measures required by the nature of the data, in line with the legislation and current technology.

This Policy explains the methods we follow for processing, storing, transferring and deleting or anonymising personal data shared during our commercial, promotional and marketing, social responsibility and similar activities, within the framework of the principles set out in Applicable Data Protection Laws.

2. Scope

All personal data processed by the Company — including that of our visitors, business contacts, business partners, employees, suppliers, members and third parties — is within the scope of this Policy.

This Policy applies to all activities involving the processing of personal data owned or managed by the Company. It has been prepared with regard to Applicable Data Protection Laws and international standards in this field.

3. Definitions and Abbreviations

This section briefly explains the specific terms, expressions, concepts and abbreviations used in the Policy.

4. Roles and Responsibilities

4.1 Board of Directors

The Board of Directors is responsible for the overall supervision of establishing and operating notification, investigation and sanction mechanisms in case of non-compliance with the Policy, rules and regulations.

The Personal Data Protection and Processing Policy has been approved by the Board of Directors.

The Board is the authorised approval mechanism for ensuring that the Policy is established, implemented and, where necessary, updated.

4.2 Audit Unit

The Audit Unit is responsible for taking the measures necessary to ensure that employees on duty, as well as outsourced service providers, comply with the Policy, and for investigating matters that are contrary to the Policy.

4.3 Information Systems Committee

The Information Systems Committee is responsible for preparing, developing, implementing and updating this Policy. It evaluates the Policy for currency and development needs when necessary. Publishing the document on the corporate portal is the responsibility of the Information Systems Committee Manager.

5. Legal Obligations

As data controller under Applicable Data Protection Laws, our legal obligations regarding the protection and processing of personal data are set out below.

5.1 Our obligation to inform

As data controller, when collecting personal data we are obliged to inform the Data Subject of:

• the purpose for which your personal data will be processed;
• our identity and, if any, the identity of our representative;
• to whom and for what purpose the processed personal data may be transferred;
• our method of collecting the data and its legal basis;
• your rights arising from the law.

As a Company, we take care that this Policy, which is available to the public, is clear, understandable and easily accessible.

5.2 Our obligation to ensure data security

As data controller, we take the administrative and technical measures stipulated in the legislation to ensure the security of the personal data in our custody. Obligations relating to data security and the measures taken are detailed in Sections 9 and 10 of this Policy.

6. Classification of Personal Data

6.1 Personal data

Personal data is any information relating to an identified or identifiable natural person.

The protection of personal data relates only to natural persons; information belonging to legal entities that contains no information about a natural person is excluded from personal data protection. Therefore, this Policy does not apply to data belonging to legal entities.

6.2 Special categories of personal data

Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data.

7. Processing of Personal Data

7.1 Our principles for processing personal data

We process personal data in accordance with the principles below.

7.1.1 Processing lawfully and in good faith. We process personal data in accordance with the rules of good faith, transparently and within the scope of our obligation to inform.

7.1.2 Ensuring personal data is accurate and, where necessary, up to date. We take the necessary measures in our data processing procedures to ensure that the data processed is accurate and up to date. We also enable the Data Subject to apply to us to update their existing data and to correct any errors in the data processed.

7.1.3 Processing for specified, explicit and legitimate purposes. As a Company, we process personal data for legitimate purposes determined in order to carry out our activities, with clearly defined scope and content, within the framework of the legislation and the ordinary course of business.

7.1.4 Personal data being relevant, limited and proportionate to the purposes of processing. We process personal data in a manner that is relevant, limited and proportionate to the purposes we have clearly and precisely determined. We avoid processing personal data that is not relevant or not needed. Therefore, unless legally required, we do not process special categories of personal data, or, where we need to process them, we obtain explicit consent for that matter.

7.1.5 Storing personal data for the period prescribed by law and for the duration of our legitimate

commercial interests. Many provisions of the legislation require personal data to be stored for a certain period. We therefore store the personal data we process for the period prescribed by the relevant legislation or required for the purposes of processing. When the storage period prescribed by the legislation expires or the purpose of processing no longer exists, we delete, destroy or anonymise the personal data. Our principles and procedures on storage periods are detailed in Section 9.1 of this Policy.

7.2 Our purposes for processing personal data

We process personal data for the following purposes:

• Conducting our commercial activities
• Providing support services under contracts and within our service standards
• Identifying the preferences and needs of our members and visitors, and shaping and updating our services accordingly
• Fulfilling our legal obligations as required or mandated by law
• Evaluating job applications
• Communicating with persons in a business relationship with the Company
• Marketing
• Supporting the training, development and career processes of our employees
• Compliance management
• Vendor / supplier management
• Statutory reporting
• Invoicing
• Operating the Chef Seasons Membership System
• Facilitating communication between Chef Seasons job candidates and employers
• Managing call centre processes
• Corporate communications
• Specifically for Chef Seasons, ensuring contact between the company and the shipping or technical service provider after a product purchase
• Sending newsletters, carrying out marketing activities and sending notifications by SMS and email

7.3 Processing of special categories of personal data

Special categories of personal data are processed by us with the administrative and technical measures prescribed by law and by the competent Supervisory Authorities, where explicit consent exists or where the legislation requires it.

Special categories of personal data relating to health and sex life may be processed only by persons under a duty of confidentiality, or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing. Therefore, such data is not processed by us, except for the data of our employees. Such data belonging to our employees may be processed by the persons specified by law.

7.4 Processing of personal data collected through cookies

We use cookies to improve the functioning and use of our websites and mobile applications, and to make the time you spend on our digital platforms more efficient and enjoyable. In addition, we use certain cookies to remember the choices you make on our websites and mobile applications, so that we can provide you with an enhanced and personalised experience.

We may collect your personal data through cookies on our digital platforms, and process, transfer and store the data we collect.

Detailed information on the cookies we use is available in the "Chef Seasons Privacy Policy".

7.5 Processing of personal data for recruitment and employment purposes

We process, store and transfer the personal data contained in your CV, diploma, photograph and other documents that you share with us during the application process as a job candidate, for the purpose of evaluating your application. The processing, transfer and storage of personal data shared by job candidates is within the scope of this Policy.

Personal data of Employees is collected, processed and stored outside this Policy, within the framework of Chef Seasons Human Resources.

7.6 Processing of personal data collected in connection with job applications

Personal data obtained through application forms, CVs and applications made via intermediary agencies will be recorded for use in evaluating the job application. Applicants are advised to review the personal data processing and privacy policies.

Those applying via the Application Form create a CV by sharing the following information:

• Identity information (name, surname, date of birth, national ID number)
• Contact information (address, email address, telephone number, etc.)
• Education information (schools graduated from, etc.)
• Work experience
• Foreign language skills
• Computer skills
• Certificates
• References
• Photograph
• Health data
• General information such as driving licence / ability to travel

Depending on the nature of the application, the above information is requested from the candidate creating the CV in order to assess whether they are qualified for the job; the employer may additionally request a photograph and health data. Health information requested is processed solely for employment purposes within the scope of the relevant legislation.

Information shared by applicants in their CVs may be viewed by employer companies. Within the scope of the legislation, the Company stores the APPLICANT's identity, education and professional information and may transfer this data to solution partners and to public institutions and organisations upon request.

The deletion, destruction or anonymisation of personal data within this platform falls under Section 9 of this Policy. If the job application process ends negatively, the processing and security of the personal data shared with the employer is the responsibility of the employer.

7.7 Processing of personal data collected in connection with purchases

When a purchase is made, the CUSTOMER's financial information is transferred to persons and institutions such as banks or credit card companies in order to complete the transaction. The data transferred is payment-related data such as:

• credit card number
• expiry date
• CVV2
• or bank account information.

During the purchase, the customer's invoice and payment information (name, surname, national ID number, telephone number, billing address), invoices sent, copies of receipts for payments received from members, payment number, invoice amount, invoice number and invoice date are collected. This data is processed for managing the invoicing process, accounting, after-sales services, communication, marketing, auditing, control, and processes carried out with payment service providers. Credit card information is not kept in Chef Seasons databases.

During purchases, video recording is carried out in stores for security purposes and to monitor checkout transactions. For distance sales made by telephone, calls are recorded to ensure secure sales.

The above data is transferred and shared with third parties in accordance with Section 8 of this Policy. The deletion, destruction or anonymisation of personal data within this platform falls under Section 9 of this Policy.

7.8 Exceptional cases where explicit consent is not required for processing personal data

In the following exceptional cases arising from the law, we may process personal data without obtaining explicit consent:

• It is expressly provided for by law.
• Processing the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract.
• Processing is mandatory for the establishment, exercise or protection of a right.
• Processing your data is mandatory for our legitimate interests as data controller, provided that it does not harm fundamental rights and freedoms.

The exceptional cases in which special categories of personal data may be processed without the Data Subject's explicit consent are set out in Section 7.3 of this Policy.

8. Transfer of Personal Data

8.1 Transfers of personal data to third parties

As a Company, we act in line with Applicable Data Protection Laws and the decisions and regulations issued by the competent Supervisory Authorities regarding the transfer of personal data.

Subject to the exceptions in the legislation, personal data and special categories of personal data are not transferred by us to other natural or legal persons without the Data Subject's explicit consent or another legal basis permitted by Applicable Data Protection Laws.

In the exceptional cases provided for by Applicable Data Protection Laws, data may be transferred without the Data Subject's explicit consent to the administrative or judicial authorities or organisations authorised by law, in the manner and within the limits prescribed by the legislation.

In addition, in the exceptional cases provided for by the legislation, and:

• in the cases explained in the Policy;
• regarding special categories of personal data, in the cases listed in the Policy;

provided that the measures required by the competent Supervisory Authorities and the relevant legislation are taken, personal data relating to the Data Subject's health and other special categories of personal data may be transferred without explicit consent only to persons under a duty of confidentiality, or to authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

8.2 International transfers of personal data

As a rule, personal data is not transferred abroad without the Data Subject's explicit consent. However, where one of the exceptional cases in this Policy applies, personal data may be transferred abroad without explicit consent if the third party abroad:

• is located in a country recognised by the competent Supervisory Authority as providing an adequate level of protection; or
• where located in a country without adequate protection, the data controllers in the exporting and importing countries undertake in writing to provide adequate protection — for example through Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum or the standard contracts issued under KVKK — and any permission or notification required by the competent Supervisory Authority is obtained or made.

8.2.1 International transfers for the provision of our services and marketing activities

We work with service providers located abroad for purposes such as developing our website and digital platforms, conducting surveys, increasing the variety of products and services according to the preferences of visitors and members, and measuring user experience. We recommend reviewing the relevant policies of the service providers we cooperate with regarding the processing and protection of personal data.

8.3 Institutions and organisations to which personal data is transferred

Personal data may be transferred, in accordance with the principles and rules explained above, to:

• our suppliers;
• our business partners and business contacts;
• technical service providers;
• shipping companies;
• cargo companies;
• legally authorised public institutions and organisations;
• legally authorised private law persons;
• our shareholders and group companies;
• independent audit firms.

8.4 Measures we take to ensure lawful transfer of personal data

8.4.1 Technical measures

To protect personal data, including but not limited to the following, we:

• establish an internal technical organisation for processing and storing personal data in compliance with the legislation;
• build the technical infrastructure to ensure the security of the databases in which your personal data is stored;
• monitor and audit the processes of the technical infrastructure established;
• set procedures for reporting the technical measures we take and our audit processes;
• periodically update and renew our technical measures;
• re-examine risky situations and develop the necessary technological solutions;
• use antivirus systems, firewalls and similar software or hardware security products, and install security systems in line with technological developments;
• employ staff with expertise in technical matters.

8.4.2 Administrative measures

To protect your personal data, including but not limited to the following, we:

• establish policies and procedures for access to personal data, including for employees of the Company and its affiliates;
• inform and train our employees on the lawful protection and processing of personal data;
• record, in our contracts with employees and/or in our Policies, the measures to be taken if employees process personal data unlawfully;
• audit the personal data processing activities of the data processors we work with and their partners.

9. Storage of Personal Data

9.1 Storing personal data for the period prescribed by the relevant legislation or required for the purpose of processing

Subject to the retention periods prescribed by the legislation, we store personal data for as long as the purpose of processing requires.

Where we process personal data for more than one purpose, the data is deleted, destroyed or anonymised once all purposes of processing have ceased, or upon the Data Subject's request where there is no legal obstacle to deletion. In deleting, destroying or anonymising data, we comply with the provisions of the legislation and the decisions of the competent Supervisory Authorities.

9.2 Measures we take regarding the storage of personal data

9.2.1 Technical measures

We:

• establish technical infrastructures, and related audit mechanisms, for deleting, destroying and anonymising personal data;
• take the necessary measures to store personal data securely;
• employ staff with technical expertise;
• develop business continuity and emergency plans against potential risks, and systems for implementing them;
• install security systems for personal data storage areas in line with technological developments.

9.2.2 Administrative measures

We:

• raise awareness among our employees by informing them of the technical and administrative risks relating to the storage of personal data;
• where we cooperate with third parties for the storage of personal data, include in our contracts with the companies to which personal data is transferred provisions requiring them to take the security measures necessary to protect and securely store the personal data transferred.

10. Security of Personal Data

10.1 Our obligations regarding the security of personal data

We take administrative and technical measures, in line with available technology and implementation costs, to:

• prevent the unlawful processing of personal data;
• prevent unlawful access to personal data;
• ensure that personal data is stored lawfully.

10.2 Measures we take to prevent unlawful processing of personal data

We:

• carry out, and have carried out, the necessary audits within our Company;
• train and inform our employees on the lawful processing of personal data;
• evaluate the activities carried out by our Company in detail for each business unit, and process personal data specifically for the commercial activities carried out by the relevant units as a result of that evaluation;
• where we cooperate with third parties for processing personal data, include in our contracts with the companies processing personal data provisions requiring them to take the necessary security measures;
• in the event of unlawful disclosure of personal data or a data leak, notify the competent Supervisory Authority and carry out the investigations and take the measures required by the legislation.

10.2.1 Technical and administrative measures taken to prevent unlawful access to personal data

To prevent unlawful access to personal data, we:

• employ staff with technical expertise;
• periodically update and renew our technical measures;
• establish access authorisation procedures within our Company;
• set procedures for reporting the technical measures we take and our audit processes;
• set up the data filing systems used within our Company in compliance with the legislation and audit them periodically;
• develop emergency plans against potential risks and systems for implementing them;
• train and inform our employees on access to personal data and authorisation;
• where we cooperate with third parties for activities such as processing and storing personal data, include in our contracts with the companies that have access to personal data provisions requiring them to take the necessary security measures;
• install security systems, in line with technological developments, to prevent unlawful access to personal data.

10.2.2 Measures we take in the event of unlawful disclosure of personal data

We take administrative and technical measures to prevent the unlawful disclosure of personal data and update them in accordance with our procedures. We establish systems and infrastructure to notify the Data Subject and the competent Supervisory Authority if we detect that personal data has been disclosed without authorisation, within the periods required by Applicable Data Protection Laws.

If, despite all administrative and technical measures taken, an unlawful disclosure occurs, it may be announced by the competent Supervisory Authority on its website or by other means, where that authority deems it necessary.

11. Rights of the Data Subject

Within the scope of our obligation to inform, we inform the Data Subject and establish systems and infrastructure for this purpose. We make the technical and administrative arrangements necessary for the Data Subject to exercise their rights regarding their personal data.

The Data Subject has the right, regarding their personal data, to:

• learn whether their personal data is processed;
• request information if their personal data has been processed;
• learn the purpose of processing and whether the data is used in line with that purpose;
• know the third parties, in their country or abroad, to whom their personal data is transferred;
• request correction of personal data that is incomplete or inaccurately processed;
• request deletion or destruction of personal data where the reasons requiring its processing no longer exist;
• request that the correction, deletion or destruction above be notified to the third parties to whom the personal data has been transferred;
• object to an adverse outcome arising from the analysis of processed data exclusively through automated systems;
• claim compensation for damage suffered due to unlawful processing of personal data.

Depending on the Applicable Data Protection Laws in the Data Subject's place of residence, the Data Subject may also have additional rights, such as the right to data portability, to restrict processing, to object to processing and direct marketing, to withdraw consent at any time, and to opt out of the sale or sharing of personal information. We will not discriminate against any Data Subject for exercising these rights.

11.1 Exercising rights regarding personal data

The Data Subject may submit their request regarding their personal data:

• in writing, with a wet signature, to Chef Seasons Corporation, 11417 IRVING PARK ROAD SUITE A-19-1, 60131/3882 ZIP CODE (POSTAL CODE), FRANKLIN PARK ILLINOIS, CHICAGO UNITED STATES TEL:+1 2245494043;
• by email to info@chefseasons.com;
• if their email address is registered in our system, to siparis@chefseasons.com.

The application must include:

• (a) name, surname and, if the application is in writing, signature;
• (b) a national identity number, or for foreign nationals, nationality and passport number or identity number if any;
• (c) residential or business address for notification;
• (d) email address, telephone and fax number for notification, if any;
• (e) the subject of the request.

Relevant information and documents are attached to the application. For written applications, the date of service is the application date. For applications made by other methods, the date the application reaches us is the application date.

Requests must be made individually; requests regarding personal data made by unauthorised third parties will not be considered.

11.2 Evaluation of the application

11.2.1 Response time

Requests regarding personal data are concluded as soon as possible according to their nature, and in any event within 30 (thirty) days at the latest, or within any shorter period required by Applicable Data Protection Laws, free of charge, or against the fee set out in any tariff published by the competent Supervisory Authority where its conditions are met.

Additional information and documents may be requested during the application or while it is being evaluated.

11.2.2 Our right to refuse an application

Applications regarding personal data will be refused, with reasons, where:

• personal data is processed for purposes such as research, marketing, planning and statistics by being anonymised through official statistics;
• personal data is processed for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that it does not violate privacy or personal rights or constitute a crime;
• personal data made public by the Data Subject is processed;
• the application is not based on a justified reason;
• the application contains a request contrary to the relevant legislation;
• the application procedure is not followed.

11.3 Procedure for evaluating the application

For the response period specified in this Policy to start, requests must be sent by the methods in Section 11.1, together with information and documents verifying the applicant's identity.

If the request is accepted, the relevant action is taken and notification is made in writing or electronically. If the request is refused, the applicant is notified in writing or electronically, with the reasons explained.

11.4 Right to complain to the Supervisory Authority

If the application is refused, the response is found insufficient, or no response is given in time, the applicant has the right to lodge a complaint with the competent Supervisory Authority in their country of residence, place of work or place of the alleged infringement, within the periods prescribed by Applicable Data Protection Laws. For data subjects in Türkiye, this period is 30 (thirty) days from the date the applicant learns of the response, and in any event 60 (sixty) days from the date of application.

12. Publication and Storage of the Document

This Policy is stored in two different media: printed on paper and electronically.

13. Update Period

This Policy is reviewed at least once every two years and updated as needed in accordance with its principles.

14. Effectiveness

This Policy is deemed to have entered into force upon its publication on the Company's website.

15. Repeal

If it is decided to repeal this Policy, the old wet-signed copies of the Policy are cancelled by the Legal Department with the written approval of the Department Manager (by stamping or writing "cancelled" on them), signed, and kept by the Legal Department for 5 years.